Obot <0.23.0 is vulnerable to HIGH severity SSRF via remote MCP URLs. Power Users+ can exploit this for internal/cloud metadata access. Upgrade to v0.23.0 now. https://radar.offseq.com/threat/obot-server-side-request-forgery-via-remote-mcp-server-url-a84328660b81bb11 #OffSeq #SSRF #CloudSecurity

CRITICAL: CVE-2026-91843 lets attackers run root code on Check Point Mgmt & Log Server via login. No exploitation yet — patch now. Tanium & Kaspersky also issue fixes. Details: https://radar.offseq.com/threat/check-point-kaspersky-tanium-patch-product-vulnerabilities-ae8c3757ea9b181a #OffSeq #Vul...

tailwindcss-form-ui v0.5.1 (npm) is a CRITICAL threat — malicious code enables remote code execution through a blockchain C2. Remove immediately and use only official tailwindlabs/tailwindcss-forms. https://radar.offseq.com/threat/malicious-code-in-tailwindcss-form-ui-npm-7a1a18bfdeeb8b15 #OffSeq...

CRITICAL malware in @kartyk-github-org/takedown-a (npm): full system compromise risk. Rotate all secrets from a secure device and plan for a full rebuild. Uninstalling isn’t enough. https://radar.offseq.com/threat/malicious-code-in-kartyk-github-orgtakedown-a-npm-3b5e9873beba7d4b #OffSeq #malware...

CVE-2026-76460 in Cisco ISE (3.1 – 3.5) is under active attack. CRITICAL auth bypass lets remote attackers access management UI. No workarounds — patch now: https://radar.offseq.com/threat/cisco-warns-of-max-severity-ise-zero-day-exploited-in-attacks-7c00b7de95d29289 🚨 #OffSeq #ZeroDay #Cisco

Mitsubishi Electric GX Works3 has a CRITICAL vuln (CVE-2026-15688, CVSS 9.2): local auth bypass lets attackers alter control programs. Limit local access until mitigation is released. #OffSeq #ICS https://radar.offseq.com/threat/cve-2026-15688-cwe-303-incorrect-implementation-of-authentication-al...

CVE-2026-76460: CRITICAL zero-day in Cisco ISE & ISE-PIC enables remote auth bypass and root access via API. Patch immediately — no workarounds except ACLs. Details: https://radar.offseq.com/threat/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day-d5bd452a61e0a8f8 #OffSeq #Cisco...

CRITICAL SSRF (CVE-2026-92576) in HKUDS nanobot <0.3.0 allows access to internal metadata & services. Restrict WebFetchTool, monitor requests, and check for vendor updates. https://radar.offseq.com/threat/cve-2026-92576-server-side-request-forgery-ssrf-in-hkuds-nanobot-4673f42d188d2ce5 #OffSeq #i...

WWBN AVideo ≤29.0 hit by CRITICAL auth bypass (CVE-2026-92578): attackers with a password hash can access any account. Restrict hash access, monitor systems, and check vendor advisories. https://radar.offseq.com/threat/cve-2026-92578-improper-authentication-in-wwbn-avideo-d660bbe72d13e3dc #OffSeq...

CRITICAL heap-based buffer overflow in NLnet Labs Unbound (≤1.26.0) risks RCE via DNSSEC validator. Update to 1.26.1+ immediately. More info: https://radar.offseq.com/threat/cve-2026-81642-cwe-122-heap-based-buffer-overflow-in-nlnet-labs-unbound-2ab04cc5a0313c65 #OffSeq #Unbound #Security

Pixel devices hit by a CRITICAL zero-day, actively exploited in the wild. Google’s Sept 2026 patch fixes it — update ASAP! 🔒 https://radar.offseq.com/threat/google-fixes-actively-exploited-android-zero-day-on-pixel-devices-d565312001e1a515 #OffSeq #Android #Security

CRITICAL: mySCADA myPRO (0 – 2.1) API vuln (CVE-2026-73807) lets unauth'd users access privileged controls. Restrict API access & watch for patch info. https://radar.offseq.com/threat/cve-2026-73807-cwe-862-in-myscada-technologies-myscada-mypro-e06debb83925d7aa #OffSeq #ICS #Vulnerability

CRITICAL zero-day in Cisco Secure Email Gateway is under active attack. Patch is out — apply immediately to prevent risk. No CVE or technical details yet. https://radar.offseq.com/threat/cisco-patches-secure-email-gateway-zero-day-exploited-in-attacks-76a43690673247c4 #OffSeq #Cisco #ZeroDay

Critical stack buffer overflow in D-Link DI-8300 (16.07) enables remote code execution. Exploit code is public. Restrict device access & monitor for attacks. https://radar.offseq.com/threat/cve-2026-91003-stack-based-buffer-overflow-in-d-link-di-8300-ce23f2734338a347 #OffSeq #CVE202691003 #DLink

D-Link DI-8400 routers (fw 16.07) hit by CRITICAL stack-based buffer overflow (CVE-2026-91001, CVSS 9.4) 🚨. Public exploit code available — restrict management access now. https://radar.offseq.com/threat/cve-2026-91001-stack-based-buffer-overflow-in-d-link-di-8400-abc2e3e858f255b9 #OffSeq #CVE202...

EFM ipTIME C200E 1.094 faces a CRITICAL OS command injection flaw (CVE-2026-90847, CVSS 9.4). Public exploit exists — restrict access and monitor devices. https://radar.offseq.com/threat/cve-2026-90847-os-command-injection-in-efm-iptime-c200e-1c30057b126bbbf4 #OffSeq #Vulnerability #IoTSecurity

D-Link DWR-M921 v1.1.52 hit by CRITICAL OS command injection (CVE-2026-90703) 🚨 Public exploit available, no patch yet. Restrict access & monitor activity. More: https://radar.offseq.com/threat/cve-2026-90703-os-command-injection-in-d-link-dwr-m921-f9739a3ef4495656 #OffSeq #CVE #RouterSecurity

CISA reports active exploitation of a CRITICAL GitLab vulnerability. No details on affected versions — monitor vendor advisories for updates and be ready to patch. https://radar.offseq.com/threat/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks-fbc70b60d8092d92 #OffSeq #GitLab #CyberT...

Totolink A3002MU routers face CRITICAL buffer overflow (CVE-2026-90607, CVSS 9.4). Exploit code is public. Restrict remote access & monitor for attacks until patches are issued. https://radar.offseq.com/threat/cve-2026-90607-buffer-overflow-in-totolink-a3002mu-f5be31acbfac3e1f #OffSeq #Vulnerabil...

Totolink A3002MU CRITICAL buffer overflow (CVSS 9.4) in /boafrm/formPortFw. Exploit code released — no patch yet. Restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-90608-buffer-overflow-in-totolink-a3002mu-43328ea907451224 #OffSeq #CVE202690608 #Vuln