The latest articles on DEV Community by Freedom Coder (@freedom-coder). https://dev.to/freedom-coder https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3057520%2F80e0c6d9-1160-4c3a-9af3-cdf5c163c85b.png https://dev.to/freedom-coder en Freedom Coder Wed, 29 Jul 2026 22:06:04 +0000 https://dev.to/freedom-coder/cve-2026-16812-arista-velocloud-orchestrator-on-prem-os-command-injection-vulnerability-34b2 https://dev.to/freedom-coder/cve-2026-16812-arista-velocloud-orchestrator-on-prem-os-command-injection-vulnerability-34b2 <h3> CVE ID </h3> <p>CVE-2026-16812</p> <h3> Vulnerability Name </h3> <p>Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability</p> <ul> <li>Project: <strong>Arista</strong> </li> <li>Product: <strong>VeloCloud Orchestrator</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-27</li> <li>Due Date: 2026-07-30</li> </ul> <h3> Description </h3> <p>Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144" rel="noopener noreferrer">https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-16812" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-16812</a></p> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> arista velocloudorchestrator cybersecurity vulnerability Freedom Coder Tue, 28 Jul 2026 20:35:06 +0000 https://dev.to/freedom-coder/cve-2020-8515-multiple-draytek-vigor-routers-web-management-page-vulnerability-2f3h https://dev.to/freedom-coder/cve-2020-8515-multiple-draytek-vigor-routers-web-management-page-vulnerability-2f3h <h3> CVE ID </h3> <p>CVE-2020-8515</p> <h3> Vulnerability Name </h3> <p>Multiple DrayTek Vigor Routers Web Management Page Vulnerability</p> <ul> <li>Project: <strong>DrayTek</strong> </li> <li>Product: <strong>Multiple Vigor Routers</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2021-11-03</li> <li>Due Date: 2022-05-03</li> </ul> <h3> Description </h3> <p>DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply updates per vendor instructions.</p> <h3> Additional Notes </h3> <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-8515" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2020-8515</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/" rel="noopener noreferrer">New Dysphoria DDoS botnet spreads to 200k devices worldwide</a></li> <li><a href="https://www.scyscan.com/news/cisa-warns-of-sitecore-rce-flaws-active-exploits-hit-next.js-and-draytek-devices/" rel="noopener noreferrer">CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices</a></li> <li><a href="https://www.scyscan.com/news/hackers-exploit-zero-day-in-cnpilot-routers-to-deploy-airashi-ddos-botnet/" rel="noopener noreferrer">Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet</a></li> <li><a href="https://www.scyscan.com/news/cisa-and-fbi-raise-alerts-on-exploited-flaws-and-expanding-hiatusrat-campaign/" rel="noopener noreferrer">CISA and FBI Raise Alerts on Exploited Flaws and Expanding HiatusRAT Campaign</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> draytek multiplevigorrouters cybersecurity vulnerability Freedom Coder Mon, 27 Jul 2026 19:01:22 +0000 https://dev.to/freedom-coder/cve-2025-68686-fortinet-fortios-exposure-of-sensitive-information-to-an-unauthorized-actor-ng7 https://dev.to/freedom-coder/cve-2025-68686-fortinet-fortios-exposure-of-sensitive-information-to-an-unauthorized-actor-ng7 <h3> CVE ID </h3> <p>CVE-2025-68686</p> <h3> Vulnerability Name </h3> <p>Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability</p> <ul> <li>Project: <strong>Fortinet</strong> </li> <li>Product: <strong>FortiOS</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-27</li> <li>Due Date: 2026-08-10</li> </ul> <h3> Description </h3> <p>Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://fortiguard.fortinet.com/psirt/FG-IR-25-934" rel="noopener noreferrer">https://fortiguard.fortinet.com/psirt/FG-IR-25-934</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68686" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2025-68686</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/attackers-exploit-arista-velocloud-orchestrator-command-injection-flaw/" rel="noopener noreferrer">Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> fortinet fortios cybersecurity vulnerability Freedom Coder Wed, 22 Jul 2026 22:06:21 +0000 https://dev.to/freedom-coder/cve-2026-50522-microsoft-sharepoint-deserialization-of-untrusted-data-vulnerability-3g80 https://dev.to/freedom-coder/cve-2026-50522-microsoft-sharepoint-deserialization-of-untrusted-data-vulnerability-3g80 <h3> CVE ID </h3> <p>CVE-2026-50522</p> <h3> Vulnerability Name </h3> <p>Microsoft SharePoint Deserialization of Untrusted Data Vulnerability</p> <ul> <li>Project: <strong>Microsoft</strong> </li> <li>Product: <strong>SharePoint</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-22</li> <li>Due Date: 2026-07-25</li> </ul> <h3> Description </h3> <p>Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522" rel="noopener noreferrer">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-50522" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-50522</a></p> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> microsoft sharepoint cybersecurity vulnerability Freedom Coder Wed, 22 Jul 2026 22:01:21 +0000 https://dev.to/freedom-coder/cve-2026-16232-check-point-smartconsole-improper-authentication-vulnerability-3g8f https://dev.to/freedom-coder/cve-2026-16232-check-point-smartconsole-improper-authentication-vulnerability-3g8f <h3> CVE ID </h3> <p>CVE-2026-16232</p> <h3> Vulnerability Name </h3> <p>Check Point SmartConsole Improper Authentication Vulnerability</p> <ul> <li>Project: <strong>Check Point</strong> </li> <li>Product: <strong>SmartConsole</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-22</li> <li>Due Date: 2026-07-25</li> </ul> <h3> Description </h3> <p>Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://support.checkpoint.com/results/sk/sk185169/" rel="noopener noreferrer">https://support.checkpoint.com/results/sk/sk185169/</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-16232" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-16232</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/public-poc-released-for-exploited-check-point-smartconsole-authentication-bypass/" rel="noopener noreferrer">Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass</a></li> <li><a href="https://www.scyscan.com/news/check-point-patches-exploited-smartconsole-flaw-allowing-full-admin-access/" rel="noopener noreferrer">Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> checkpoint smartconsole cybersecurity vulnerability Freedom Coder Tue, 21 Jul 2026 16:08:49 +0000 https://dev.to/freedom-coder/cve-2021-27137-dd-wrt-stack-based-buffer-overflow-vulnerability-3c4d https://dev.to/freedom-coder/cve-2021-27137-dd-wrt-stack-based-buffer-overflow-vulnerability-3c4d <h3> CVE ID </h3> <p>CVE-2021-27137</p> <h3> Vulnerability Name </h3> <p>DD-WRT Stack-Based Buffer Overflow Vulnerability</p> <ul> <li>Project: <strong>DD-WRT</strong> </li> <li>Product: <strong>DD-WRT</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-21</li> <li>Due Date: 2026-07-24</li> </ul> <h3> Description </h3> <p>DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p>This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: <a href="https://svn.dd-wrt.com/changeset/45724" rel="noopener noreferrer">https://svn.dd-wrt.com/changeset/45724</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-27137" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2021-27137</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/hackers-exploit-windmill-flaw-to-read-arbitrary-server-files-without-authentication/" rel="noopener noreferrer">Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> ddwrt cybersecurity vulnerability Freedom Coder Tue, 21 Jul 2026 16:06:18 +0000 https://dev.to/freedom-coder/cve-2026-0770-langflow-inclusion-of-functionality-from-untrusted-control-sphere-vulnerability-3b02 https://dev.to/freedom-coder/cve-2026-0770-langflow-inclusion-of-functionality-from-untrusted-control-sphere-vulnerability-3b02 <h3> CVE ID </h3> <p>CVE-2026-0770</p> <h3> Vulnerability Name </h3> <p>Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability</p> <ul> <li>Project: <strong>Langflow</strong> </li> <li>Product: <strong>Langflow</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-21</li> <li>Due Date: 2026-07-24</li> </ul> <h3> Description </h3> <p>Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. </p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://github.com/langflow-ai/langflow/releases/tag/v1.9.0" rel="noopener noreferrer">https://github.com/langflow-ai/langflow/releases/tag/v1.9.0</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-0770" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-0770</a> </p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/hackers-exploit-windmill-flaw-to-read-arbitrary-server-files-without-authentication/" rel="noopener noreferrer">Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> langflow cybersecurity vulnerability Freedom Coder Tue, 21 Jul 2026 16:03:47 +0000 https://dev.to/freedom-coder/cve-2026-63030-wordpress-core-interpretation-conflict-vulnerability-12m3 https://dev.to/freedom-coder/cve-2026-63030-wordpress-core-interpretation-conflict-vulnerability-12m3 <h3> CVE ID </h3> <p>CVE-2026-63030</p> <h3> Vulnerability Name </h3> <p>WordPress Core Interpretation Conflict Vulnerability</p> <ul> <li>Project: <strong>WordPress</strong> </li> <li>Product: <strong>Core</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-21</li> <li>Due Date: 2026-07-24</li> </ul> <h3> Description </h3> <p>WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://wordpress.org/news/2026/07/wordpress-7-0-2-release/" rel="noopener noreferrer">https://wordpress.org/news/2026/07/wordpress-7-0-2-release/</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-63030" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-63030</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/hackers-exploit-windmill-flaw-to-read-arbitrary-server-files-without-authentication/" rel="noopener noreferrer">Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication</a></li> <li><a href="https://www.scyscan.com/news/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/" rel="noopener noreferrer">Critical wp2shell WordPress flaws exploited to install webshells</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> wordpress core cybersecurity vulnerability Freedom Coder Tue, 21 Jul 2026 16:01:16 +0000 https://dev.to/freedom-coder/cve-2026-60137-wordpress-core-sql-injection-vulnerability-c87 https://dev.to/freedom-coder/cve-2026-60137-wordpress-core-sql-injection-vulnerability-c87 <h3> CVE ID </h3> <p>CVE-2026-60137</p> <h3> Vulnerability Name </h3> <p>WordPress Core SQL Injection Vulnerability</p> <ul> <li>Project: <strong>WordPress</strong> </li> <li>Product: <strong>Core</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-21</li> <li>Due Date: 2026-08-04</li> </ul> <h3> Description </h3> <p>WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://wordpress.org/news/2026/07/wordpress-7-0-2-release/" rel="noopener noreferrer">https://wordpress.org/news/2026/07/wordpress-7-0-2-release/</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-60137" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-60137</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/hackers-exploit-windmill-flaw-to-read-arbitrary-server-files-without-authentication/" rel="noopener noreferrer">Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication</a></li> <li><a href="https://www.scyscan.com/news/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/" rel="noopener noreferrer">Critical wp2shell WordPress flaws exploited to install webshells</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> wordpress core cybersecurity vulnerability Freedom Coder Mon, 20 Jul 2026 19:33:24 +0000 https://dev.to/freedom-coder/cve-2025-33053-microsoft-windows-external-control-of-file-name-or-path-vulnerability-fai https://dev.to/freedom-coder/cve-2025-33053-microsoft-windows-external-control-of-file-name-or-path-vulnerability-fai <h3> CVE ID </h3> <p>CVE-2025-33053</p> <h3> Vulnerability Name </h3> <p>Microsoft Windows External Control of File Name or Path Vulnerability</p> <ul> <li>Project: <strong>Microsoft</strong> </li> <li>Product: <strong>Windows</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2025-06-10</li> <li>Due Date: 2025-07-01</li> </ul> <h3> Description </h3> <p>Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.</p> <h3> Additional Notes </h3> <p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053" rel="noopener noreferrer">https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-33053" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2025-33053</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/exposed-server-reveals-ai-assisted-phishing-toolkit-behind-webdav-malware-campaign/" rel="noopener noreferrer">Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign</a></li> <li><a href="https://www.scyscan.com/news/microsoft-fixes-surface-hub-boot-issues-with-emergency-update/" rel="noopener noreferrer">Microsoft fixes Surface Hub boot issues with emergency update</a></li> <li><a href="https://www.scyscan.com/news/microsoft-kb5060533-update-triggers-boot-errors-on-surface-hub-v1-devices/" rel="noopener noreferrer">Microsoft: KB5060533 update triggers boot errors on Surface Hub v1 devices</a></li> <li><a href="https://www.scyscan.com/news/windows-11-24h2-emergency-update-fixes-easy-anti-cheat-bsod-issue/" rel="noopener noreferrer">Windows 11 24H2 emergency update fixes Easy Anti-Cheat BSOD issue</a></li> <li><a href="https://www.scyscan.com/news/hackers-exploited-windows-webdav-zero-day-to-drop-malware/" rel="noopener noreferrer">Hackers exploited Windows WebDav zero-day to drop malware</a></li> <li><a href="https://www.scyscan.com/news/microsoft-creates-separate-windows-11-24h2-update-for-incompatible-pcs/" rel="noopener noreferrer">Microsoft creates separate Windows 11 24H2 update for incompatible PCs</a></li> <li><a href="https://www.scyscan.com/news/microsoft-patches-67-vulnerabilities-including-webdav-zero-day-exploited-in-the-wild/" rel="noopener noreferrer">Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero-Day Exploited in the Wild</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> microsoft windows cybersecurity vulnerability Freedom Coder Thu, 16 Jul 2026 19:07:08 +0000 https://dev.to/freedom-coder/cve-2026-46817-oracle-e-business-suite-improper-privilege-management-vulnerability-1g40 https://dev.to/freedom-coder/cve-2026-46817-oracle-e-business-suite-improper-privilege-management-vulnerability-1g40 <h3> CVE ID </h3> <p>CVE-2026-46817</p> <h3> Vulnerability Name </h3> <p>Oracle E-Business Suite Improper Privilege Management Vulnerability</p> <ul> <li>Project: <strong>Oracle</strong> </li> <li>Product: <strong>E-Business Suite</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-15</li> <li>Due Date: 2026-07-18</li> </ul> <h3> Description </h3> <p>Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://www.oracle.com/security-alerts/cspumay2026.html" rel="noopener noreferrer">https://www.oracle.com/security-alerts/cspumay2026.html</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46817" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-46817</a></p> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> oracle ebusinesssuite cybersecurity vulnerability Freedom Coder Thu, 16 Jul 2026 19:05:07 +0000 https://dev.to/freedom-coder/cve-2026-39808-fortinet-fortisandbox-os-command-injection-vulnerability-1c2b https://dev.to/freedom-coder/cve-2026-39808-fortinet-fortisandbox-os-command-injection-vulnerability-1c2b <h3> CVE ID </h3> <p>CVE-2026-39808</p> <h3> Vulnerability Name </h3> <p>Fortinet FortiSandbox OS Command Injection Vulnerability</p> <ul> <li>Project: <strong>Fortinet</strong> </li> <li>Product: <strong>FortiSandbox</strong> </li> </ul> <h3> Date </h3> <ul> <li>Date Added: 2026-07-16</li> <li>Due Date: 2026-07-19</li> </ul> <h3> Description </h3> <p>Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.</p> <h3> Known To Be Used in Ransomware Campaigns? </h3> <p>Unknown</p> <h3> Action </h3> <p>Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.</p> <h3> Additional Notes </h3> <p><a href="https://fortiguard.fortinet.com/psirt/FG-IR-26-100" rel="noopener noreferrer">https://fortiguard.fortinet.com/psirt/FG-IR-26-100</a> ; BOD 26-04: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk</a> ; Forensics Triage Requirements: <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" rel="noopener noreferrer">https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk</a> ; <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39808" rel="noopener noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2026-39808</a></p> <h3> Related Security News </h3> <ul> <li><a href="https://www.scyscan.com/news/cisa-urges-immediate-action-on-actively-exploited-fortinet-flaws/" rel="noopener noreferrer">CISA urges immediate action on actively exploited Fortinet flaws</a></li> <li><a href="https://www.scyscan.com/news/cisa-adds-exploited-sharepoint-rce-zero-day-cve-2026-58644-to-kev/" rel="noopener noreferrer">CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV</a></li> </ul> <h3> More CVEs Info </h3> <p><a href="https://www.scyscan.com/cves/" rel="noopener noreferrer">Common Vulnerabilities &amp; Exposures (CVE) List</a></p> fortinet fortisandbox cybersecurity vulnerability