🟠 CVE-2025-13774 - High (8.8)

A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13774/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12051 - High (7.8)

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12051/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-36640 - High (8.8)

A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-36640/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-10915 - Critical (9.8)

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-10915/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-37168 - High (8.2)

Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete ar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-37168/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

FYI: Es gibt einen Micropatch für die CredsSSP-Schwachstelle CVE-2025-47987 für Windows-Systeme, die von MS keine Updates mehr bekommen.

https://borncity.com/blog/2026/01/13/0patch-micropatch-fuer-credssp-schwachstelle-cve-2025-47987/

🔴 CVE-2025-68271 - Critical (10)

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68271/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21287 - High (7.8)

Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22861 - High (8.8)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior to 2.3.1.2, There is a heap-based buffer overflow in SIccCalcOp::De...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack