Ransomwarehigh
⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
- CVEs
- CVE-2026-48276CVE-2026-48283CVE-2026-48277CVE-2026-48281CVE-2026-48316CVE-2026-48282CVE-2026-48313CVE-2026-48315CVE-2026-48286CVE-2026-50548CVE-2026-50549CVE-2026-46242CVE-2026-6682CVE-2026-6687CVE-2026-6688CVE-2026-8037CVE-2026-28701CVE-2026-33560CVE-2026-31928CVE-2026-41120CVE-2026-41492CVE-2026-55047CVE-2026-13774CVE-2026-13788CVE-2026-48519CVE-2026-48520CVE-2026-7528CVE-2026-7524CVE-2026-3199CVE-2026-12166CVE-2026-12167CVE-2026-12168CVE-2026-56141CVE-2026-56142CVE-2026-50242CVE-2026-20213CVE-2026-20214CVE-2026-20215CVE-2026-20216CVE-2026-20217CVE-2026-20243CVE-2026-20244CVE-2026-20191CVE-2026-53917CVE-2026-54475CVE-2026-49877CVE-2026-13079CVE-2026-45504CVE-2026-14191CVE-2026-44024CVE-2026-44025CVE-2026-55957CVE-2026-55956CVE-2026-13136CVE-2025-15660CVE-2026-22678CVE-2026-49102CVE-2026-49103CVE-2026-42210CVE-2026-56022CVE-2026-12044CVE-2026-12050CVE-2025-66273CVE-2025-66279CVE-2026-22893CVE-2026-11310CVE-2026-11999CVE-2026-6679CVE-2026-55958CVE-2026-55960CVE-2026-55961CVE-2026-48611
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-22893+2 related CVEs | A command injection vulnerability has been reported to affect several QNAP operating system versions | 8.6 | 1% | ||
| CVE-2026-6679 | A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated | 8.8 group max | <1% | ||
CVE-2026-12044+1 related CVE | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON .. | 8.7 group max | <1% | ||
| CVE-2026-12166 | A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of service via crafted… | 5.5 | <1% | ||
| CVE-2026-12167 | The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver functionality via a… | 7.8 | <1% | ||
| CVE-2026-12168 | An improper validation vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute… | 7.8 | <1% | ||
| CVE-2026-13079 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT… | 7.3 | <1% | ||
CVE-2026-13788+1 related CVE | Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page | 8.8 group max | <1% | ||
| CVE-2026-14191 | An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp) | 7.8 | <1% | ||
| CVE-2026-20191 | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container | 7.5 | <1% | ||
| CVE-2026-20213 | A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded… | 7.5 | <1% | ||
| CVE-2026-22678 | Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that… | 5.1 | <1% | ||
CVE-2026-28701+2 related CVEs | Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate… | 9.3 group max | <1% | ||
| CVE-2026-3199 | A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task… | 9.4 | <1% | ||
| CVE-2026-41120 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability | 9.8 | <1% | ||
| CVE-2026-41492 | Dgraph: Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is… | 9.8 | 3% | PoC | |
| CVE-2026-42210 | Webmin: For Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and… | 5.3 | <1% | ||
CVE-2026-44024+1 related CVE | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on | 9.8 group max | 1% | ||
| CVE-2026-45504 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network | 8.8 | <1% | ||
| CVE-2026-46242 | Linux kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared… | 7.8 | 4% | PoC | |
| CVE-2026-48282 | Path Traversal Leading to RCE in Adobe ColdFusion | 10.0 group max | 42% | KEV | KEV |
| CVE-2026-48286 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code… | 10.0 | 1% | ||
| CVE-2026-48316 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… | 10.0 | 1% | ||
CVE-2026-48519+1 related CVE | Langflow: The "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works… | 9.6 group max | <1% | PoC ×2 | |
| CVE-2026-48611 | Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access… | 9.8 | 4% | ||
CVE-2026-49103+1 related CVE | Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component | 9.4 group max | <1% | ||
CVE-2026-49877+2 related CVEs | Improper Authorization vulnerability in Apache ActiveMQ | 8.1 group max | <1% | ||
CVE-2026-50242+2 related CVEs | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database… | 9.8 group max | <1% | ||
CVE-2026-50548+1 related CVE | Cursor: Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working… | 9.3 | 1% | ||
| CVE-2026-55047 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally | 5.5 | <1% | ||
CVE-2026-55957+1 related CVE | Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers… | 7.3 group max | 3% | ||
| CVE-2026-56022 | Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent | 6.9 | <1% | ||
CVE-2026-6687+2 related CVEs | FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums | 7.6 | <1% | PoC ×2 | |
CVE-2026-7524+1 related CVE | IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction | 9.8 group max | <1% | ||
| CVE-2026-8037 | Unauthenticated OS Command Injection RCE in Progress Kemp LoadMaster | 9.8 | 100% | KEVPoC | KEV |
From the original article
12 min read at thehackernews.com
A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.