1. CVE-2026-124058 – TOTOLINK CA300-PoE Reason: Remotely exploitable buffer overflow with a publicly available exploit may allow attackers to compromise affected network devices.
2. CVE-2026-67449 – Portabase Reason: Upgrade to version 1.21.2 immediately, as unauthenticated attackers may overwrite sensitive files, including the AES master encryption key, potentially compromising stored data.
3. CVE-2026-126812 – blueprintUE Self-Hosted Edition Reason: Exposed MariaDB services with empty root passwords may allow unauthorized database access, modification, or deletion.
4. CVE-2026-126797 – NextScan Reason: Secure JWT authentication, replace hardcoded signing keys, and restrict administrator access to prevent unauthorized administrative control.
5. CVE-2026-65840 – Fider Reason: Unauthenticated attackers can access sensitive log archives, extract JWT secrets, create administrator accounts, and gain full server control.
The five CVEs affect network devices, database platforms, self-hosted applications, security scanners, and multi-tenant environments, potentially resulting in device compromise, authentication bypass, unauthorized access, data exposure, database manipulation, and system takeover. Public exploits, insecure configurations, and hardcoded authentication keys further increase these risks.
Organizations should identify affected assets, apply available patches, secure exposed services and administrative interfaces, strengthen authentication, and continuously monitor suspicious activities to reduce exposure and prevent potential attacks.
01. DOES THIS AFFECT ME?
CVE-2026-124058 – TOTOLINK CA300-PoE: Yes, if your network device is running firmware version 6.2c.884.
CVE-2026-67449 – Portabase: Yes, if your environment uses a Portabase version earlier than 1.21.2.
CVE-2026-126812 – blueprintUE Self-Hosted Edition: Yes, if you use a version earlier than 4.3.7 with an exposed MariaDB service and an empty root password.
CVE-2026-126797 – NextScan: Yes, if your organization uses versions 1.1.0 to 1.2.0, which are vulnerable to authentication bypass.
CVE-2026-65840 – Fider: Yes, if you use a version earlier than 0.36.0 in multi-tenant mode (HOST_MODE=multi). Single-host deployments are not affected.
02. HOW EXPOSED AM I?
Internet-facing vulnerable servers and applications face increased risks of unauthorized access and potential compromise.
Portabase systems are at risk of unauthorized file modification, including the AES master encryption key, which could affect stored data security.
blueprintUE deployments with exposed MariaDB services and empty root passwords may face unauthorized database access, data theft, or manipulation.
NextScan installations may be vulnerable to authentication bypass, allowing attackers to gain administrative access to security scan data and system functions.
Fider multi-tenant deployments may allow attackers to bypass tenant isolation and gain unauthorized access to accounts across tenants.
03. WHAT SHOULD I DO NOW?
Update network device firmware and disable unnecessary remote administration.
Upgrade vulnerable software and check sensitive files and encryption keys for unauthorized changes.
Disable default or empty passwords and allow database access only from trusted networks.
Replace hardcoded JWT keys, strengthen authentication, and limit administrative privileges.
Apply security patches and enforce proper tenant isolation and access controls.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
