ROOT-APP-NPM-GHSA-QWWW-VCR4-C8H2 GHSA-qwww-vcr4-c8h2 in react-router - Patched by Root

Root has patched GHSA-qwww-vcr4-c8h2 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-55685 CVE-2026-55685 in react-router - Patched by Root

Root has patched CVE-2026-55685 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-53667 CVE-2026-53667 in react-router - Patched by Root

Root has patched CVE-2026-53667 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-53666 CVE-2026-53666 in react-router - Patched by Root

Root has patched CVE-2026-53666 in the react-router package for Root:npm. Multiple fixed versions available...

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine

Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant by coming in over the private cellular network the local grid operator uses to reach remote equipment. The plant supplies heat to roughly 50,000 residents. Recovery began at about...

CVE-2026-51584: Improper Authentication

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

PT-2026-70231

Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description Insufficient input validation allows authenticated administrators connected to the local network to make unauthorized modifications to router software and functionality. Recommendations At th...

PT-2026-80691

Root has patched GHSA-qwww-vcr4-c8h2 in the react-router package for Root:npm. Multiple fixed versions available...

PT-2026-73233

damn so check this out... basically some crazy smart researchers found out that a bad SIM card can straight up hijack IoT devices like EV chargers and industrial routers using this sneaky old command called RUN AT. if an attacker gets physical access to stick a malicious card in there, it gives...

CVE-2026-72600: Improper Access Control

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72876

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and...

CVE-2026-72902 Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72886 Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch...

CVE-2026-72876

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and...

CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72873

Dokploy prior to v0.29.13 exposes Git provider secrets (githubClientSecret, githubPrivateKey, githubWebhookSecret) to users with only service:read by returning provider relations in application.one without redaction. Affected code paths: application.one in apps/dokploy/server/api/routers/applicat...

CVE-2026-72737

Dokploy (free self-hosted PaaS) vulnerability CVE-2026-72737 affects 0.29.8 and earlier. The flaw is in backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts, which accept a client-controlled destinationId and use the referenced destination wi...

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default. That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so shor...

Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-53666 DESCRIPTION: React...

CVE-2026-6373

CVE-2026-6373 affects Zyxel Networks WAH7601 routers (through 20072026). Described as exposure of sensitive system information to an unauthorized control sphere, enabling Web Application Fingerprinting. CVSS 3.1 base score 6.5 (Medium); metrics show Adjacent attack vector, no privileges required,...