Malwarecritical
⚡ Weekly Recap: Double-Tap Skimmers, PromptSpy AI, 30Tbps DDoS, Docker Malware & More
- CVEs
- CVE-2026-22769CVE-2026-25926CVE-2026-26119CVE-2026-2329CVE-2025-65717CVE-2026-1358CVE-2026-25108CVE-2026-25084CVE-2026-24789CVE-2026-2577CVE-2026-25903CVE-2026-26019CVE-2026-1670CVE-2025-7740CVE-2025-61928CVE-2026-20140CVE-2026-27118CVE-2026-27099CVE-2026-27100CVE-2026-24733CVE-2026-2648CVE-2026-2649CVE-2026-2650CVE-2025-29969CVE-2025-64127CVE-2025-64128CVE-2025-64129CVE-2025-64130CVE-2025-32355CVE-2025-59793CVE-2026-1357CVE-2025-9501CVE-2025-13818CVE-2025-11730CVE-2025-67303
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-11730 | A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35… | 7.2 | 1% | ||
| CVE-2025-13818 | Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent | 8.3 | <1% | ||
| CVE-2025-29969 | Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network | 7.5 | 1% | ||
CVE-2025-59793+1 related CVE | Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files | 9.4 group max | 1% | PoC | |
| CVE-2025-61928 | Better Auth: Unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the… | 9.3 | 18% | ||
| CVE-2025-64127 | An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input | 10.0 | 2% | ||
| CVE-2025-64128 | An OS command injection vulnerability exists due to incomplete validation of user-supplied input | 10.0 | 2% | ||
CVE-2025-64130+1 related CVE | Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the… | 9.3 group max | <1% | ||
| CVE-2025-65717 | An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page | 4.3 | <1% | PoC | |
| CVE-2025-67303 | An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data | 7.5 | 1% | PoC | |
| CVE-2025-7740 | Default credentials vulnerability exists in SuprOS product | 8.8 | <1% | ||
| CVE-2025-9501 | Unauthenticated Command Injection in W3 Total Cache WordPress Plugin | 9.0 | 20% | ||
| CVE-2026-1357 | Unauthenticated RCE in WPvivid Backup & Migration WordPress Plugin | 9.8 | 33% | ||
| CVE-2026-1358 | Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges | 9.3 | 1% | ||
| CVE-2026-1670 | The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery… | 9.3 | <1% | ||
| CVE-2026-22769 | Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access | 10.0 | 14% | KEV | KEV |
| CVE-2026-2329 | Unauthenticated RCE via stack buffer overflow in Grandstream GXP1600-series VoIP phones | 9.3 | 40% | ||
| CVE-2026-24733 | Improper Input Validation vulnerability in Apache Tomcat | 3.7 | <1% | PoC | |
| CVE-2026-24789 | An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication | 9.3 | <1% | ||
| CVE-2026-25084 | Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs | 9.3 | <1% | ||
| CVE-2026-25108 | Authenticated OS Command Injection in Soliton FileZen Exploited in the Wild | 8.7 | 5% | KEV | KEV |
| CVE-2026-2577 | The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require… | 10.0 | <1% | ||
| CVE-2026-25903 | Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required… | 8.7 | <1% | ||
| CVE-2026-25926 | Notepad++: An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an… | 7.3 | <1% | PoC | |
| CVE-2026-26019 | LangChain: The RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its… | 4.1 | <1% | ||
| CVE-2026-26119 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network | 8.8 | 1% | ||
CVE-2026-2649+2 related CVEs | Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | <1% | ||
CVE-2026-27099+1 related CVE | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark… | 8.0 group max | <1% | ||
| CVE-2026-27118 | SvelteKit: Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for… | 5.3 | <1% |
From the original article
13 min read at thehackernews.com
Security news rarely moves in a straight line. This week, it feels more like a series of sharp turns, some happening quietly in the background, others playing out in public view. The details are different, but the pressure points are familiar.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.