⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More
- CVEs
- CVE-2026-20127CVE-2025-40538CVE-2025-40539CVE-2025-40540CVE-2025-40541CVE-2026-20122CVE-2026-20126CVE-2026-20128CVE-2026-25755CVE-2025-12543CVE-2026-22719CVE-2026-22720CVE-2026-22721CVE-2026-3061CVE-2026-3062CVE-2026-3063CVE-2025-10010CVE-2025-13942CVE-2025-13943CVE-2026-1459CVE-2025-71210CVE-2025-71211CVE-2026-0542CVE-2026-24061CVE-2026-21902CVE-2025-29631CVE-2025-1242CVE-2025-15576CVE-2026-26365CVE-2026-27739
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10010 | The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows… | 6.8 | <1% | ||
| CVE-2025-1242 | The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse… | 9.3 | <1% | ||
| CVE-2025-12543 | Undertow HTTP server core: The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing… | 9.6 | 1% | ||
| CVE-2025-13942 | A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to… | 9.8 | 1% | ||
| CVE-2025-13943 | A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could… | 8.8 | 1% | ||
| CVE-2025-15576 | If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other… | 7.5 | <1% | ||
| CVE-2025-29631 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through… | 9.8 | 2% | ||
CVE-2025-40541+3 related CVEs | An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as… | 7.2 | <1% | ||
CVE-2025-71210+1 related CVE | A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected… | 9.8 | 4% | ||
| CVE-2026-0542 | ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform | 9.2 | <1% | ||
| CVE-2026-1459 | A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through… | 7.2 | <1% | ||
| CVE-2026-20122 | Arbitrary File Overwrite via Privileged APIs in Cisco Catalyst SD-WAN Manager | 5.4 | 26% | KEV | KEV |
CVE-2026-20128+1 related CVE | DCA Password File Disclosure in Cisco Catalyst SD-WAN Manager | 7.5 group max | 7% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
| CVE-2026-21902 | An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX… | 9.3 | 18% | ||
| CVE-2026-22719 | Unauthenticated Command Injection RCE in Broadcom VMware Aria Operations | 8.1 | 18% | KEV | KEV |
CVE-2026-22720+1 related CVE | VMware Aria Operations contains a stored cross-site scripting vulnerability | 9.0 group max | <1% | ||
| CVE-2026-24061 | Argument Injection Authentication Bypass in GNU Inetutils telnetd | 9.8 | 99% | KEVPoC ×8 | KEV |
| CVE-2026-25755 | jsPDF is a library to generate PDFs in JavaScript | 8.8 | <1% | PoC | |
| CVE-2026-26365 | Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the… | 4.0 | <1% | ||
| CVE-2026-27739 | Angular SSR: 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling… | 9.2 | <1% | PoC | |
CVE-2026-3062+2 related CVEs | Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a… | 9.8 group max | <1% |
From the original article
13 min read at thehackernews.com
This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.