#OffSeq

Offensive Sequence

@offseq.bsky.social

55 seconds ago

CVE-2026-4169: Cross Site Scripting in Tecnick TCExam CVE-2026-4169 is a cross-site scripting vulnerability identified in the Tecnick TCExam application, affecting versions 16.0 through 16.6.0. The vulnerability resides in the F_xml_export_users function of the admin/code/tce_xml_users.php fil

Tecnick TCExam (16.0 – 16.6.0) hit by MEDIUM XSS (CVE-2026-4169) in XML export. Admins: upgrade to 16.6.1, restrict admin access, & audit logs. Details: radar.offseq.com/threat/cve-2026-4169-cro... #OffSeq #XSS #PatchNow

Offensive Sequence

@offseq.bsky.social

1 hour ago

CVE-2026-4167: Stack-based Buffer Overflow in Belkin F9K1122 CVE-2026-4167 identifies a critical stack-based buffer overflow vulnerability in the Belkin F9K1122 router firmware version 1.00.33. The vulnerability resides in the formReboot function, which processes requests to the /goform/formReboot en

Belkin F9K1122 (fw 1.00.33) hit by HIGH severity stack overflow — remote code execution possible, no patch yet! Restrict access & monitor endpoints ASAP. radar.offseq.com/threat/cve-2026-4167-sta... #OffSeq #infosec #routersecurity

Offensive Sequence

@offseq.bsky.social

3 hours ago

CVE-2026-4164: Command Injection in Wavlink WL-WN578W2 CVE-2026-4164 is a command injection vulnerability identified in the Wavlink WL-WN578W2 router firmware version 221110. The vulnerability resides in the POST request handler of the /cgi-bin/wireless.cgi script, affecting functions such as D

CRITICAL: CVE-2026-4164 in Wavlink WL-WN578W2 (v221110) enables remote command injection. Public exploit available — patch ASAP or restrict web access. radar.offseq.com/threat/cve-2026-4164-com... #OffSeq #RouterSecurity #CVE

Offensive Sequence

@offseq.bsky.social

4 hours ago

CVE-2026-1947: CWE-639 Authorization Bypass Through User-Controlled Key in webaw CVE-2026-1947 is an authorization bypass vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key) affecting the NEX-Forms – Ultimate Forms Plugin for WordPress, versions up to and including 9.1.9. The vulner

HIGH severity: CVE-2026-1947 in NEX-Forms – Ultimate Forms Plugin for WordPress lets unauthenticated attackers overwrite form data. No patch yet — disable or restrict access now. radar.offseq.com/threat/cve-2026-1947-cwe... #OffSeq #WordPress #Security

Offensive Sequence

@offseq.bsky.social

6 hours ago

Critical HPE AOS-CX Vulnerability Allows Admin Password Resets The reported security threat concerns a critical vulnerability in Hewlett Packard Enterprise's AOS-CX network operating system, which powers various HPE network switches and devices. This vulnerability allows an unauthenticated remote attac

CRITICAL: HPE AOS-CX flaw allows remote, unauth attackers to reset admin passwords & control switches. Restrict access, monitor configs, and await patch. Details: radar.offseq.com/threat/critical-hpe-aos-... #OffSeq #HPE #NetworkSecurity

Offensive Sequence

@offseq.bsky.social

7 hours ago

CVE-2026-4163: Command Injection in Wavlink WL-WN579A3 CVE-2026-4163 is a critical remote command injection vulnerability identified in the Wavlink WL-WN579A3 router firmware version 220323. The vulnerability resides in the SetName/GuestWifi function within the /cgi-bin/wireless.cgi POST reques

WL-WN579A3 routers hit by CRITICAL command injection (CVE-2026-4163). Public exploit code out — restrict remote admin, monitor traffic, and patch ASAP! radar.offseq.com/threat/cve-2026-4163-com... #OffSeq #CVE20264163 #networksecurity

Offensive Sequence

@offseq.bsky.social

8 hours ago

CVE-2026-4163: Command Injection in Wavlink WL-WN579A3 CVE-2026-4163 is a critical remote command injection vulnerability identified in the Wavlink WL-WN579A3 router firmware version 220323. The vulnerability resides in the SetName/GuestWifi function within the /cgi-bin/wireless.cgi POST reques

Wavlink WL-WN579A3 (220323) faces CRITICAL CVE-2026-4163 — unauthenticated remote command injection. Exploit code is public. Restrict access & monitor traffic while awaiting patch. radar.offseq.com/threat/cve-2026-4163-com... #OffSeq #CVE20264163 #Ro...

Offensive Sequence

@offseq.bsky.social

21 hours ago

CVE-2026-32708: CWE-121: Stack-based Buffer Overflow in PX4 PX4-Autopilot CVE-2026-32708 is a stack-based buffer overflow vulnerability identified in the PX4-Autopilot, an open-source flight control software widely used in drone platforms. The vulnerability is located in the Zenoh uORB subscriber component, which

PX4-Autopilot (<1.17.0-rc2) hit by HIGH-severity stack overflow (CVE-2026-32708). Update to 1.17.0-rc2+ to prevent drone control compromise. 🚁 radar.offseq.com/threat/cve-2026-32708-cw... #OffSeq #DroneSecurity #Vulnerability

Offensive Sequence

@offseq.bsky.social

23 hours ago

CVE-2026-32720: CWE-284: Improper Access Control in ctfer-io monitoring CVE-2026-32720 is a vulnerability identified in the ctfer-io monitoring component, which is responsible for collecting, processing, and storing telemetry data such as logs, metrics, and distributed traces. The root cause is a misconfigured

HIGH severity alert: ctfer-io monitoring (<0.2.1) lets attackers move laterally across Kubernetes namespaces. Upgrade to 0.2.1+ & audit policies now. radar.offseq.com/threat/cve-2026-32720-cw... #OffSeq #Kubernetes #Vulnerability

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-3227: CWE-78 Improper Neutralization of Special Elements used in an OS CVE-2026-3227 is an OS command injection vulnerability classified under CWE-78, discovered in several TP-Link router models including TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6. The vulnerability arises from improper neutralization of sp

TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 hit by HIGH-severity OS command injection (CVE-2026-3227). Restrict admin access & monitor config imports — no patch yet. radar.offseq.com/threat/cve-2026-3227-cwe... #OffSeq #TPLink #Vulnerability

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-26954: CWE-94: Improper Control of Generation of Code ('Code Injection' SandboxJS is a JavaScript sandboxing library designed to safely execute untrusted code by restricting access to dangerous functions and objects. Versions prior to 0.8.34 contain a critical vulnerability (CVE-2026-26954) classified under CWE

SandboxJS < 0.8.34 hit by CRITICAL vuln: attackers can escape the JS sandbox & execute code. Immediate upgrade to 0.8.34+ required! High impact for all environments. Details: radar.offseq.com/threat/cve-2026-26954-cw... #OffSeq #CVE202626954 #security

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-32746: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buf CVE-2026-32746 is a classic buffer overflow vulnerability classified under CWE-120, found in the telnetd daemon of GNU inetutils versions through 2.7. The vulnerability stems from the add_slc function, which handles the LINEMODE SLC (Set Lo

CRITICAL: GNU inetutils telnetd (<=2.7) vulnerable to remote buffer overflow (CVE-2026-32746). Disable telnet, restrict access, and monitor for exploits until patch released. radar.offseq.com/threat/cve-2026-32746-cw... #OffSeq #CVE202632746 #security

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-31886: CWE-22: Improper Limitation of a Pathname to a Restricted Direct Dagu is a workflow engine with a web interface that prior to version 2.2.4 contains a critical path traversal vulnerability (CVE-2026-31886) classified under CWE-22. The vulnerability stems from improper validation of the dagRunId request p

dagu <2.2.4 faces a CRITICAL path traversal (CVE-2026-31886) — attackers can delete /tmp & disrupt systems. Upgrade to 2.2.4+ or patch input validation ASAP! radar.offseq.com/threat/cve-2026-31886-cw... #OffSeq #dagu #vuln

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-32626: CWE-79: Improper Neutralization of Input During Web Page Generat CVE-2026-32626 is a critical security vulnerability affecting AnythingLLM Desktop versions 1.11.1 and earlier, developed by Mintplex-Labs. The vulnerability is classified as CWE-79, an improper neutralization of input during web page genera

Critical XSS in AnythingLLM Desktop ≤1.11.1 (CVSS 9.7) enables remote code execution via chat input. Patch ASAP or restrict chat & secure Electron configs. Stay protected! radar.offseq.com/threat/cve-2026-32626-cw... #OffSeq #Security #XSS

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-32621: CWE-1321: Improperly Controlled Modification of Object Prototype Apollo Federation is a framework designed to compose multiple GraphQL APIs into a single unified graph. The vulnerability identified as CVE-2026-32621 is a prototype pollution issue classified under CWE-1321, which occurs in the federation-

CRITICAL: Prototype pollution in @apollo federation-internals (CVE-2026-32621, CVSS 9.9) risks code execution & data breaches. Upgrade to patched versions immediately! Details: radar.offseq.com/threat/cve-2026-32621-cw... #OffSeq #CVE202632621 #GraphQL

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-32242: CWE-362: Concurrent Execution using Shared Resource with Imprope CVE-2026-32242 is a race condition vulnerability classified under CWE-362 affecting the parse-community parse-server, an open-source backend platform running on Node.js. The root cause is the export of a singleton OAuth2 auth adapter instan

CRITICAL: Race condition in parse-server OAuth2 can allow token bypass across providers (>=9.0.0 <9.6.0-alpha.11, <8.6.37). Upgrade now! 🔒 radar.offseq.com/threat/cve-2026-32242-cw... #OffSeq #parseServer #OAuth2

Offensive Sequence

@offseq.bsky.social

1 day ago

CVE-2026-3891: CWE-434 Unrestricted Upload of File with Dangerous Type in linkna CVE-2026-3891 is a critical security vulnerability affecting the Pix for WooCommerce plugin for WordPress, identified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability arises from the lack of capability checks

CRITICAL: Pix for WooCommerce plugin vuln (CVE-2026-3891) enables unauthenticated RCE via unrestricted file uploads. Disable or secure plugin immediately — patch pending. More info: radar.offseq.com/threat/cve-2026-3891-cwe... #OffSeq #WordPress #Sec...

Offensive Sequence

@offseq.bsky.social

2 days ago

CVE-2026-32251: CWE-611: Improper Restriction of XML External Entity Reference i CVE-2026-32251 is an XML External Entity (XXE) vulnerability classified under CWE-611 affecting tolgee-platform, an open-source localization platform. The vulnerability exists because the XML parsers used to import Android XML resource file

CRITICAL: tolgee-platform <3.166.3 has an XXE vuln (CVE-2026-32251)! Auth users can access server files & SSRF internal services. Upgrade to 3.166.3+ now. radar.offseq.com/threat/cve-2026-32251-cw... #OffSeq #XXE #CVE202632251

Offensive Sequence

@offseq.bsky.social

2 days ago

CVE-2026-3611: CWE-306 Missing authentication for critical function in Honeywell CVE-2026-3611 is a critical security vulnerability identified in the Honeywell IQ4x building management controller, specifically affecting versions v3.50_3.44. The root cause is a missing authentication mechanism for critical web-based Huma

CRITICAL: Honeywell IQ4E (v3.50_3.44) lacks HMI authentication by default. Remote attackers can seize admin control & lock out users. Create user accounts + restrict access now! radar.offseq.com/threat/cve-2026-3611-cwe... #OffSeq #Honeywell #ICS

Offensive Sequence

@offseq.bsky.social

2 days ago

CVE-2026-22193: Improper Neutralization of Special Elements used in an SQL Comma CVE-2026-22193 is an SQL injection vulnerability identified in the popular WordPress commenting plugin wpDiscuz, specifically affecting versions prior to 7.6.47. The vulnerability is located in the getAllSubscriptions() function, where inpu

🚨 CRITICAL SQL injection in wpDiscuz <7.6.47 (CVE-2026-22193). Remote, unauthenticated exploit possible — update ASAP or use WAF rules to block malicious input. radar.offseq.com/threat/cve-2026-22193-im... #OffSeq #WordPress #Security

Offensive Sequence

@offseq.bsky.social

2 days ago

CVE-2026-32301: CWE-918: Server-Side Request Forgery (SSRF) in centrifugal centr CVE-2026-32301 is a critical SSRF vulnerability affecting Centrifugo, an open-source real-time messaging server, in versions before 6.7.0. The flaw exists when Centrifugo is configured to fetch JSON Web Key Sets (JWKS) from a dynamic URL th

Centrifugo < 6.7.0 faces CRITICAL SSRF (CVE-2026-32301): unauthenticated attackers can trigger outbound server requests. Upgrade now, restrict JWKS URLs, & monitor logs. radar.offseq.com/threat/cve-2026-32301-cw... #OffSeq #SSRF #Centrifugo

Offensive Sequence

@offseq.bsky.social

2 days ago

CVE-2026-32304: CWE-94: Improper Control of Generation of Code ('Code Injection' Locutusjs is a JavaScript library that provides standard libraries from other programming languages for educational purposes. The vulnerability identified as CVE-2026-32304 resides in the create_function(args, code) function of locutus vers

🚨 CRITICAL vuln: locutusjs <3.0.14 lets attackers run remote code via unsafe create_function(). No user interaction required — patch to 3.0.14+ ASAP! radar.offseq.com/threat/cve-2026-32304-cw... #OffSeq #JavaScript #Security

Offensive Sequence

@offseq.bsky.social

2 days ago

Critical N8n Vulnerabilities Allowed Server Takeover N8n is an open-source workflow automation tool that enables users to connect various applications and services through customizable workflows. The reported critical vulnerabilities in N8n allow unauthenticated attackers to execute arbitrary

CRITICAL: N8n automation flaws allow unauthenticated code execution & server takeover. Restrict access, audit your deployments, and monitor for signs of compromise until a patch is released. radar.offseq.com/threat/critical-n8n-vuln... #OffSeq #N8n #...

Offensive Sequence

@offseq.bsky.social

3 days ago

CVE-2026-31896: CWE-89: Improper Neutralization of Special Elements used in an S The vulnerability CVE-2026-31896 affects the WeGIA web management system, specifically versions before 3.6.6. The root cause is improper neutralization of special elements in SQL commands (CWE-89), resulting from the use of PHP's extract($_

WeGIA <3.6.6 hit by CRITICAL SQL injection (CVSS 9.8). Remote attackers can access or alter DB data. Upgrade to 3.6.6+ or apply WAF rules now! Full details: radar.offseq.com/threat/cve-2026-31896-cw... #OffSeq #SQLInjection #Cybersecurity

Offensive Sequence

@offseq.bsky.social

3 days ago

CVE-2026-31957: CWE-1188: Insecure Default Initialization of Resource in himmelb CVE-2026-31957 is a critical security vulnerability identified in the himmelblau interoperability suite, which facilitates integration between Microsoft Azure Entra ID and Intune. The flaw exists in versions 3.0.0 through 3.0.x prior to 3.1

🚨 CRITICAL: CVE-2026-31957 in himmelblau-idm (v3.0.0-<3.1.0) breaks tenant isolation in Azure Entra ID if config is unset. Upgrade to 3.1.0+ & set tenant domain now. radar.offseq.com/threat/cve-2026-31957-cw... #OffSeq #Azure #CVE202631957

Offensive Sequence

@offseq.bsky.social

3 days ago

CVE-2026-32096: CWE-918: Server-Side Request Forgery (SSRF) in useplunk plunk CVE-2026-32096 is a critical SSRF vulnerability identified in Plunk, an open-source email platform built on AWS Simple Email Service (SES). The vulnerability resides in the SNS webhook handler component of Plunk versions prior to 0.7.0. An

CRITICAL: Plunk < 0.7.0 has SSRF flaw in SNS webhook — attackers can access internal resources. Upgrade to 0.7.0+ & restrict outbound HTTP now! radar.offseq.com/threat/cve-2026-32096-cw... #OffSeq #SSRF #EmailSecurity

Offensive Sequence

@offseq.bsky.social

3 days ago

CVE-2026-27591: CWE-284: Improper Access Control in wintercms winter Winter CMS is an open-source content management system built on the Laravel PHP framework. CVE-2026-27591 is an improper access control vulnerability classified under CWE-284, CWE-639, and CWE-915, which collectively relate to authorization

Winter CMS has a CRITICAL access control flaw (CVE-2026-27591): any backend user can escalate to admin in versions <1.0.477, <1.1.12, <1.2.12. Upgrade now to prevent full system compromise. radar.offseq.com/threat/cve-2026-27591-cw... #OffSeq #Winter...

Offensive Sequence

@offseq.bsky.social

3 days ago

CVE-2026-32136: CWE-287: Improper Authentication in AdguardTeam AdGuardHome AdGuard Home is a popular network-wide software solution designed to block ads and tracking across all devices on a network. The vulnerability identified as CVE-2026-32136 (CWE-287: Improper Authentication) affects versions of AdGuard Home

AdGuard Home <0.107.73 faces CRITICAL auth bypass (CVE-2026-32136). Remote attackers get admin access. Upgrade to 0.107.73+ now! 🔒 radar.offseq.com/threat/cve-2026-32136-cw... #OffSeq #AdGuardHome #SecurityAlert

Offensive Sequence

@offseq.bsky.social

3 days ago

CVE-2026-24448: Use of hard-coded credentials in Micro Research Ltd. MR-GM5L-S1 CVE-2026-24448 identifies a critical security vulnerability in Micro Research Ltd.'s MR-GM5L-S1 and MR-GM5A-L1 devices, specifically due to the presence of hard-coded credentials within the firmware versions prior to v2.01.04N1_02. Hard-cod

CRITICAL: Micro Research MR-GM5L-S1/MR-GM5A-L1 devices before v2.01.04N1_02 let attackers in via hard-coded creds. Immediate firmware update needed! 🚨 radar.offseq.com/threat/cve-2026-24448-us... #OffSeq #CVE #IoTSecurity

Offensive Sequence

@offseq.bsky.social

3 days ago

CVE-2026-2631: CWE-269 Improper Privilege Management in Datalogics Ecommerce Del CVE-2026-2631 is a critical security vulnerability identified in the Datalogics Ecommerce Delivery WordPress plugin prior to version 2.6.60. The flaw arises from improper privilege management (CWE-269) where an unauthenticated REST API endp

CRITICAL: Datalogics Ecommerce Delivery plugin (<2.6.60) lets remote attackers gain WordPress admin via unauthenticated REST API. Update ASAP or restrict access! See: radar.offseq.com/threat/cve-2026-2631-cwe... #OffSeq #WordPress #Security