Live and recent posts from across the Fediverse tagged #vulnerability, aggregated by home.social.
🚨 EUVD-2026-124340
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Telerik UI for WinForms
🏢 Vendor: Progress Software
📅 Updated: 2026-11-12
📝 In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124340
🚨 EUVD-2026-124341
📊 Score: 6.5/10 (CVSS v3.1)
📅 Updated: 2026-11-12
📝 A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled (host_key_auto_add on the libssh connection plugin, or AutoAddPolicy in ansible-pylibssh), a host that is already present in known_hosts but now...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124341
🚨 EUVD-2026-124342
📊 Score: 6.5/10 (CVSS v3.1)
📅 Updated: 2026-11-12
📝 A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated Automa...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124342
🚨 EUVD-2026-124343
📊 Score: 3.9/10 (CVSS v3.1)
📅 Updated: 2026-11-12
📝 A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user repla...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124343
🚨 EUVD-2026-124344
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Telerik UI for WPF
🏢 Vendor: Progress Software
📅 Updated: 2026-11-12
📝 In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124344
🚨 EUVD-2026-124346
📊 Score: 2.7/10 (CVSS v3.1)
📦 Product: Qt Framework, Qt Framework
🏢 Vendor: Qt
📅 Updated: 2026-11-12
📝 Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124346
🚨 EUVD-2026-124345
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Telerik UI for WPF
🏢 Vendor: Progress Software
📅 Updated: 2026-11-12
📝 In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124345
🚨 EUVD-2026-122647
📊 Score: n/a
📅 Published: 2026-11-10 | Updated: 2026-11-12
📝 This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122647
🚨 EUVD-2026-124347
📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: CourseCure Courses
🏢 Vendor: Wishlist Member
📅 Updated: 2026-11-12
📝 The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST param...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124347
🚨 EUVD-2026-124349
📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: VibeBP
🏢 Vendor: vibethemes
📅 Updated: 2026-11-12
📝 The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it po...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124349
🚨 EUVD-2026-124348
📊 Score: 5.4/10 (CVSS v3.1)
📦 Product: WP Table Builder – Drag & Drop Table Builder
🏢 Vendor: wptb
📅 Updated: 2026-11-12
📝 The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124348
🚨 EUVD-2026-124350
📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: Masterstudy - Education WordPress Theme
🏢 Vendor: StylemixThemes
📅 Updated: 2026-11-12
📝 The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `ma...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124350
🚨 EUVD-2026-124351
📊 Score: 8.6/10 (CVSS v3.1)
📦 Product: WebFOCUS, WebFOCUS, WebFOCUS
🏢 Vendor: ibi
📅 Updated: 2026-11-12
📝 Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.
This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124351
CVE-2026-119618
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
🟠 CVE-2026-124704 - High (7.8)
In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-124704/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🟠 CVE-2026-124703 - High (7.8)
In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application.
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-124703/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🟠 CVE-2026-124701 - High (7.8)
In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-124701/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
Lessons from 59 Linux Kernel Bug Reports - https://www.redpacketsecurity.com/lessons-from-59-linux-kernel-bug-reports/
#threatintel
#Linux Kernel
#Vulnerability Research
#AI-Powered Security
#Privilege Escalation
#CVE Analysis
🚨 EUVD-2026-124334
📊 Score: 7.3/10 (CVSS v3.1)
📦 Product: Telerik Reporting
🏢 Vendor: Progress Software
📅 Updated: 2026-11-12
📝 In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124334
🚨 EUVD-2026-124336
📊 Score: 6.5/10 (CVSS v3.1)
📦 Product: Telerik Reporting
🏢 Vendor: Progress Software
📅 Updated: 2026-11-12
📝 In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a repo...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124336
🚨 EUVD-2026-124335
📊 Score: 9.2/10 (CVSS v3.1)
📦 Product: misp-modules
🏢 Vendor: MISP
📅 Updated: 2026-11-12
📝 The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the applicat...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124335
🚨 EUVD-2026-124337
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Telerik UI for WinForms
🏢 Vendor: Progress Software
📅 Updated: 2026-11-12
📝 In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affe...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124337
🚨 EUVD-2026-124338
📊 Score: n/a
📦 Product: Apache Sling XSS
🏢 Vendor: Apache Software Foundation
📅 Updated: 2026-11-12
📝 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124338
🚨 EUVD-2026-124339
📊 Score: n/a
📦 Product: Apache Axis2/C, Apache Axis2/C
🏢 Vendor: Apache Software Foundation
📅 Updated: 2026-11-12
📝 Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124339
🟠 CVE-2026-13672 - High (8.8)
An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-...
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13672/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🟠 CVE-2026-19048 - High (8.1)
An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19048/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🟠 CVE-2026-18792 - High (8.8)
An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and con...
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18792/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🟠 CVE-2026-124699 - High (7.8)
In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-124699/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
MongoDB Server contains a high-severity flaw tracked as CVE-2026-118383 with a 9.5 CVSS rating.
An unauthenticated attacker can trigger a server crash under specific conditions involving lagging replica sets and primary catch-up cleanup.
MongoDB discovered the issue internally and released patched versions.
Cloud-managed clusters receive automatic updates, while self-managed deployments require manual patching across…
🚨 EUVD-2026-124267
📊 Score: 8.6/10 (CVSS v3.1)
📦 Product: Air Terminal 6
🏢 Vendor: SoftBank Corp.
📅 Updated: 2026-11-12
📝 An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124267
🚨 EUVD-2026-63137
📊 Score: 8.4/10 (CVSS v3.1)
📦 Product: Aodh, Aodh, Aodh
🏢 Vendor: OpenStack
📅 Published: 2026-08-19 | Updated: 2026-11-12
📝 In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63137
CVE-2026-101107: HIGH severity OS command injection in SoftBank Air Terminal 6 (0 – 1.01.80) allows authenticated console users root command execution 🖥️. Patch status unconfirmed — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-101107-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-bcce6251ee5f1a39 #OffSeq #Vulnerability #SoftBank #InfoSec
🚨 EUVD-2026-124251
📊 Score: 4.3/10 (CVSS v3.1)
📦 Product: DiskStation Manager (DSM), DiskStation Manager (DSM)
🏢 Vendor: Synology
📅 Updated: 2026-11-12
📝 A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124251
🚨 EUVD-2026-124252
📊 Score: 4.3/10 (CVSS v3.1)
📦 Product: DiskStation Manager (DSM), DiskStation Manager (DSM)
🏢 Vendor: Synology
📅 Updated: 2026-11-12
📝 An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write spec...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124252
🚨 EUVD-2026-124254
📊 Score: 9.8/10 (CVSS v3.1)
📦 Product: DiskStation Manager (DSM), DiskStation Manager (DSM), DiskStation Manager (DSM) (+1 more)
🏢 Vendor: Synology
📅 Updated: 2026-11-12
📝 An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124254
🚨 EUVD-2026-124253
📊 Score: 8.6/10 (CVSS v3.1)
📦 Product: DiskStation Manager (DSM), DiskStation Manager (DSM), DiskStation Manager (DSM) (+1 more)
🏢 Vendor: Synology
📅 Updated: 2026-11-12
📝 An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-860...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124253
🚨 EUVD-2026-124255
📊 Score: 8.6/10 (CVSS v3.1)
📦 Product: iSulad
🏢 Vendor: openEuler
📅 Updated: 2026-11-12
📝 UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
If an attacker can get the victim...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124255
🚨 EUVD-2026-124256
📊 Score: 5.6/10 (CVSS v3.1)
📦 Product: iSulad
🏢 Vendor: openEuler
📅 Updated: 2026-11-12
📝 Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
When the iSulad daemon perf...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124256
🚨 EUVD-2026-124257
📊 Score: 7.4/10 (CVSS v3.1)
📦 Product: iSulad
🏢 Vendor: openEuler
📅 Updated: 2026-11-12
📝 Relative path traversal vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
In oci_load.c, oci_load_process_manifest() doe...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124257
🚨 EUVD-2026-124258
📊 Score: 4.4/10 (CVSS v3.1)
📦 Product: iSulad
🏢 Vendor: openEuler
📅 Updated: 2026-11-12
📝 Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
The memory leak vulne...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124258
CVE-2026-126855 – HIGH severity in Chrome ImageCapture (<157.0.8103.78): Compromised renderer can bypass web origin policy, risking unauthorized access. Update Chrome ASAP. https://radar.offseq.com/threat/cve-2026-126855-cwe-862-missing-authorization-in-google-chrome-e1f03524124b863b #OffSeq #Chrome #Infosec #Vulnerability
🟠 CVE-2026-121744 - High (7.8)
Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is requi...
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121744/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🟠 CVE-2026-121743 - High (7.8)
Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is requir...
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121743/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🟠 CVE-2026-121742 - High (7.8)
Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploi...
🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121742/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
🚨 EUVD-2026-124166
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Origin Viewer
🏢 Vendor: OriginLab
📅 Updated: 2026-11-12
📝 OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124166
🚨 EUVD-2026-124169
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Origin Viewer
🏢 Vendor: OriginLab
📅 Updated: 2026-11-12
📝 OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is requir...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124169
🚨 EUVD-2026-124167
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Origin Viewer
🏢 Vendor: OriginLab
📅 Updated: 2026-11-12
📝 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is require...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124167
🚨 EUVD-2026-124168
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Origin Viewer
🏢 Vendor: OriginLab
📅 Updated: 2026-11-12
📝 OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is require...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124168
🚨 EUVD-2026-124171
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Origin Viewer
🏢 Vendor: OriginLab
📅 Updated: 2026-11-12
📝 OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction i...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124171
🚨 EUVD-2026-124170
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Origin Viewer
🏢 Vendor: OriginLab
📅 Updated: 2026-11-12
📝 OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is requir...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124170