Vulnerabilitycritical

Week in review: Weaponized OAuth redirection logic delivers malware, Patch Tuesday forecast

Help Net Securityby @helpnetsecurityMar 8, 2026 · 00:00 UTC (Mar 8, 2026)12 min read1 · 1 read

Read at helpnetsecurity.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-14500 CVE-2026-28289 CVE-2026-20128 CVE-2026-20122

Tags: cve-2025-14500 cve-2026-28289 cve-2026-20128 cve-2026-20122 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-14500	IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability	9.8	2%		Dec 23, 2025
CVE-2026-20122	Arbitrary File Overwrite via Privileged APIs in Cisco Catalyst SD-WAN Manager	5.4	26%	KEV	Feb 25, 2026 KEV Apr 20, 2026
CVE-2026-20128	DCA Password File Disclosure in Cisco Catalyst SD-WAN Manager	7.5	7%	KEV	Feb 25, 2026 KEV Apr 20, 2026
CVE-2026-28289	Authenticated RCE via .htaccess Upload Bypass in FreeScout 1.8.206 and Earlier	8.1	35%	PoC ×2	Mar 3, 2026

From the original article

12 min read at helpnetsecurity.com

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: BlacksmithAI: Open-source AI-powered penetration testing framework BlacksmithAI is an open-source penetration testing framework that uses multiple AI agents to execute different stages of a security assessment lifecycle.

Help Net Security

By @helpnetsecurity · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.