News
A Hidden Admin Password (Backdoor) in Tenda Wi-Fi Routers: CVE-2026-11405, and There's No Patch
InfrastructureSecurity
Multiple Tenda Wi-Fi routers ship with a hidden admin password (a backdoor): anyone who can reach the admin page can take the router over with no login (CVE-2026-11405). There is no vendor fix — here's how to check your model and protect yourself.
2026.07.07145 views
News
Self-hosted Git "Gitea" hit by admin-takeover flaw: CVE-2026-20896 and 8 more, update to 1.26.4
InfrastructureDevelopmentSecurity
Gitea, the self-hosted source-code tool, was patched for nine security flaws in version 1.26.4. The worst lets an attacker impersonate the admin with no password on Docker instances using a specific setting. If you self-host Gitea, update now.
2026.07.04148 views
News
On-Prem SharePoint Takeover With No Login — CVE-2026-50522 & More, Patch Now
SecurityInfrastructure
Microsoft's on-premises SharePoint Server has a flaw (CVE-2026-45659) that lets even a low-privilege user run code on the server. CISA confirms exploitation. Editions 2016/2019/Subscription are affected; SharePoint Online is not. The fix is out — patch unpatched servers now.
2026.07.0258 views
News
CWP takeover flaw CVE-2026-57517: exploit code is public
InfrastructureSecurity
Control Web Panel (CWP, formerly CentOS Web Panel), a free Linux server management panel, has a flaw (CVE-2026-57517) that lets an unauthenticated attacker manipulate the database and take over the server. 150,000+ instances are exposed — update to 0.9.8.1225.
2026.07.0275 views
News
Critical Flaw in BMC Control-M (CVE-2026-10539): Server Takeover With No Password — Update to 9.0.21.300
SecurityInfrastructure
BMC Control-M, which runs companies' core batch jobs, has a critical flaw: a passwordless attacker can take over the server (CVE-2026-10539, CVSS 9.0). Update to 9.0.21.300.
2026.07.0193 views
News
JR Ticket Machines and Ekinet Go Down Nationwide at Once: Why One Fault Stops All of JR — Inside the MARS System
Japanese CompaniesInfrastructure
On July 1, 2026, JR ticket machines, Ekinet and e5489 failed nationwide. The cause: MARS, the system running all JR reservations. Why one fault stops every JR, and what travelers can do.
2026.07.0172 views
News
UltraVNC: 3 Critical Flaws (CVE-2026-7840) — Repeater Takeover With No Password, Update to 1.8.2.4
SecurityInfrastructure
UltraVNC has three critical flaws. The repeater can be hijacked with no password (CVE-2026-7840, CVSS 9.8); a viewer bug lets a rogue server seize your PC. Update to 1.8.2.4.
2026.07.01113 views
News
Pre-Auth RCE in IBM Db2 (CVE-2026-10109): Patch the Core Database Now
SecurityInfrastructure
IBM Db2, the enterprise core database, has a flaw (CVE-2026-10109): tampering with the pre-login connection exchange runs commands on the server with no authentication. Rated 9.8; IBM has shipped special fix builds — apply now.
2026.07.0132 views
News
Conductor CVE-2026-58138: PoC is public, no confirmed attacks yet
SecurityInfrastructure
Conductor (formerly Netflix Conductor), a platform that chains business processes, has a flaw (CVE-2026-58138): sending one crafted workflow definition to the API runs commands before login. Rated 9.8; update to 3.30.2 now.
2026.07.0154 views
News
Adobe ColdFusion Flaw Now Exploited in Attacks — CVE-2026-48282, Seven 10.0s, Patch Now
InfrastructureSecurity
Adobe ColdFusion has 9 new flaws that let attackers take over a server from outside with no login. Five are rated a perfect 10.0 (CVE-2026-48276 et al.). Adobe shipped a fix (APSB26-68) — update now.
2026.07.0183 views
News
AWS WAF Body-Inspection Bypass (CVE-2026-13762/13763, CVSS 9.8): Attacks Can Slip Past on CloudFront and the Load Balancer
SecurityInfrastructure
AWS WAF, the web shield on Amazon's cloud, has a flaw (CVE-2026-13762/13763, CVSS 9.8): splitting an attack across HTTP/2 frames slips past body inspection. CloudFront is auto-fixed; load balancer (ALB) users must change a setting.
2026.06.3066 views
News
Critical Auth-Bypass in SimpleHelp (CVE-2026-48558, CVSS 10): Attackers Can Take Over Every Managed PC — Now in CISA KEV, Update to 5.5.16
SecurityInfrastructure
SimpleHelp remote-support software has a critical auth-bypass flaw (CVE-2026-48558, CVSS 10): attackers forge a login to create an admin technician and take over every managed PC. Now in CISA KEV — update to 5.5.16.
2026.06.3062 views
