Real-time vulnerability alerts for all your software to all your teams.
Joined June 2017
- Tweets2K
- Following2K
- Followers905
- Likes91
OpenSSH on certain musl-based Linux hosts can accept an oversized password as a valid login. Public reproductions make affected configurations worth checking.
secalerts.co/news/openssh-ac…
42
💉 Public PoC dropped for CVE-2026-54349 in Chartbrew. SQL injection via dashboard filter variable substitution, no auth required, CVSS 9.8. Upgrade to v5.2.1 now. #cybersecurity #ciso #vulnerabilities #mssp secalerts.co/vulnerability/C…
1
1
167
🔑 Public PoC out for CVE-2026-121609: Qihoo 360 M5 router ships hard-coded credentials in its /etc/init.d/mpt boot script. CVSS 9.3, no auth needed, full C/I/A impact. Check your fleet. #cybersecurity #vulnerabilities #ciso secalerts.co/vulnerability/C…
1
81
🔓 PoC public: Linksys E5600 auth bypass via mesh_login.cgi lets unauthenticated attackers take full control. CVSS 9.3 critical, no login needed. CVE-2026-121615 #cybersecurity #vulnerabilities #ciso #mssp secalerts.co/vulnerability/C…
3
235
Public PoC dropped for CVE-2026-121606: firmware signature verification bypass (verify_sign in iscm) across 6 Qihoo 360 router models up to v6.4.9. Network-exploitable, no auth, CVSS 9.3. 🔓 #cybersecurity #vulnerabilities #ciso secalerts.co/vulnerability/C…
2
1
123
Some WordPress websites open to attack even while using update to fix actively exploited flaw.
Info, incl. fix info, now at SecAlerts:
CVE-2026-119977 - secalerts.co/vulnerability/C…
#ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #secalerts #CVE2026119977 #Wordpress
168
💳 Public exploit out for CVE-2026-86596: s2Member WordPress plugin (<=260927) allows unauthenticated RCE via the 'item_name' PayPal IPN parameter. No auth needed, CVSS 9.8. Patch now. #cybersecurity #ciso #wordpress #vulnerabilities secalerts.co/vulnerability/C…
Crafted LXD images can enable arbitrary host-file reads and writes via template operations, with potential command execution. Fixed releases are available.
secalerts.co/news/lxd-images…
41
🔓 Public PoC dropped for CVE-2026-120345 — WAVLINK WN551X3-A router hit with OS command injection via sub_41a430 in the DNS Resolution Handler (/bin/ioos). No auth needed, full system impact. Check your network edge. #cybersecurity #vulnerabilities #ciso
secalerts.co/vulnerability/C…
2
114
🛠️ Craft CMS has a critical unauthenticated SQLi — CVE-2026-123488. The element search endpoint concatenates `attribute` directly into queries. PoC is public. Patch to 4.18.9 or 5.11.2 now.
#cybersecurity #ciso #cto #vulnerabilities #msp #mssp
secalerts.co/vulnerability/C…
1
110
📡 PoC out for CVE-2026-120281: WAVLINK WN536AX6-A stack overflow via strcpy in /protocol.csp OpenVPN handler. No auth needed, full system impact. Critical 9.3 CVSS. Check your routers. #cybersecurity #vulnerabilities #ciso #mssp secalerts.co/vulnerability/C…
1
1
157
🪓 Apache Juneau: CVSS 10 CRLF injection in HTTP response headers lets attackers split responses and redirect users. If your app sets headers or redirects from request data, you're exposed. CVE-2026-73117 #cybersecurity #apache #ciso #vulnerabilities secalerts.co/vulnerability/C…
92
💉 Public PoC dropped for CVE-2026-38595. Upload a crafted filename to the /sync endpoint in im3x Scriptables and get OS command injection. CVSS 9.8, no auth required. Patch or pull from v2-dev now.
#cybersecurity #vulnerabilities #ciso #mssp
secalerts.co/vulnerability/C…
1
2
238
Barracuda Email Gateway lets a remote attacker reaching the admin interface restore a crafted config archive without authentication, changing global settings. Chained with command injection, researchers reached root.
secalerts.co/news/barracuda-…
33
🔓 Public PoC dropped for CVE-2026-120277 — OS command injection in WAVLINK WN536AX6-A via the WireGuard CLI Group handler (sub_41a1d8 in /bin/ioos). CVSS 9.3, no auth needed. Check your network gear. #cybersecurity #vulnerabilities #ciso secalerts.co/vulnerability/C…
1
166
💉 Public PoC out for CVE-2026-123198: unauthenticated SSTI in LMFDB via /knowledge/render/. The render_knowl function exposes Jinja injection — no auth required, CVSS 9.3. Patch to commit 01829bd. #cybersecurity #vulnerabilities #ciso secalerts.co/vulnerability/C…
2
178
📎 Public PoC dropped for CVE-2026-118423. WP Libre Form 1.5.0.1 lets unauthenticated attackers upload PHP files via form submissions — no login needed, full RCE possible. Patch or remove it now. #cybersecurity #ciso #wordpress #vulnerabilities #mssp secalerts.co/vulnerability/C…
1
1
175
🧨 Public PoC dropped for CVE-2026-44267: Elo JS emitter sandbox escape via unfiltered `.constructor` access — no auth needed, full Node.js/browser code execution. Patch now. #cybersecurity #ciso #vulnerabilities #msp secalerts.co/vulnerability/C…
1
124
🔌 Public exploit out for Edimax BR-6208AC routers. CVE-2026-122051 hits /goform/mp with unauthenticated command injection — CVSS 9.3 critical, no login needed, full device compromise possible. Patch or isolate now. #cybersecurity #vulnerabilities #ciso secalerts.co/vulnerability/C…
1
2
93
Vulnerable Apache OFBiz servers can evaluate attacker-controlled Groovy code via a crafted upload and anonymous JSON request. Upgrade to 24.09.08+ and review exposed instances.
secalerts.co/news/apache-ofb…
1
53