Live and recent posts from across the Fediverse tagged #tenda, aggregated by home.social.
π CVE-2026-105293 - High (8.1)
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as thro...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105293/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105295 - High (7.5)
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid ...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105295/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105220 - High (7.8)
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScra...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105220/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105219 - High (7.5)
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an untermina...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105219/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105089 - High (8.7)
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and chann...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105089/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105086 - High (8.7)
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entitie...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105086/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-105135 - Critical (10)
A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection....
π https://www.thehackerwire.com/vulnerability/CVE-2026-105135/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-105134 - Critical (10)
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comman...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105134/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-103355 - Critical (9.3)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection...
π https://www.thehackerwire.com/vulnerability/CVE-2026-103355/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-97307 - High (7.5)
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
π https://www.thehackerwire.com/vulnerability/CVE-2026-97307/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105208 - High (7.7)
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An atta...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105208/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-105207 - Critical (9.8)
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User S...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105207/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-105215 - Critical (9.1)
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105215/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105213 - High (8.2)
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refres...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105213/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105212 - High (7.5)
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105212/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105211 - High (8.1)
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with ...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105211/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105210 - High (8.2)
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Att...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105210/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-105209 - Critical (9.6)
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organizat...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105209/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-105123 - High (8.8)
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php file...
π https://www.thehackerwire.com/vulnerability/CVE-2026-105123/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-103628 - Critical (9.6)
Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
π https://www.thehackerwire.com/vulnerability/CVE-2026-103628/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-103626 - Critical (9.6)
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securi...
π https://www.thehackerwire.com/vulnerability/CVE-2026-103626/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-103625 - High (8.8)
Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
π https://www.thehackerwire.com/vulnerability/CVE-2026-103625/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-103624 - High (8.3)
Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu...
π https://www.thehackerwire.com/vulnerability/CVE-2026-103624/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-103622 - High (8.8)
Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
π https://www.thehackerwire.com/vulnerability/CVE-2026-103622/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-51916 - High (7.5)
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowle...
π https://www.thehackerwire.com/vulnerability/CVE-2026-51916/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-51907 - High (8.1)
In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.
π https://www.thehackerwire.com/vulnerability/CVE-2026-51907/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-67989 - High (7.5)
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x
π https://www.thehackerwire.com/vulnerability/CVE-2026-67989/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-103956 - Critical (10)
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integ...
π https://www.thehackerwire.com/vulnerability/CVE-2026-103956/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-103958 - High (7.6)
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from ...
π https://www.thehackerwire.com/vulnerability/CVE-2026-103958/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-96940 - High (8.8)
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
π https://www.thehackerwire.com/vulnerability/CVE-2026-96940/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-104019 - Critical (9)
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as...
π https://www.thehackerwire.com/vulnerability/CVE-2026-104019/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-104988 - High (8.1)
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retai...
π https://www.thehackerwire.com/vulnerability/CVE-2026-104988/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-39718 - High (8.8)
Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.
π https://www.thehackerwire.com/vulnerability/CVE-2026-39718/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-82039 - High (8.8)
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanit...
π https://www.thehackerwire.com/vulnerability/CVE-2026-82039/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-82044 - High (7.7)
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() meth...
π https://www.thehackerwire.com/vulnerability/CVE-2026-82044/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-82042 - Critical (9.8)
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which t...
π https://www.thehackerwire.com/vulnerability/CVE-2026-82042/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-82041 - Critical (9.9)
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before for...
π https://www.thehackerwire.com/vulnerability/CVE-2026-82041/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-97363 - High (7.5)
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
π https://www.thehackerwire.com/vulnerability/CVE-2026-97363/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-95102 - Critical (9.4)
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given t...
π https://www.thehackerwire.com/vulnerability/CVE-2026-95102/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-94593 - High (7.8)
Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access...
π https://www.thehackerwire.com/vulnerability/CVE-2026-94593/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-91078 - High (8.2)
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone wit...
π https://www.thehackerwire.com/vulnerability/CVE-2026-91078/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-89236 - High (8.6)
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive info...
π https://www.thehackerwire.com/vulnerability/CVE-2026-89236/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-88783 - High (8.8)
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to...
π https://www.thehackerwire.com/vulnerability/CVE-2026-88783/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-96451 - High (8.8)
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
π https://www.thehackerwire.com/vulnerability/CVE-2026-96451/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-101923 - High (8.1)
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of ...
π https://www.thehackerwire.com/vulnerability/CVE-2026-101923/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-103913 - High (7.5)
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation o...
π https://www.thehackerwire.com/vulnerability/CVE-2026-103913/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-97337 - High (7.5)
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are ...
π https://www.thehackerwire.com/vulnerability/CVE-2026-97337/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-18443 - High (8.8)
The Smart Manager β Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping...
π https://www.thehackerwire.com/vulnerability/CVE-2026-18443/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π΄ CVE-2026-87115 - Critical (9.1)
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for u...
π https://www.thehackerwire.com/vulnerability/CVE-2026-87115/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
π CVE-2026-75028 - High (7.5)
The WPCafe β Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authe...
π https://www.thehackerwire.com/vulnerability/CVE-2026-75028/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack