← Feed

Posts

• View post

  Critical: Google Cloud Application Integration is affected by CVE-2026-81867 (CVSS 9.4) — deserialization of untrusted data lets authenticated users run code on shared servers. Patched 2026-06-28. Confirm your environment is current. Details: https://radar.offseq.com/threat/cve-2026-81867-cwe-502-deserialization-of-untrusted-data-in-google-cloud-application-integration-14d58452543f7963 #OffSeq #CloudSecurity #CVE202681867

• View post

  OS command injection (CVE-2026-101009) in aaPanel BaoTa <=11.8.0: CRITICAL severity. Exploit public, vendor silent. Remote attackers can execute commands via panelTask.bt_task._unzip. Review and mitigate now. https://radar.offseq.com/threat/cve-2026-101009-os-command-injection-in-aapanel-baota-2affddad69ededf3 #OffSeq #CVE2026101009 #infosec

• View post

  CVE-2026-101002: Critical OS command injection in Netcore NBR200V2 v1.3.241127.071246 via Tools Ping Handler. Public exploit code available; no vendor patch. Isolate devices, restrict network access. https://radar.offseq.com/threat/cve-2026-101002-os-command-injection-in-netcore-nbr200v2-8a15ef317ba62749 #OffSeq #CVE2026101002 #Netcore #Vuln

• View post

  Seetong T8108 series (v4.6.1.4-build202604241011) hit by CRITICAL CVE-2026-100886: improper authentication in Debug Service. Exploitable remotely — public exploit code available. No patch. Restrict network access ASAP. https://radar.offseq.com/threat/cve-2026-100886-improper-authentication-in-seetong-t8108-acea634abd75f700 #OffSeq #CVE2026100886 #IoTSecurity #Vuln

• View post

  CVE-2026-100721: CRITICAL auth bypass in vm2 <3.12.2's NodeVM external-module resolver. Sandbox escape & arbitrary code exec possible. Upgrade to 3.12.2+ ASAP. https://radar.offseq.com/threat/vm2-before-3122-contains-an-authorization-bypass-in-the-nodevm-external-module-resolver-cve-2026-100721-5c70167d00dbbf82 #OffSeq #CVE2026100721 #vm2 #infosec

• View post

  CVE-2026-89055 (CRITICAL, CVSS 9.1): Customer Reviews for WooCommerce <=5.120.0 lets unauthenticated attackers delete arbitrary media via public review-form links. Restrict link access, monitor suspicious review activity. https://radar.offseq.com/threat/cve-2026-89055-cwe-862-missing-authorization-in-ivole-customer-reviews-for-woocommerce-49ae0564154df323 #OffSeq #CVE202689055 #WordPress #Infosec

• View post

  OffSeq is an European offensive security company. We do pentesting, red teaming, OT/ICS and critical infrastructure security, and NIS2/DORA work across the EU. Here we post our research: vulnerability disclosures (latest in Latvian and Estonian eID software and X-Road), monthly Mirage honeypot field reports and open-source tools. Open to collaboration, DMs are open. https://offseq.com/en/ #Introduction #InfoSec #PenTest #RedTeam #ThreatIntel #OffensiveSecurity

• View post

  CVE-2026-100551: OpenClaw for iOS (>=2026.7.1, <2026.8.11) has a CRITICAL vuln in Control UI WebViews — TLS pins not enforced. Attackers can steal Gateway creds if they can redirect traffic. Patch to 2026.8.11 ASAP! https://radar.offseq.com/threat/openclaw-for-ios-versions-202671-and-2026811-do-not-enforce-saved-gateway-tls-pins-in-the-control-ui-5ff1fd58a7f58c18 #OffSeq #Vulnerability #iOS #AppSec

• View post

  CVE-2026-18467: CRITICAL privilege escalation in Paytium: Mollie payment forms (≤5.0.3). Unauthenticated users can create admin accounts via exploited payment forms. Restrict forms or disable plugin until full fix. https://radar.offseq.com/threat/cve-2026-18467-cwe-269-improper-privilege-management-in-paytiumsupport-paytium-mollie-payment-forms-816d892a2e04a4c5 #OffSeq #WordPress #CVE202618467 #Security

• View post

  CVE-2026-19599: CRITICAL RCE in ManageEngine OpManager MSP (<12.8.711). Improper OS command neutralization enables remote command execution (CVSS 9.9). Upgrade to 12.8.711+ ASAP. https://radar.offseq.com/threat/cve-2026-19599-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-d62870fccbe1d229 #OffSeq #Vuln #InfoSec #RCE

• View post

  F5 BIG-IP APM (OAuth Authorization Server) is facing a CRITICAL RCE zero-day, CVE-2026-94127, with active exploitation. Versions 21.1.0, 17.5.0 – 17.5.1, 17.1.0 – 17.1.3 affected. Apply hotfixes now. Details: https://radar.offseq.com/threat/critical-f5-big-ip-vulnerability-exploited-as-zero-day-024f528e7ee83eed #OffSeq #F5 #ZeroDay #Infosec

• View post

  D-Link DIR-822A routers are affected by CVE-2026-86510 (CRITICAL, CVSS 9.4): remote out-of-bounds write in L2TP parser can lead to system compromise. No patch yet — restrict access and monitor updates. https://radar.offseq.com/threat/cve-2026-86510-out-of-bounds-write-in-d-link-dir-822a-e90339b14a1aa39b #OffSeq #CVE202686510 #RouterSecurity #Infosec

• View post

  CVE-2026-86296 | D-Link DIR-822A A_101: Critical stack-based buffer overflow in udhcpcd (CVSS 10). Remotely exploitable, no auth needed. Exploit code is public. Isolate devices & check vendor updates. https://radar.offseq.com/threat/a-vulnerability-was-determined-in-d-link-dir-822a-a101-cve-2026-86296-3125c70d27558796 #OffSeq #Vulnerability #DLink #Security

• View post

  CVE-2026-94003: CRITICAL stack buffer overflow in Comfast CF-N1-S (2.6.0.1). Flaw in get_css_path_from_uri (/cgi-bin/mbox-config) is remotely exploitable; public exploit exists. Restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-94003-stack-based-buffer-overflow-in-comfast-cf-n1-s-1046130f838f5eec #OffSeq #Infosec #CVE #IoTSecurity

• View post

  HIGH severity: CVE-2026-92965 in TikTok WordPress plugin (1.2.0 – 1.4.2) allows any visitor to redeem sign-in codes via URL, risking ad platform abuse. Restrict or disable the plugin while awaiting a patch. https://radar.offseq.com/threat/cve-2026-92965-cwe-862-missing-authorization-in-tiktok-38fbb3b8076a5adb #OffSeq #WordPress #Vuln #Security

• View post

  CVE-2026-93741: Totolink A3002MU (Hh-B20211125.1046) hit by CRITICAL buffer overflow in formWlWds (CVSS 10). Exploit is public; remote code exec risk. Isolate affected routers or block attacks at the network. https://radar.offseq.com/threat/cve-2026-93741-buffer-overflow-in-totolink-a3002mu-bc2e06f7d2d53482 #OffSeq #CVE202693741 #IoT #Exploit

• View post

  @kartyk-github-org/takedown-b (npm) contains CRITICAL malware: full system compromise if installed/run. All secrets and keys must be rotated from a clean device. Removal alone is insufficient — investigate for persistence. No CVE. https://radar.offseq.com/threat/malicious-code-in-kartyk-github-orgtakedown-b-npm-3a3addb0368973b9 #OffSeq #npm #malware #infosec

• View post

  Check Point Security Mgmt & Log Server hit by CRITICAL RCE (CVE-2026-91843) via unauthenticated login. No active exploitation yet. Patch ASAP. Tanium (SQLi, RCE) & Kaspersky (Redis) also patched. https://radar.offseq.com/threat/check-point-kaspersky-tanium-patch-product-vulnerabilities-ae8c3757ea9b181a #OffSeq #Vulnerability #RCE #PatchNow

• View post

  Cisco Secure Email Gateway faces a CRITICAL zero-day vulnerability, actively exploited in the wild. No CVE or version info yet. Patch available — apply ASAP to protect email infrastructure. https://radar.offseq.com/threat/cisco-patches-secure-email-gateway-zero-day-exploited-in-attacks-76a43690673247c4 #OffSeq #Cisco #ZeroDay #BlueTeam #EmailSecurity

• View post

  EFM ipTIME C200E v1.094 suffers CRITICAL OS command injection (CVE-2026-90847, CVSS 9.4) via iux_set.cgi. Remotely exploitable, public exploit available. Restrict device access and monitor. https://radar.offseq.com/threat/cve-2026-90847-os-command-injection-in-efm-iptime-c200e-1c30057b126bbbf4 #OffSeq #Vulnerability #IoTSecurity #CVE

• View post

  CVE-2026-87931 | CRITICAL buffer overflow in Pavlok Behavioral Conditioning Wearable (Apple Notification Center Service Event Handler). Exploitable locally, no patch or vendor response. Limit device network access. Details: https://radar.offseq.com/threat/cve-2026-87931-buffer-overflow-in-behavioral-technology-group-pavlok-behavioral-conditioning-wearable-98a2d4c4edee7864 #OffSeq #CVE202687931 #IoTSecurity

• View post

  CVE-2026-16149 (HIGH, CVSS 8.8): marc4 Security Hardener <=2.4.4 allows Subscriber-level users to create Admin accounts or reset passwords via REST API. Disable plugin or limit API access pending patch. https://radar.offseq.com/threat/cve-2026-16149-cwe-269-improper-privilege-management-in-marc4-security-hardener-a438d1f2a5360b5c #OffSeq #WordPress #Vulnerability #Infosec

• View post

  CVE-2026-78122: HIGH severity in Tecnativa docker-socket-proxy (CVSS 8.3). Insufficient access control enables attackers to read files & export entire container filesystems via Docker API. Restrict access, check vendor guidance. https://radar.offseq.com/threat/cve-2026-78122-insufficient-granularity-of-access-control-in-tecnativa-docker-socket-proxy-6e8e6aaf03a19cce #OffSeq #Docker #Infosec #Vuln

• View post

  CVE-2026-8445: EmilStenstrom justhtml <=1.11.0 suffers CRITICAL XSS due to improper escaping in Markdown output. Remote attackers can inject scripts. Update to v1.12.0 now. https://radar.offseq.com/threat/cve-2026-8445-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-42aabed1c30bf24b #OffSeq #XSS #AppSec #CVE20268445

• View post

  CVE-2026-7808 | justhtml <1.16.0 faces CRITICAL XSS risk via HTML sanitization bypass in advanced use cases. Upgrade to 1.16.0+ to fix. Impacts apps with custom/mutated policies. Details: https://radar.offseq.com/threat/cve-2026-7808-improper-input-validation-in-emilstenstrom-justhtml-86dd54d29e0645e9 #OffSeq #CVE20267808 #infosec #XSS

• View post

  CRITICAL: Stack-based buffer overflow (CVE-2026-78169) in UTT HiPER 1250GW v3.2.7-210907-180535. Public exploit code available — no patch yet. Restrict device access & monitor /goform/aspRemoteApConfTempSend traffic. https://radar.offseq.com/threat/cve-2026-78169-stack-based-buffer-overflow-in-utt-hiper-1250gw-b9697a669a575a95 #OffSeq #CVE #Infosec #IoT

• View post

  4MOSAn GCB Doctor faces a CRITICAL OS Command Injection (CVE-2026-78211, CVSS 9.8). Unauthenticated attackers can execute arbitrary system commands via ADOdb test page parameter. No patch — restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-78211-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-91902877a695e366 #OffSeq #CVE202678211 #Vuln #BlueTeam

• View post

  CRITICAL vuln (CVE-2026-78168) in EFM ipTIME T24000M ≤14.20.0: improper authentication in httpcon_check_session_url enables remote exploit. Public exploit disclosed, no vendor fix. Review access controls now. https://radar.offseq.com/threat/cve-2026-78168-improper-authentication-in-efm-iptime-t24000m-bfa2e716a3fcf0b6 #OffSeq #CVE #IoTSecurity #Exploit

• View post

  CVE-2026-78251 (CRITICAL): DJI Neo & related drones have hard-coded FTP creds, letting attackers fill storage & disrupt logging/updates via network or USB. Patch required! https://radar.offseq.com/threat/cve-2026-78251-cwe-798-use-of-hard-coded-credentials-in-dji-neo-98f2d4e34b35b2e0 #OffSeq #CVE2026_78251 #DJI #DroneSec

• View post

  CVE-2026-77994: CRITICAL SQL injection in Joomla Page Builder CK (v1.0.0-3.6.4). Unauthenticated remote SQL execution possible. No official fix yet — disable/remove vulnerable versions. CVSS 9.3. https://radar.offseq.com/threat/cve-2026-77994-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-d508026cac86e490 #OffSeq #Joomla #SQLInjection #Infosec