CRITICAL buffer overflow in Netcore NBR200V2 v1.3.241127.071246 (CVE-2026-94100). Remote exploit available. Restrict WAN VLAN config access — no patch yet. https://radar.offseq.com/threat/cve-2026-94100-buffer-overflow-in-netcore-nbr200v2-9ab8800727104374 #OffSeq #Netcore #Vuln

Netcore NBR200V2 routers v1.3.241127.071246 face a CRITICAL 9.4 CVSS command injection (CVE-2026-94096). Exploit is public. No patch yet — segment or limit access. https://radar.offseq.com/threat/cve-2026-94096-command-injection-in-netcore-nbr200v2-73f6afc059a1e2bc #OffSeq #Netcore #Vulnerability

CRITICAL: Comfast CF-N1-S v2.6.0.1 has a stack buffer overflow (CVE-2026-94003). Remote exploitation possible; public exploit disclosed. Restrict access, monitor for anomalies. https://radar.offseq.com/threat/cve-2026-94003-stack-based-buffer-overflow-in-comfast-cf-n1-s-1046130f838f5eec #OffSeq #...

D-Link R95 routers (BE9500_1.00.16) face a CRITICAL OS command injection (CVE-2026-93958, CVSS 9.4). No patch — public exploit exists. Restrict device exposure & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93958-os-command-injection-in-d-link-r95-a15aa6eceda20938 #OffSeq #CVE20269...

CRITICAL vuln in Suricata 8.0.0 – 8.0.6 (CVE-2026-94083): DoH2 type confusion can lead to DoS. Upgrade to 8.0.7+ ASAP 🛡️. Details: https://radar.offseq.com/threat/cve-2026-94083-cwe-843-access-of-resource-using-incompatible-type-type-confusion-in-oisf-suricata-a9f0752b258da862 #OffSeq #Suricata #...

Suricata <8.0.7 has a CRITICAL use-after-free flaw (CVE-2026-94084, CVSS 9.4). Affected by certain HTTP/2 rules. Upgrade to 8.0.7+ to mitigate risks. https://radar.offseq.com/threat/cve-2026-94084-cwe-416-use-after-free-in-oisf-suricata-f54e858a25f14d6f #OffSeq #Suricata #Vulnerability

Botiga Pro <1.6.5 has a CRITICAL flaw: missing REST API auth lets attackers hijack WP sites — inject scripts, trash posts, escalate privileges. Update to 1.6.5+ ASAP. https://radar.offseq.com/threat/cve-2026-86591-cwe-862-missing-authorization-in-botiga-pro-dcf5d6244d090e38 #OffSeq #WordPress #Vuln

Totolink A3002MU faces a CRITICAL command injection flaw (CVE-2026-93742, CVSS 9.4). Remote attackers can exploit this — public exploit exists. Restrict access & monitor for compromise. https://radar.offseq.com/threat/cve-2026-93742-command-injection-in-totolink-a3002mu-0eaffbb279ea62b7 #OffSeq #...

Obot <0.23.0 is vulnerable to HIGH severity SSRF via remote MCP URLs. Power Users+ can exploit this for internal/cloud metadata access. Upgrade to v0.23.0 now. https://radar.offseq.com/threat/obot-server-side-request-forgery-via-remote-mcp-server-url-a84328660b81bb11 #OffSeq #SSRF #CloudSecurity

CRITICAL: CVE-2026-91843 lets attackers run root code on Check Point Mgmt & Log Server via login. No exploitation yet — patch now. Tanium & Kaspersky also issue fixes. Details: https://radar.offseq.com/threat/check-point-kaspersky-tanium-patch-product-vulnerabilities-ae8c3757ea9b181a #OffSeq #Vul...

tailwindcss-form-ui v0.5.1 (npm) is a CRITICAL threat — malicious code enables remote code execution through a blockchain C2. Remove immediately and use only official tailwindlabs/tailwindcss-forms. https://radar.offseq.com/threat/malicious-code-in-tailwindcss-form-ui-npm-7a1a18bfdeeb8b15 #OffSeq...

CRITICAL malware in @kartyk-github-org/takedown-a (npm): full system compromise risk. Rotate all secrets from a secure device and plan for a full rebuild. Uninstalling isn’t enough. https://radar.offseq.com/threat/malicious-code-in-kartyk-github-orgtakedown-a-npm-3b5e9873beba7d4b #OffSeq #malware...

CVE-2026-76460 in Cisco ISE (3.1 – 3.5) is under active attack. CRITICAL auth bypass lets remote attackers access management UI. No workarounds — patch now: https://radar.offseq.com/threat/cisco-warns-of-max-severity-ise-zero-day-exploited-in-attacks-7c00b7de95d29289 🚨 #OffSeq #ZeroDay #Cisco

Mitsubishi Electric GX Works3 has a CRITICAL vuln (CVE-2026-15688, CVSS 9.2): local auth bypass lets attackers alter control programs. Limit local access until mitigation is released. #OffSeq #ICS https://radar.offseq.com/threat/cve-2026-15688-cwe-303-incorrect-implementation-of-authentication-al...

CVE-2026-76460: CRITICAL zero-day in Cisco ISE & ISE-PIC enables remote auth bypass and root access via API. Patch immediately — no workarounds except ACLs. Details: https://radar.offseq.com/threat/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day-d5bd452a61e0a8f8 #OffSeq #Cisco...

CRITICAL SSRF (CVE-2026-92576) in HKUDS nanobot <0.3.0 allows access to internal metadata & services. Restrict WebFetchTool, monitor requests, and check for vendor updates. https://radar.offseq.com/threat/cve-2026-92576-server-side-request-forgery-ssrf-in-hkuds-nanobot-4673f42d188d2ce5 #OffSeq #i...

WWBN AVideo ≤29.0 hit by CRITICAL auth bypass (CVE-2026-92578): attackers with a password hash can access any account. Restrict hash access, monitor systems, and check vendor advisories. https://radar.offseq.com/threat/cve-2026-92578-improper-authentication-in-wwbn-avideo-d660bbe72d13e3dc #OffSeq...

CRITICAL heap-based buffer overflow in NLnet Labs Unbound (≤1.26.0) risks RCE via DNSSEC validator. Update to 1.26.1+ immediately. More info: https://radar.offseq.com/threat/cve-2026-81642-cwe-122-heap-based-buffer-overflow-in-nlnet-labs-unbound-2ab04cc5a0313c65 #OffSeq #Unbound #Security

Pixel devices hit by a CRITICAL zero-day, actively exploited in the wild. Google’s Sept 2026 patch fixes it — update ASAP! 🔒 https://radar.offseq.com/threat/google-fixes-actively-exploited-android-zero-day-on-pixel-devices-d565312001e1a515 #OffSeq #Android #Security

CRITICAL: mySCADA myPRO (0 – 2.1) API vuln (CVE-2026-73807) lets unauth'd users access privileged controls. Restrict API access & watch for patch info. https://radar.offseq.com/threat/cve-2026-73807-cwe-862-in-myscada-technologies-myscada-mypro-e06debb83925d7aa #OffSeq #ICS #Vulnerability