24h | 7d | 30d

CVE-2025-30238

Overview

  • TP-Link Systems Inc.
  • HB810(US2) V1.0/1.6/2.0/2.6
10 Aug 2026
Published
09 Oct 2026
Updated
CVSS v4.0
HIGH (8.6)
EPSS
0.20%
KEV

Description

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

Statistics

  • 2 Posts
  • 3 Interactions
Last activity: 20 hours ago

Fediverse

Profile picture fallback
buherator @buherator
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series

https://seclists.org/fulldisclosure/2026/Oct/11

CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241
  • 1
  • 2
  • 0
  • 20h ago

Bluesky

Profile picture fallback
buherator @buherator.bsky.social
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series seclists.org -> CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241 Original->
  • 0
  • 0
  • 0
  • 20h ago

CVE-2025-30237

Overview

  • TP-Link Systems Inc.
  • HB810(US2) V1.0/1.6/2.0/2.6
10 Aug 2026
Published
09 Oct 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.33%
KEV

Description

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.

Statistics

  • 2 Posts
  • 3 Interactions
Last activity: 20 hours ago

Fediverse

Profile picture fallback
buherator @buherator
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series

https://seclists.org/fulldisclosure/2026/Oct/11

CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241
  • 1
  • 2
  • 0
  • 20h ago

Bluesky

Profile picture fallback
buherator @buherator.bsky.social
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series seclists.org -> CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241 Original->
  • 0
  • 0
  • 0
  • 20h ago

CVE-2025-30240

Overview

  • TP-Link Systems Inc.
  • HB810(US2) V1.0/1.6/2.0/2.6
10 Aug 2026
Published
12 Aug 2026
Updated
CVSS v4.0
MEDIUM (5.1)
EPSS
0.23%
KEV

Description

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.

Statistics

  • 2 Posts
  • 3 Interactions
Last activity: 20 hours ago

Fediverse

Profile picture fallback
buherator @buherator
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series

https://seclists.org/fulldisclosure/2026/Oct/11

CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241
  • 1
  • 2
  • 0
  • 20h ago

Bluesky

Profile picture fallback
buherator @buherator.bsky.social
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series seclists.org -> CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241 Original->
  • 0
  • 0
  • 0
  • 20h ago

CVE-2025-30239

Overview

  • TP-Link Systems Inc.
  • HB810(US2) V1.0/1.6/2.0/2.6
10 Aug 2026
Published
09 Oct 2026
Updated
CVSS v4.0
HIGH (8.5)
EPSS
0.20%
KEV

Description

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

Statistics

  • 2 Posts
  • 3 Interactions
Last activity: 20 hours ago

Fediverse

Profile picture fallback
buherator @buherator
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series

https://seclists.org/fulldisclosure/2026/Oct/11

CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241
  • 1
  • 2
  • 0
  • 20h ago

Bluesky

Profile picture fallback
buherator @buherator.bsky.social
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series seclists.org -> CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241 Original->
  • 0
  • 0
  • 0
  • 20h ago

CVE-2026-97851

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 9 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ Six flaws in dcm4chee-arc-light 5.35.1 enable data theft, tampering, deletion and denial of service; upgrade to 5.35.2+. - IOCs: CVE-2026-97851, CVE-2026-105279, CVE-2026-105667 - #CVE #Healthcare #ThreatIntel
  • 0
  • 1
  • 0
  • 9h ago

CVE-2026-105667

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 9 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ Six flaws in dcm4chee-arc-light 5.35.1 enable data theft, tampering, deletion and denial of service; upgrade to 5.35.2+. - IOCs: CVE-2026-97851, CVE-2026-105279, CVE-2026-105667 - #CVE #Healthcare #ThreatIntel
  • 0
  • 1
  • 0
  • 9h ago

CVE-2026-105279

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 9 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ Six flaws in dcm4chee-arc-light 5.35.1 enable data theft, tampering, deletion and denial of service; upgrade to 5.35.2+. - IOCs: CVE-2026-97851, CVE-2026-105279, CVE-2026-105667 - #CVE #Healthcare #ThreatIntel
  • 0
  • 1
  • 0
  • 9h ago

CVE-2026-110913

Overview

  • Google
  • Chrome
15 Oct 2026
Published
16 Oct 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Statistics

  • 1 Post
Last activity: Last hour

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

A Chrome security update fixes 10 flaws, including critical use after free bug CVE-2026-110922. Update to Chrome 155.0.8059.84 now.

securityonline.info/chrome-sec

  • 0
  • 0
  • 0
  • Last hour

CVE-2026-110919

Overview

  • Google
  • Chrome
15 Oct 2026
Published
16 Oct 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Statistics

  • 1 Post
Last activity: Last hour

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

A Chrome security update fixes 10 flaws, including critical use after free bug CVE-2026-110922. Update to Chrome 155.0.8059.84 now.

securityonline.info/chrome-sec

  • 0
  • 0
  • 0
  • Last hour

CVE-2026-89073

Overview

  • Progress
  • MOVEit Transfer
14 Oct 2026
Published
15 Oct 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.31%
KEV

Description

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Statistics

  • 1 Post
  • 3 Interactions
Last activity: 15 hours ago

Fediverse

Profile picture fallback
:rainbowCrow: @cR0w

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

community.progress.com/s/artic

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

  • 0
  • 3
  • 0
  • 15h ago
Showing 71 to 80 of 89 CVEs