SecAlerts

Real-time vulnerability alerts for all your software to all your teams.

[SecAlerts @SecAlertsCo]

Critical 10.0: CVE-2026-49185 hits FieldX MDM with unauthenticated OS command injection. Unverified adb payloads go straight into Runtime.exec(). No auth, no interaction, full system compromise. https://t.co/lcS1Zp31Gd

[SecAlerts @SecAlertsCo]

CVE-2026-41283: Critical 9.9 in OpenStack Mistral through 22.0.0. Policy enforcement bypass enables RCE via exposed API endpoints, leading to service credential exfiltration. If Mistral is in your stack, treat this as urgent. https://t.co/rnKKY85O1u

[SecAlerts @SecAlertsCo]

CVE-2026-46135: Critical (9.8) race condition in the Linux kernel's nvmet-tcp. ICReq handling vs queue teardown can be exploited remotely with no auth required. No interaction needed. Patch your kernel. #Linux #CVE https://t.co/ROSS12nEem

[SecAlerts @SecAlertsCo]

CVE-2026-46562: Critical 9.8 unauthenticated RCE in yamcs-core. Nashorn ScriptEngine evaluates user-supplied algorithm text with zero restrictions. No auth, no interaction, full system compromise possible. Patch now if you run YAMCS. #yamcs #infosec https://t.co/g31wDvmxLh

[SecAlerts @SecAlertsCo]

CVE-2026-44887: Critical (9.8) unauthenticated RCE in Pi.Alert. Attackers can inject arbitrary Python code via the web config editor, no credentials needed. If you're running Pi.Alert, update immediately. #NetworkSecurity #RCE
https://t.co/ScZTrD7vXs

[SecAlerts @SecAlertsCo]

CVSS 9.2 vulnerability affecting multiple HP Poly Voice VoIP phone models can be exploited.

Info, incl. fix info, at vulnerability alert service, #SecAlerts:

CVE-2026-0826: https://t.co/okp70i8b8w

#ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #CVE20260826 #HP

[SecAlerts @SecAlertsCo]

Actively exploited in the wild. CVE-2025-48595 is an integer overflow in Android Framework enabling local privilege escalation - no privileges needed. CVSS 8.4, now on CISA KEV. Patch now. https://t.co/n7vnaOEzt7

[SecAlerts @SecAlertsCo]

Actively exploited CVSS 9.8 Windows Netlogon vulnerability could lead to RCE.

Info, incl. fix info, at vulnerability alert service, #SecAlerts:

CVE-2026-41089: https://t.co/ucA8fqSaXC

#ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #CVE202641089 #Netlogon #Microsoft

[BleepingComputer @BleepinComputer]

⏱️ Attackers are exploiting vulnerabilities faster than many organizations can identify and patch them.

🛡️ @SecAlertsCo explains how faster vulnerability alerts can help reduce exposure and improve response times.

➡️ https://t.co/dDcXhS3f0z
#cybersecurity #sponsored

[SecAlerts @SecAlertsCo]

If you use an in-house vulnerability alert service or one that solely relies on NVD, you need to read this. Even if you don't, you'll learn something new.

#ciso #cio #cto #vulnerabilities #cybersecurity #secalerts #msp #mssp #zeroday

[BleepingComputer @BleepinComputer]

⏱️ Attackers are exploiting vulnerabilities faster than many organizations can identify and patch them.

🛡️ @SecAlertsCo explains how faster vulnerability alerts can help reduce exposure and improve response times.

➡️ https://t.co/dDcXhS3f0z
#cybersecurity #sponsored

[SecAlerts @SecAlertsCo]

Critical: Apache Solr 9.4.0-9.10.1 & 10.0.0 ships hardcoded credentials via bin/solr auth enable, handing remote attackers full admin access. No auth, no interaction needed. CVE-2026-44825 — patch or migrate now. https://t.co/9kZk1msJDm

[SecAlerts @SecAlertsCo]

Unauthenticated RCE in Mirasvit Cache Warmer for Magento 2. CVE-2026-45247 (CVSS 9.3) lets attackers exploit PHP object injection with zero privileges. Update to v1.11.12 now. #Magento #Security https://t.co/FsQ4BfgfT0

[SecAlerts @SecAlertsCo]

CVE-2026-10187: Totolink N300RH 6.1c.1353 has a stack-based buffer overflow in setWiFiBasicConfig (https://t.co/dUNkMF6ohq). Unauthenticated, network-exploitable. CVSS 8.9 high. Check your routers. #infosec https://t.co/seE7kUOdvW

[SecAlerts @SecAlertsCo]

CVSS 10.0 critical: CVE-2026-49197 hits the Acer Predator Connect W6x. Broken auth on web endpoints lets anyone bypass the HTTP Authorization header check entirely. Update to firmware W6x_GBL_2.00.000008 now. #NetworkSecurity https://t.co/b39Hx02Yxx

[SecAlerts @SecAlertsCo]

CVE-2026-49201: Acer Wave 7 router has a hardcoded AES key in upload.cgi. Anyone can decrypt, tamper, and re-encrypt your backups. CVSS 10 critical, no auth required. If this router is in your stack, act now. https://t.co/2Rsl1WSnmn

[SecAlerts @SecAlertsCo]

CVE-2026-49200: Critical severity on the Acer Wave 7 router. No auth needed to read acer_cgi.log, which exposes cleartext web + Telnet credentials. Full system compromise, no friction. Check your network gear. #CriticalVuln #InfoSec https://t.co/wmyilNCLiy

[SecAlerts @SecAlertsCo]

CVSS 10 critical in npm/vm2 (GHSA-v6mx-mf47-r5wg): sandbox escape via prototype manipulation using Buffer internals. No auth, no interaction, full host compromise possible. Patch to v3.11.4 if you run vm2. https://t.co/HrZl8rg776

[SecAlerts @SecAlertsCo]

CVSS 10.0 in vm2 (npm). CVE-2026-47131 is a critical sandbox escape via prototype manipulation - no auth, no interaction, full host compromise possible. If you use vm2, update to v3.11.4 now. #nodejs #security https://t.co/pYZr15pKcb

[SecAlerts @SecAlertsCo]

GHSA-m4wx-m65x-ghrr: vm2 sandbox escape, CVSS 10. A previous fix for CVE-2023-37903 was bypassed via a strict equality check flaw in nodevm.js. Network-exploitable, no auth needed, full RCE scope. Update vm2 now. https://t.co/Ly0xGUIdpu

[SecAlerts @SecAlertsCo]

CVSS 10.0 in vm2 (npm). CVE-2026-47137 is a sandbox escape that bypasses the fix for CVE-2023-37903 - unauthenticated, no interaction needed, full compromise possible. If vm2 is in your stack, treat this as critical. #nodejs #security https://t.co/mpwdoehrZO