home.social

#vuln — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #vuln, aggregated by home.social.

  1. CVE-2026-16227: SQL injection in SourceCodester Class and Exam Timetabling System v1.0 (/edit_subject.php, ID param). MEDIUM severity (CVSS 6.9). No patch yet — use input validation & parameterized queries. radar.offseq.com/threat/cve-20 #OffSeq #SQLInjection #AppSec #Vuln

  2. CVE-2026-16229 (MEDIUM, CVSS 5.3): XSS in itsourcecode Courier Management System v1.0 via 'page' param in /index.php. Remote exploitation possible, user interaction needed. No patch yet — use WAF and input validation. radar.offseq.com/threat/cve-20 #OffSeq #XSS #Vuln

  3. CVE-2026-16223: SSRF in 1Panel-dev CordysCRM 1.4.0 & 1.4.1 (MEDIUM, CVSS 5.3). Exploitable via appSecret — enables unauthorized server requests. No patch yet: restrict endpoint, monitor logs. radar.offseq.com/threat/cve-20 #OffSeq #SSRF #CyberSecurity #Vuln

  4. guohongze adminset (v0.1 – 0.61) is vulnerable to authorization bypass (CVE-2026-16217) via delivery/deli.py. Remote exploitation is possible, exploit is public. Severity: MEDIUM. Patch unavailable. radar.offseq.com/threat/cve-20 #OffSeq #CVE202616217 #Vuln #Infosec

  5. CVE-2026-16210: Medium severity vuln in newpanjing simpleui 2026.01.13 allows remote, unauthenticated actions via AjaxAdmin AJAX Endpoint. Exploit is public — no vendor fix yet. Restrict access or disable endpoint until patched. radar.offseq.com/threat/cve-20 #OffSeq #Vuln #SimpleUI

  6. CVE-2026-53994: ProFTPD mod_sftp heap buffer overflow (HIGH severity, CVSS 7.5) lets authenticated SFTP users crash session processes via crafted 0-length packets. Patch status unconfirmed — restrict SFTP access & monitor logs. radar.offseq.com/threat/cve-20 #OffSeq #ProFTPD #infosec #vuln

  7. CVE-2026-12228: parisneo/lollms suffers HIGH severity stored XSS (CVSS 8.7) via POST /api/prompts/share. Authenticated users can execute JS in victims' browsers, risking account takeover. Patch status unknown — check vendor updates. radar.offseq.com/threat/cve-20 #OffSeq #XSS #Vuln #InfoSec

  8. 7-Zip patched a CRITICAL RCE vulnerability — malicious archive files could allow attackers to execute code and fully compromise systems. Update to v26.02 ASAP. No CVE assigned. Full details: radar.offseq.com/threat/update #OffSeq #7zip #RCE #Vuln

  9. WordPress Core "wp2shell" CRITICAL RCE chain (CVE-2026-63030 & CVE-2026-60137) actively exploited. Affects 6.9.0 – 6.9.4 & 7.0.0 – 7.0.1. Public PoCs out. Patch to 6.9.5/7.0.2 ASAP. Block REST API endpoints as temp mitigation. radar.offseq.com/threat/wordpr #OffSeq #WordPress #RCE #Vuln

  10. CVE-2026-13446: IBM Langflow OSS 1.0.0 – 1.10.1 contains hard-coded credentials (CRITICAL, CVSS 9.8). Total system compromise possible. No patch yet — restrict access, monitor activity. More: radar.offseq.com/threat/cve-20 #OffSeq #Vuln #Cybersecurity #IBM

  11. CVE-2026-58644: CRITICAL RCE in Microsoft SharePoint enables remote, authenticated Site Owners to execute code via deserialization. Exploited in the wild — patch now (July 2026 updates). Details: radar.offseq.com/threat/fresh- #OffSeq #SharePoint #Vuln #KEV #Infosec

  12. CVE-2026-58644: CRITICAL RCE in Microsoft SharePoint enables remote, authenticated Site Owners to execute code via deserialization. Exploited in the wild — patch now (July 2026 updates). Details: radar.offseq.com/threat/fresh- #OffSeq #SharePoint #Vuln #KEV #Infosec

  13. CVE-2026-58644: CRITICAL RCE in Microsoft SharePoint enables remote, authenticated Site Owners to execute code via deserialization. Exploited in the wild — patch now (July 2026 updates). Details: radar.offseq.com/threat/fresh- #OffSeq #SharePoint #Vuln #KEV #Infosec

  14. CVE-2026-58644: CRITICAL RCE in Microsoft SharePoint enables remote, authenticated Site Owners to execute code via deserialization. Exploited in the wild — patch now (July 2026 updates). Details: radar.offseq.com/threat/fresh- #OffSeq #SharePoint #Vuln #KEV #Infosec

  15. MohibShaikh clawvet API server <0.7.5 (CVE-2026-62241) suffers a CRITICAL flaw: hard-coded JWT secret enables unauthenticated user data access and session cookie forgery. Change secrets & limit endpoint access. radar.offseq.com/threat/cve-20 #OffSeq #CVE202662241 #vuln

  16. CRITICAL: CVE-2026-63305 impacts WWBN AVideo ≤29.0. OS command injection in ffmpeg.json.php allows arbitrary command execution as the web-server user. No patch yet — restrict access & monitor logs. Details: radar.offseq.com/threat/cve-20 #OffSeq #Vuln #WWBN #CVE202663305

  17. CVE-2026-15013 | CRITICAL vuln in cyberlord92 SAML SSO Login (≤5.4.3): Signature verification flaw enables authentication bypass & admin account takeover. Disable plugin until patched. radar.offseq.com/threat/cve-20 #OffSeq #WordPress #CVE202615013 #SAML #Vuln

  18. CVE-2026-54052: CRITICAL auth bypass in czlonkowski n8n-mcp <2.56.1. Multi-tenant HTTP mode allows tenants to access/delete others’ sensitive workflow backups. Patch to 2.56.1 ASAP. radar.offseq.com/threat/cve-20 #OffSeq #CVE #infosec #vuln

  19. CVE-2026-55445: Qinglong <2.20.1 has a CRITICAL improper authentication bug (CVSS 9.3). Attackers can reset admin credentials on initialized systems via /open/user/init. Upgrade to 2.20.1 ASAP. radar.offseq.com/threat/cve-20 #OffSeq #CVE202655445 #Vuln #Qinglong

  20. CRITICAL RCE in ServiceNow AI platform (CVE-2026-6875) allows unauthenticated code execution. Patched — no active exploitation. Ivanti & Fortinet also released key updates. Patch all affected systems promptly. radar.offseq.com/threat/vulner #OffSeq #Vuln #ServiceNow #Ivanti #Fortinet

  21. Firefox 152.0.6 and Chrome 150.0.7871.124/.125 resolve CRITICAL flaws. Firefox bugs (CVE-2026-15718, CVE-2026-15719) have public exploits, but no in-the-wild attacks. Patch ASAP. Chrome fixes 15 issues. radar.offseq.com/threat/critic #OffSeq #Vuln #PatchNow #BrowserSecurity

  22. Firefox 152.0.6 and Chrome 150.0.7871.124/.125 resolve CRITICAL flaws. Firefox bugs (CVE-2026-15718, CVE-2026-15719) have public exploits, but no in-the-wild attacks. Patch ASAP. Chrome fixes 15 issues. radar.offseq.com/threat/critic #OffSeq #Vuln #PatchNow #BrowserSecurity

  23. CVE-2026-48324 (CRITICAL, CVSS 9.1): Adobe ColdFusion 2025 suffers from an SQL Injection (CWE-89) allowing arbitrary code execution. No patch confirmed — restrict access & monitor SQL activity. radar.offseq.com/threat/cve-20 #OffSeq #ColdFusion #SQLInjection #Vuln

  24. CRITICAL: CVE-2026-48334 impacts Adobe Illustrator Desktop 2026 (CVSS 9.3). Improper input validation lets attackers run code if a user opens a malicious file. No patch — open only trusted files. radar.offseq.com/threat/cve-20 #OffSeq #Adobe #Vuln #CVE202648334

  25. ASUS routers face CRITICAL risk (CVE-2026-13385, CVSS 9.5) due to improper integrity and certificate checks. MITM attackers can execute arbitrary commands. No patch yet — monitor ASUS advisories. radar.offseq.com/threat/cve-20 #OffSeq #ASUS #infosec #CVE #vuln

  26. SAP July 2026 patch day delivers CRITICAL fixes: NetWeaver (CVE-2026-44747, memory corruption), Approuter (CVE-2026-27690, HTTP smuggling), Commerce Cloud (CVE-2026-44761, hardcoded creds). Patch ASAP. radar.offseq.com/threat/sap-pa #OffSeq #SAP #Vuln #PatchTuesday

  27. Eclipse BaSyx Java Server SDK (MongoDB backend) CRITICAL vuln: CVE-2026-57898 (CVSS 9.0) allows unauthenticated path traversal & arbitrary file writes — potential RCE. Upgrade to 2.0.0-milestone-13. Details: radar.offseq.com/threat/cve-20 #OffSeq #Vuln #Java #Eclipse

  28. Deserialization of untrusted data (CVE-2026-12583, CRITICAL) in Newsletters WP plugin <4.15 allows unauthenticated RCE via public form. Disable or restrict plugin until patch is confirmed. radar.offseq.com/threat/cve-20 #OffSeq #WordPress #Vuln #RCE

  29. SAP Commerce Cloud impacted by CRITICAL CVE-2026-44761 (CVSS 9.1): Default OAuth2 credentials can let unauthenticated attackers access APIs & modify data. Change/remove sample creds now. No patch yet. radar.offseq.com/threat/cve-20 #OffSeq #SAP #OAuth2 #Vuln

  30. CVE-2026-62327 (CRITICAL): decolua 9Router ≤0.4.41 exposes plaintext API keys & usage stats via unauthenticated /api/usage/stats. No patch yet — restrict access or add auth controls. Details: radar.offseq.com/threat/cve-20 #OffSeq #CVE #APIsecurity #Vuln

  31. CVE-2026-62327 (CRITICAL): decolua 9Router ≤0.4.41 exposes plaintext API keys & usage stats via unauthenticated /api/usage/stats. No patch yet — restrict access or add auth controls. Details: radar.offseq.com/threat/cve-20 #OffSeq #CVE #APIsecurity #Vuln

  32. CVE-2026-62327 (CRITICAL): decolua 9Router ≤0.4.41 exposes plaintext API keys & usage stats via unauthenticated /api/usage/stats. No patch yet — restrict access or add auth controls. Details: radar.offseq.com/threat/cve-20 #OffSeq #CVE #APIsecurity #Vuln

  33. CVE-2026-62327 (CRITICAL): decolua 9Router ≤0.4.41 exposes plaintext API keys & usage stats via unauthenticated /api/usage/stats. No patch yet — restrict access or add auth controls. Details: radar.offseq.com/threat/cve-20 #OffSeq #CVE #APIsecurity #Vuln

  34. CVE-2026-58596 (HIGH, CVSS 8.3): Microsoft Edge (Chromium-based) suffers from untrusted pointer dereference, enabling remote privilege escalation. Patch ASAP: radar.offseq.com/threat/cve-20 🛡️ #OffSeq #MicrosoftEdge #Vuln #Infosec

  35. CVE-2026-15506: HIGH severity heap-based buffer overflow in SecureAge CatchPulse (v10.9.0 – 10.9.3, saappctl.sys). Exploitable by local attackers for code execution or DoS. No patch yet — restrict access & monitor updates. radar.offseq.com/threat/cve-20 #OffSeq #vuln #BlueTeam

  36. CVE-2026-15483: HIGH (CVSS 8.7) buffer overflow in TRENDnet TEW-821DAP 1.12B01. Remote exploitation possible via /goform/tools_nslookup. No patch — device is EOL. Upgrade or replace to secure your network. radar.offseq.com/threat/cve-20 #OffSeq #CVE2026_15483 #TRENDnet #Vuln

  37. CVE-2026-15484: HIGH-severity buffer overflow (CVSS 8.7) in TRENDnet TEW-821DAP v1.12B01 — remote code execution possible. Device is EOL; no patch. Mitigate by isolating or replacing affected units. radar.offseq.com/threat/cve-20 #OffSeq #infosec #vuln #TRENDnet

  38. Dell PowerFlex Manager <5.1.0.1 faces CRITICAL OS command injection (CVE-2026-56688, CVSS 9.1). High-priv attackers can execute root commands — full compromise risk. No patch yet. Limit admin remote access & monitor activity. radar.offseq.com/threat/cve-20 #OffSeq #Dell #Vuln #Infosec

  39. CVE-2026-14781 (MEDIUM): Red Hat Build of Keycloak flaw in OIDC broker email_verified claim sync. If trustEmail=true & userinfo enabled, attacker can mark emails as verified. Review config & monitor fixes. radar.offseq.com/threat/cve-20 #OffSeq #Keycloak #Vuln #IAM

  40. CVE-2026-14781 (MEDIUM): Red Hat Build of Keycloak flaw in OIDC broker email_verified claim sync. If trustEmail=true & userinfo enabled, attacker can mark emails as verified. Review config & monitor fixes. radar.offseq.com/threat/cve-20 #OffSeq #Keycloak #Vuln #IAM

  41. CVE-2026-14781 (MEDIUM): Red Hat Build of Keycloak flaw in OIDC broker email_verified claim sync. If trustEmail=true & userinfo enabled, attacker can mark emails as verified. Review config & monitor fixes. radar.offseq.com/threat/cve-20 #OffSeq #Keycloak #Vuln #IAM

  42. CVE-2026-14781 (MEDIUM): Red Hat Build of Keycloak flaw in OIDC broker email_verified claim sync. If trustEmail=true & userinfo enabled, attacker can mark emails as verified. Review config & monitor fixes. radar.offseq.com/threat/cve-20 #OffSeq #Keycloak #Vuln #IAM

  43. CVE-2026-14570: HIGH severity in TIMLEGGE Crypt::DSA (<1.22) — insufficiently random values in DSA signing allow attackers to recover private keys using lattice attacks. Replace all affected keys and upgrade to 1.22+. radar.offseq.com/threat/cve-20 #OffSeq #Vuln #Perl #Crypto

  44. CVE-2026-13601 (HIGH, CVSS 7.1) in Red Hat Enterprise Linux 10: Yelp’s help viewer can leak sensitive files via crafted Flatpak apps due to weak Content Security Policy. No patch yet — restrict untrusted Flatpaks. radar.offseq.com/threat/cve-20 #OffSeq #Linux #Vuln #RedHat

  45. CVE-2026-13491: MEDIUM severity DoS flaw in 78 xiaozhi-esp32 (v2.2.0 – 2.2.6) via MQTT Goodbye Handler. Exploitable remotely with public exploit. Patch via commit e182471f8c5a. radar.offseq.com/threat/cve-20 #OffSeq #Vuln #IoT #DoS

  46. CVE-2026-13486 | SQL injection in SourceCodester Class and Exam Timetabling System (v1.0/6.php). MEDIUM severity. Exploit public for /preview6.php — remote attackers can target course_year_section param. Monitor & mitigate. radar.offseq.com/threat/cve-20 #OffSeq #Vuln #SQLi #AppSec

  47. CVE-2026-53753: CRITICAL code injection in unclecode crawl4ai (<0.8.7). Unauthenticated RCE via /crawl POST request due to insufficient AST validation. Patch to 0.8.7 ASAP. radar.offseq.com/threat/cve-20 #OffSeq #CVE202653753 #infosec #vuln

  48. CVE-2026-44914: HIGH severity in Apache NiFi (1.12.0 – 2.9.0). Missing authorization lets users with write access add restricted components. Upgrade to 2.9.0 or enforce specific controls. radar.offseq.com/threat/cve-20 #OffSeq #NiFi #Vuln #Infosec

  49. CVE-2026-12780: HIGH severity vuln in AOMEI Backupper ≤8.3.0. Local attackers can abuse improper access controls in amwrtdrv.sys for potential privilege escalation. No patch available — limit local access & watch for updates. radar.offseq.com/threat/cve-20 #OffSeq #Vuln #AOMEI