⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
- CVEs
- CVE-2026-63030CVE-2026-60137CVE-2026-15409CVE-2026-15410CVE-2026-58644CVE-2026-56164CVE-2026-56155CVE-2026-53412CVE-2026-44747CVE-2026-27690CVE-2026-44761CVE-2026-57219CVE-2026-57221CVE-2026-59208CVE-2026-54305CVE-2026-60105CVE-2026-14960CVE-2026-14961CVE-2026-33894CVE-2026-33895CVE-2026-6875CVE-2026-42533CVE-2026-60005CVE-2026-56434CVE-2026-20296CVE-2026-20297CVE-2026-15265CVE-2026-6423CVE-2026-15053
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-14960 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface | 9.8 | <1% | ||
| CVE-2026-14961 | Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality | 6.2 | <1% | ||
| CVE-2026-15053 | Tanium addressed a denial of service vulnerability in Tanium Server | 7.5 | <1% | ||
| CVE-2026-15265 | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin… | 9.4 | <1% | ||
CVE-2026-15409+1 related CVE | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 group max | 7% | KEVRansomwarePoC | KEV |
CVE-2026-20296+1 related CVE | In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16… | 8.3 group max | <1% | ||
| CVE-2026-27690 | Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to… | 9.1 | <1% | ||
CVE-2026-33895+1 related CVE | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript | 7.5 | <1% | ||
CVE-2026-42533+2 related CVEs | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture… | 9.2 group max | <1% | PoC ×2 | |
| CVE-2026-44747 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could… | 9.9 | <1% | ||
| CVE-2026-44761 | SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help… | 9.1 | <1% | ||
| CVE-2026-53412 | Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user… | 9.8 | <1% | ||
| CVE-2026-54305 | n8n is an open source workflow automation platform | 8.9 | <1% | ||
| CVE-2026-56155 | Local Privilege Escalation in Microsoft Active Directory Federation Services | 7.8 | <1% | KEV | KEV |
| CVE-2026-56164 | Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation | 9.8 | 1% | KEV | KEV |
CVE-2026-57219+1 related CVE | RabbitMQ: 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations… | 8.7 group max | 2% | ||
| CVE-2026-58644 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server | 9.8 | 16% | KEV | KEV |
| CVE-2026-59208 | n8n is an open source workflow automation platform | 7.6 | 3% | ||
| CVE-2026-60105 | Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the… | 7.7 | 2% | ||
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×7 | KEV |
| CVE-2026-6423 | A local privilege escalation vulnerability in ESET Inspect Connector | 8.5 | <1% | ||
| CVE-2026-6875 | Unauthenticated Remote Code Execution in ServiceNow AI Platform | 9.5 | 1% | PoC |
From the original article
12 min read at thehackernews.com
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.