Vulnerabilities

Vulnerabilities

Bransys ELD Flaws Could Reveal Live Fleet Telemetry Through Shared Credentials

Three Bransys ELD flaws expose live fleet telemetry via shared MQTT and FTP credentials and unencrypted traffic, risking multi-carrier data leaks.

Sep 17, 202619:31 5 min readRead →

Vulnerabilities

Cisco ISE API Authentication Flaw Opens a Remote Path to Root Access

Cisco warns of exploited CVE-2026-76460 in ISE with CVSS 10.0 enabling unauthenticated remote root access. See affected versions, patches, mitigations.

Sep 17, 202607:47 6 min readRead →

Vulnerabilities

One Shared JWT Secret Exposes Issabel PBX Servers to Remote Command Execution

CVE-2026-89026 in Issabel Framework lets unauthenticated attackers forge JWTs with a hard-coded key and execute commands as Asterisk via pbxapi.

Sep 17, 202605:20 5 min readRead →

Vulnerabilities

Siemens Reyrolle 7SR5 Flaws Expose Energy Devices to Authentication Bypass and Remote Crashes

CISA warns 14 flaws in Siemens Reyrolle 7SR5 before V2.70, including critical CVE-2026-62645 auth bypass and remote crash bugs. Upgrade advised.

Sep 17, 202601:23 5 min readRead →

Vulnerabilities

CareCam Camera Flaws Open Paths to Live Video, Root Access and Wi-Fi Credential Theft

Seven flaws in CareCam CM2507 cameras expose live video, ONVIF access, root passwords and Wi-Fi credentials, risking surveillance and network compromise.

Sep 16, 202621:26 6 min readRead →

Vulnerabilities

Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks

Google patched CVE-2026-58704, a Pixel modem privilege-escalation zero-day exploited in targeted attacks and added to CISA's KEV catalog.

Sep 16, 202617:41 6 min readRead →

Vulnerabilities

Critical Events Calendar Flaws Put More Than 200,000 WordPress Sites at Risk

Two critical 9.8 RCE flaws in The Events Calendar plugin expose 200,000+ WordPress sites. Update to version 6.17.4.1 to fix both vulnerabilities.

Sep 16, 202613:22 5 min readRead →

Vulnerabilities

Attackers Exploit WooCommerce Plugin Flaw to Install PHP Web Shells

Attackers exploit CVE-2026-27540 in a WooCommerce plugin to upload PHP web shells. Learn the indicators, impact, and recommended defenses.

Sep 16, 202611:31 5 min readRead →

Vulnerabilities

Siemens Patches Teamcenter Authentication Redirect XSS Across Four Release Branches

Siemens patched CVE-2026-58113, a reflected XSS in Teamcenter /auth/ flow affecting four branches. Upgrade V2412, V2506, V2512, V2606 now.

Sep 16, 202605:45 5 min readRead →