C4illin ConvertX <0.19.0 faces a CRITICAL flaw (CVSS 9.4): .recipe files can trigger code execution via Calibre. Upgrade to 0.19.0+ now! https://radar.offseq.com/threat/cve-2026-105080-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-c4illin-convertx-bd5c3a85ca8190d3 #OffSeq #C...

MikroTik RouterOS <7.24 hit by CVE-2026-84411 (CRITICAL, 9.8). Unauthenticated attackers can run code as root or DoS via web management. Restrict access & monitor HTTP traffic. Details: https://radar.offseq.com/threat/cve-2026-84411-cwe-191-in-mikrotik-routeros-962ba80173301661 #OffSeq #MikroTik ...

Dell CSM for Kubernetes hit by two CRITICAL vulnerabilities. No CVEs yet. Admins must patch ASAP to secure enterprise storage integrations. Details: https://radar.offseq.com/threat/dell-asks-admins-to-patch-max-severity-csm-flaws-as-soon-as-possible-8294df0e4995eed9 #OffSeq #Dell #Kubernetes

Webpros cPanel has a CRITICAL stored XSS (CVE-2026-93029) in WHM Manage SSL Hosts. Low-priv attackers can execute code. Restrict access & check for updates. https://radar.offseq.com/threat/cve-2026-93029-cwe-79-cross-site-scripting-xss-stored-in-webpros-cpanel-7c14cb89e30db301 #OffSeq #cPanel #Se...

CRITICAL: CVE-2026-103764 in kvcache-ai Mooncake (<0.3.13) lets unauthenticated users read/write memory — data leaks & code execution possible. Patch to 0.3.13+ ASAP! https://radar.offseq.com/threat/cve-2026-103764-untrusted-pointer-dereference-in-kvcache-ai-mooncake-1cbac989f2110be6 #OffSeq #CVE...

Critical use-after-free in esnet iperf3 3.21 (CVE-2026-101276, CVSS 9.2): remote, unauthenticated attackers can cause DoS or RCE. Upgrade to 3.22+ now. https://radar.offseq.com/threat/cve-2026-101276-cwe-416-use-after-free-in-esnet-iperf3-8a664a87c0e694fb #OffSeq #CVE2026101276 #iperf3

esnet iperf3 v3.20 & v3.21 hit by CRITICAL heap-based buffer overflow (CVE-2026-101283). Unauthenticated attackers can corrupt memory. Upgrade to 3.22 now. https://radar.offseq.com/threat/cve-2026-101283-cwe-122-heap-based-buffer-overflow-in-esnet-iperf3-1608d23cd8415ceb #OffSeq #CVE2026101283 #s...

Fireware OS CRITICAL code injection (CVE-2026-86131): remote attackers can gain root via BOVPN over TLS. Patch affected WatchGuard systems & APs immediately. Details: https://radar.offseq.com/threat/watchguard-patches-critical-fireware-os-code-injection-vulnerability-36035f2a6c97cfc4 #OffSeq #Vul...

CRITICAL OS command injection in zosmaai pi-llm-wiki (0.11.0 – 0.11.7). Public exploit out — upgrade to 0.11.8 now to block remote control risk. https://radar.offseq.com/threat/cve-2026-102911-os-command-injection-in-zosmaai-pi-llm-wiki-28aaee951c4eb21f #OffSeq #CVE2026102911 #Security

Ziroom ZHOME A0101 1.0.1.0 has a CRITICAL command injection vuln (CVE-2026-102794). No fix yet — exploit details public. Limit endpoint access & monitor systems. https://radar.offseq.com/threat/a-vulnerability-has-been-found-in-ziroom-zhome-a0101-1010-cve-2026-102794-9a56d1624759c7e9 #OffSeq #Vul...

Ziroom ZHOME A0101 v1.0.1.0 hit by CRITICAL command injection (CVE-2026-102794). Exploit is public, vendor silent. Assess your exposure and segment devices if possible. https://radar.offseq.com/threat/cve-2026-102794-command-injection-in-ziroom-zhome-a0101-70f3389000d03735 #OffSeq #IoTSecurity #C...

CRITICAL vuln in MyPresta Google Merchant Center Feed (v1.9.1 – 2.3.8): unauthenticated RCE via arbitrary file write. Patch to 2.3.9 ASAP! https://radar.offseq.com/threat/cve-2026-85520-cwe-73-external-control-of-file-name-or-path-in-mypresta-google-merchant-center-feed-ec39d5f257163d36 #OffSeq #...

CVE-2026-15390: Das U-Boot v2009.08 faces a CRITICAL out-of-bounds write flaw (CONFIG_IP_DEFRAG=y). Update to 2026.07 to block arbitrary code execution. https://radar.offseq.com/threat/cve-2026-15390-cwe-787-out-of-bounds-write-in-denx-software-engineering-das-u-boot-0f1571fd5895238c #OffSeq #Fir...

figlet-chalk-render v1.2.1 (npm) contains CRITICAL malicious code: on import, it downloads & runs a Windows executable, evading CI/sandbox. Remove & audit dependencies now. https://radar.offseq.com/threat/malicious-code-in-figlet-chalk-render-npm-e2cae6cc542e670e #OffSeq #npm #SupplyChainSecurity

nebulaai-sdk v1.0.0 (npm) is CRITICAL: Installs a RAT on Windows, opening C2 access with user privileges. Remove the package & conhost.exe if installed. Monitor for suspicious connections. https://radar.offseq.com/threat/malicious-code-in-nebulaai-sdk-npm-cf83f4133db4c1ba #OffSeq #npm #malware

FAST FAC1203R (20200116_2.0.4) faces a CRITICAL buffer overflow (CVE-2026-101354). Public exploit out, no vendor patch. Limit network access & monitor devices. https://radar.offseq.com/threat/cve-2026-101354-stack-based-buffer-overflow-in-fast-fac1203r-384c04ef24176780 #OffSeq #CVE2026101354 #IoT...

Netcore NAP930 v0.1.241010.141410 hit by CRITICAL OS command injection (CVE-2026-102240, CVSS 10). Public exploit, no patch. Isolate affected systems & monitor. https://radar.offseq.com/threat/cve-2026-102240-os-command-injection-in-netcore-nap930-5453a1be70791747 #OffSeq #Netcore #Vulnerability

CRITICAL: Ziroom ZHOME A0101 v1.0.1.0 has a command injection risk (CVE-2026-101264). No patch — limit API access & watch for updates. Full system compromise possible. https://radar.offseq.com/threat/cve-2026-101264-command-injection-in-ziroom-zhome-a0101-06a3a86bcb9501aa #OffSeq #IoTSecurity #CV...

CRITICAL buffer overflow (CVE-2026-101039) in FAST FAC1900R 20190827_2.0.2 enables remote code execution. Exploit is public, no patch. Apply network restrictions immediately. https://radar.offseq.com/threat/cve-2026-101039-stack-based-buffer-overflow-in-fast-fac1900r-f3ece93ec0ed3ff8 #OffSeq #CVE...

aaPanel BaoTa <=11.8.0 hit by CRITICAL OS command injection (CVE-2026-101009). Public exploit, no vendor fix. Restrict access & monitor systems. https://radar.offseq.com/threat/cve-2026-101009-os-command-injection-in-aapanel-baota-2affddad69ededf3 #OffSeq #CVE2026101009 #cybersecurity