⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
- CVEs
- CVE-2026-3055CVE-2025-62843CVE-2025-62844CVE-2025-62845CVE-2025-62846CVE-2026-22898CVE-2026-4673CVE-2026-4677CVE-2026-4674CVE-2026-4404CVE-2026-1995CVE-2026-4681CVE-2025-15517CVE-2025-15518CVE-2025-15519CVE-2025-15605CVE-2025-62673CVE-2025-66176CVE-2026-32647CVE-2026-22765CVE-2026-22766CVE-2026-21637CVE-2026-21710CVE-2026-25185CVE-2026-1519CVE-2026-3104CVE-2026-3119CVE-2026-3591CVE-2026-2931CVE-2026-33656CVE-2026-3608CVE-2026-20817CVE-2025-33244CVE-2026-32746CVE-2026-3098
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-15517+3 related CVEs | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access… | 8.6 group max | 3% | ||
| CVE-2025-33244 | NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data | 9.0 | <1% | ||
| CVE-2025-62673 | Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or… | 8.6 | <1% | ||
CVE-2025-62846+3 related CVEs | An SQL injection vulnerability has been reported to affect QHora | 7.3 group max | <1% | ||
| CVE-2025-66176 | There: If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted… | 8.8 | <1% | ||
CVE-2026-1519+3 related CVEs | If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU | 7.5 group max | 2% | ||
| CVE-2026-1995 | In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the… | 7.8 | <1% | ||
| CVE-2026-20817 | Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally | 7.8 | 5% | PoC | |
| CVE-2026-21637 | A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use | 7.5 | 1% | ||
| CVE-2026-21710 | Uncaught TypeError DoS in Node.js HTTP Servers via __proto__ Request Header | 7.5 | 25% | ||
CVE-2026-22765+1 related CVE | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability | 8.8 group max | <1% | ||
| CVE-2026-22898 | A missing authentication for critical function vulnerability has been reported to affect QVR Pro | 9.3 | <1% | ||
| CVE-2026-25185 | Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network | 5.3 | 1% | ||
| CVE-2026-2931 | The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2 | 8.8 | <1% | ||
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP | 9.3 | 91% | KEVPoC | KEV |
| CVE-2026-3098 | The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function | 6.5 | <1% | ||
| CVE-2026-32647 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or… | 8.5 | <1% | ||
| CVE-2026-32746 | Out-of-Bounds Write in GNU inetutils telnetd Enables Unauthenticated RCE | 9.8 | 45% | PoC | |
| CVE-2026-33656 | EspoCRM: EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to… | 9.1 | <1% | PoC | |
| CVE-2026-3608 | Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can… | 7.5 | 1% | ||
| CVE-2026-4404 | Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI | 9.4 | <1% | ||
CVE-2026-4673+2 related CVEs | Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML… | 8.8 | <1% | ||
| CVE-2026-4681 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM | 9.3 | <1% |
From the original article
13 min read at thehackernews.com
Some weeks are loud. This one was quieter but not in a good way. Long-running operations are finally hitting courtrooms, old attack methods are showing up in new places, and research that stopped being theoretical right around the time defenders stopped paying attention.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.