CRITICAL: n8n-nodes-moonlet-helpers (npm, v1.0.0/1.0.4) installs attacker code via postinstall script. Remove package, scan for /tmp/.np, and avoid affected versions. https://radar.offseq.com/threat/malicious-code-in-n8n-nodes-moonlet-helpers-npm-12fed58075d25a88 #OffSeq #npm #Security

Eufy Omni C20 (<1.6.4) has a CRITICAL cert validation flaw (CVE-2026-93291). MITM risk & code execution possible. Patch status unconfirmed — review vendor updates. 🔐 https://radar.offseq.com/threat/cve-2026-93291-cwe-295-improper-certificate-validation-in-eufy-omni-c20-63bb60225f0bad8d #OffSeq #I...

CRITICAL: Isolation failure in Atlassian Rovo lets attackers access & run code in other user/tenant sessions. No patch yet — pause sensitive use, monitor vendor updates. https://radar.offseq.com/threat/critical-cross-user-and-cross-tenant-compromise-in-atlassian-rovo-d49ff9569505cde6 #OffSeq #Atl...

Deltaww DIAEnergie (pre-1.11.00.022) hit by CRITICAL Improper Authentication flaw — auth bypass possible. Patch ASAP when available. https://radar.offseq.com/threat/cve-2026-78308-cwe-287-improper-authentication-in-deltaww-diaenergie-6cc9f25ab57e2374 #OffSeq #ICS #Vulnerability

Malicious npm package '[email protected]' (CRITICAL) enables arbitrary code execution. Remove immediately, check for typosquatting, and verify dependencies. https://radar.offseq.com/threat/malicious-code-in-pino-testkit-npm-da4f2d1960e5a45d #OffSeq #npm #SupplyChain

IBM Concert (v1.0.0 – 3.0.0) is affected by a CRITICAL use-after-free vulnerability (CVSS 9.8). Remote exploitation possible — patch status unconfirmed. Monitor IBM advisories: https://radar.offseq.com/threat/cve-2026-6928-cwe-416-use-after-free-in-ibm-concert-2eb5c8a4bd6982d7 #OffSeq #IBM #CVE20...

CVE-2026-93352 in plank laravel-mediable (<7.0.2): CRITICAL risk of RCE via .pht file uploads. Update to 7.0.2+ to patch. https://radar.offseq.com/threat/cve-2026-93352-unrestricted-upload-of-file-with-dangerous-type-in-plank-laravel-mediable-969ae75c94489a3a #OffSeq #CVE202693352 #RCE

Adobe Connect & AEM Forms face CRITICAL vulnerabilities, including SQLi, XSS, SSRF. Patch within 30 days to prevent code execution & privilege escalation. No active exploits. https://radar.offseq.com/threat/adobe-patches-critical-flaws-in-connect-aem-forms-c099ebdbecb92098 #OffSeq #Adobe #Security

CRITICAL zero-day (CVE-2026-94127) in F5 BIG-IP APM (OAuth Auth Server) enables unauth RCE. Actively exploited. Patch hotfixes for 21.1.0, 17.5.0 – 17.5.1, 17.1.0 – 17.1.3 ASAP. https://radar.offseq.com/threat/critical-f5-big-ip-vulnerability-exploited-as-zero-day-024f528e7ee83eed #OffSeq #F5 #Ze...

CRITICAL zero-day (CVE-2026-93952) impacts Arista VeloCloud Orchestrator (on-prem <5.2.3.16, <6.4.2.8). Remote attackers can exploit without credentials. Patch immediately. https://radar.offseq.com/threat/arista-urges-immediate-patching-of-exploited-vco-zero-day-0c28c2caa003025a #OffSeq #ZeroDay ...

CVE-2026-94127 is a CRITICAL zero-day in F5 BIG-IP APM (OAuth Authorization Servers) with active RCE exploitation. Patch now or apply iRule mitigation. https://radar.offseq.com/threat/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks-191545153729ae57 #OffSeq #F5 #ZeroDay

WordPress patched the CRITICAL Click2Shell flaw (v4.7 – 7.1.0). Attackers could trigger remote code execution via inactive theme previews. Update to 7.1.1 or apply security backports immediately. https://radar.offseq.com/threat/wordpress-patches-click2shell-vulnerability-f550dfa1d978a913 #OffSeq ...

LOW severity: ISC Stormcast (Sep 22, 2026) reports no new vulnerabilities or threats. No affected products or action needed. Details: https://radar.offseq.com/threat/isc-stormcast-for-tuesday-september-22nd-2026-httpsiscsansedupodcastdetail10104-tue-sep-22nd-1ebaaa69bb952985 #OffSeq #Cybersecurit...

LOW severity: US proposes AI incident alert system with China. No current technical threat, but signals future policy changes for AI risk reporting. Monitor developments. https://radar.offseq.com/threat/us-proposes-ai-incident-alert-system-in-talks-with-china-bessent-says-0ae21c941fe0207e #OffSeq...

Netcore NBR200V2 firmware 1.3.241127.071246 faces CRITICAL remote command injection (CVE-2026-94099, CVSS 9.4). Public exploit, no patch. Isolate & monitor systems now. https://radar.offseq.com/threat/cve-2026-94099-command-injection-in-netcore-nbr200v2-adc35b079f75e0e5 #OffSeq #Netcore #Vulnerab...

Netcore NBR200V2 routers (v1.3.241127.071246) face a CRITICAL buffer overflow (CVE-2026-94101). Public exploit, no patch. Restrict remote access or replace device. https://radar.offseq.com/threat/cve-2026-94101-buffer-overflow-in-netcore-nbr200v2-21b7762bd81c815b #OffSeq #Netcore #Vulnerability

Three CRITICAL Linux kernel vulnerabilities now in CISA KEV: exploited for DoS, memory disclosure, or memory corruption. Patch all Linux systems immediately. Details: https://radar.offseq.com/threat/organizations-warned-of-3-exploited-linux-kernel-vulnerabilities-1c077e64a021762d #OffSeq #Linux #...

BioStar BIOS Update Utility 1.9.7.3 faces CRITICAL CVE-2026-94146: local write-what-where flaw with public exploit. No vendor fix. Restrict local access now. https://radar.offseq.com/threat/cve-2026-94146-write-what-where-condition-in-biostar-bios-update-utility-47de5318713632c6 #OffSeq #CVE20269...

BioStar Temp Monitor Utility 1.2.1806.2200 faces CRITICAL CVE-2026-94142: local attackers can perform arbitrary memory writes. No patch — limit local access. https://radar.offseq.com/threat/cve-2026-94142-write-what-where-condition-in-biostar-temperature-monitor-utility-b89c455f336372e0 #OffSeq #...

CRITICAL buffer overflow in Netcore NBR200V2 v1.3.241127.071246 (CVE-2026-94100). Remote exploit available. Restrict WAN VLAN config access — no patch yet. https://radar.offseq.com/threat/cve-2026-94100-buffer-overflow-in-netcore-nbr200v2-9ab8800727104374 #OffSeq #Netcore #Vuln