CRITICAL: SQL Injection in Unlimited Elements For Elementor (<2.0.21). Sites at risk — monitor for fixes & restrict access. https://radar.offseq.com/threat/cve-2026-103355-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-3504f0f6c5f88104 #OffSeq #WordPress #SQLI...

InternLM MindSearch 0.1.0 faces CRITICAL code injection (CVE-2026-105135). Remote attackers can run arbitrary code — no patch yet. Restrict access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-105135-code-injection-in-internlm-mindsearch-f0d6fc8a61cd76d9 #OffSeq #CVE202610513...

Vulnerability CVE-2026-88779 (HIGH, CVSS 8.7) affects NetScaler ADC/Gateway pre-14.1-73.41. Remote attacks possible — patch now. No active exploits detected. https://radar.offseq.com/threat/cve-2026-88779-vulnerability-in-netscaler-adc-93f6c6cf8720e4e9 #OffSeq #NetScaler #Security

CRITICAL: Bouncy Castle for Java <1.86 lets attackers hijack X.509 identities in MLS groups. Upgrade to v1.86+ for protection. https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-messaging-layer-security-mls-rfc-9420-implementation-did-not-53cae24ecd925b00 #OffSeq #BouncyCast...

CRITICAL vulnerabilities in Fortra BoKS allow auth bypass, root command injection, and memory corruption. No active exploitation yet — patch immediately to protect privileged access. https://radar.offseq.com/threat/fortra-patches-critical-vulnerabilities-in-boks-b7c49740fa76eb7b #OffSeq #Vulnerab...

CRITICAL vuln in Monta monta.app (CVE-2026-95102, CVSS 9.4): missing WebSocket auth lets attackers impersonate charging stations. Restrict endpoint access & monitor activity. More: https://radar.offseq.com/threat/cve-2026-95102-cwe-306-in-monta-montaapp-d0effdc35e6b46a2 #OffSeq #CVE202695102 #AppSec

C4illin ConvertX <0.19.0 faces a CRITICAL flaw (CVSS 9.4): .recipe files can trigger code execution via Calibre. Upgrade to 0.19.0+ now! https://radar.offseq.com/threat/cve-2026-105080-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-c4illin-convertx-bd5c3a85ca8190d3 #OffSeq #C...

MikroTik RouterOS <7.24 hit by CVE-2026-84411 (CRITICAL, 9.8). Unauthenticated attackers can run code as root or DoS via web management. Restrict access & monitor HTTP traffic. Details: https://radar.offseq.com/threat/cve-2026-84411-cwe-191-in-mikrotik-routeros-962ba80173301661 #OffSeq #MikroTik ...

Dell CSM for Kubernetes hit by two CRITICAL vulnerabilities. No CVEs yet. Admins must patch ASAP to secure enterprise storage integrations. Details: https://radar.offseq.com/threat/dell-asks-admins-to-patch-max-severity-csm-flaws-as-soon-as-possible-8294df0e4995eed9 #OffSeq #Dell #Kubernetes

Webpros cPanel has a CRITICAL stored XSS (CVE-2026-93029) in WHM Manage SSL Hosts. Low-priv attackers can execute code. Restrict access & check for updates. https://radar.offseq.com/threat/cve-2026-93029-cwe-79-cross-site-scripting-xss-stored-in-webpros-cpanel-7c14cb89e30db301 #OffSeq #cPanel #Se...

CRITICAL: CVE-2026-103764 in kvcache-ai Mooncake (<0.3.13) lets unauthenticated users read/write memory — data leaks & code execution possible. Patch to 0.3.13+ ASAP! https://radar.offseq.com/threat/cve-2026-103764-untrusted-pointer-dereference-in-kvcache-ai-mooncake-1cbac989f2110be6 #OffSeq #CVE...

Critical use-after-free in esnet iperf3 3.21 (CVE-2026-101276, CVSS 9.2): remote, unauthenticated attackers can cause DoS or RCE. Upgrade to 3.22+ now. https://radar.offseq.com/threat/cve-2026-101276-cwe-416-use-after-free-in-esnet-iperf3-8a664a87c0e694fb #OffSeq #CVE2026101276 #iperf3

esnet iperf3 v3.20 & v3.21 hit by CRITICAL heap-based buffer overflow (CVE-2026-101283). Unauthenticated attackers can corrupt memory. Upgrade to 3.22 now. https://radar.offseq.com/threat/cve-2026-101283-cwe-122-heap-based-buffer-overflow-in-esnet-iperf3-1608d23cd8415ceb #OffSeq #CVE2026101283 #s...

Fireware OS CRITICAL code injection (CVE-2026-86131): remote attackers can gain root via BOVPN over TLS. Patch affected WatchGuard systems & APs immediately. Details: https://radar.offseq.com/threat/watchguard-patches-critical-fireware-os-code-injection-vulnerability-36035f2a6c97cfc4 #OffSeq #Vul...

CRITICAL OS command injection in zosmaai pi-llm-wiki (0.11.0 – 0.11.7). Public exploit out — upgrade to 0.11.8 now to block remote control risk. https://radar.offseq.com/threat/cve-2026-102911-os-command-injection-in-zosmaai-pi-llm-wiki-28aaee951c4eb21f #OffSeq #CVE2026102911 #Security

Ziroom ZHOME A0101 1.0.1.0 has a CRITICAL command injection vuln (CVE-2026-102794). No fix yet — exploit details public. Limit endpoint access & monitor systems. https://radar.offseq.com/threat/a-vulnerability-has-been-found-in-ziroom-zhome-a0101-1010-cve-2026-102794-9a56d1624759c7e9 #OffSeq #Vul...

Ziroom ZHOME A0101 v1.0.1.0 hit by CRITICAL command injection (CVE-2026-102794). Exploit is public, vendor silent. Assess your exposure and segment devices if possible. https://radar.offseq.com/threat/cve-2026-102794-command-injection-in-ziroom-zhome-a0101-70f3389000d03735 #OffSeq #IoTSecurity #C...

CRITICAL vuln in MyPresta Google Merchant Center Feed (v1.9.1 – 2.3.8): unauthenticated RCE via arbitrary file write. Patch to 2.3.9 ASAP! https://radar.offseq.com/threat/cve-2026-85520-cwe-73-external-control-of-file-name-or-path-in-mypresta-google-merchant-center-feed-ec39d5f257163d36 #OffSeq #...

CVE-2026-15390: Das U-Boot v2009.08 faces a CRITICAL out-of-bounds write flaw (CONFIG_IP_DEFRAG=y). Update to 2026.07 to block arbitrary code execution. https://radar.offseq.com/threat/cve-2026-15390-cwe-787-out-of-bounds-write-in-denx-software-engineering-das-u-boot-0f1571fd5895238c #OffSeq #Fir...

figlet-chalk-render v1.2.1 (npm) contains CRITICAL malicious code: on import, it downloads & runs a Windows executable, evading CI/sandbox. Remove & audit dependencies now. https://radar.offseq.com/threat/malicious-code-in-figlet-chalk-render-npm-e2cae6cc542e670e #OffSeq #npm #SupplyChainSecurity