⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
- CVEs
- CVE-2026-16232CVE-2025-66376CVE-2026-54121CVE-2026-16723CVE-2026-32194CVE-2026-32191CVE-2026-10591CVE-2026-48294CVE-2026-8933CVE-2026-62144CVE-2026-62145CVE-2026-64600CVE-2026-15226CVE-2026-15899CVE-2026-15900CVE-2026-15901CVE-2026-15342CVE-2026-16411CVE-2026-16412CVE-2026-16360CVE-2026-16157CVE-2026-14985CVE-2026-47056CVE-2026-60217CVE-2026-60358CVE-2026-60360CVE-2026-60365CVE-2026-60366CVE-2026-60379CVE-2026-60389CVE-2026-60644CVE-2026-61211CVE-2026-60402CVE-2026-61146CVE-2026-15611CVE-2026-15617CVE-2026-57239CVE-2026-57308CVE-2026-23795CVE-2026-23794CVE-2026-65906CVE-2026-64812CVE-2026-64813CVE-2026-8085CVE-2026-8312CVE-2026-8313CVE-2026-8314CVE-2026-12927CVE-2026-42958CVE-2026-42953CVE-2026-49033CVE-2025-40947CVE-2025-40948CVE-2025-40949CVE-2026-54052
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-40949+2 related CVEs | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400… | 8.9 group max | <1% | ||
| CVE-2025-66376 | Stored Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI | 6.1 | 20% | KEV | KEV |
| CVE-2026-10591 | Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute… | 8.6 | <1% | ||
| CVE-2026-12927 | CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is… | 8.4 | <1% | ||
| CVE-2026-14985 | The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware | 7.8 | <1% | ||
| CVE-2026-15226 | A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine) | 8.4 | <1% | ||
| CVE-2026-15342 | Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate… | 6.5 | <1% | ||
| CVE-2026-15611 | Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain… | 9.1 | <1% | ||
| CVE-2026-15617 | Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or… | 9.1 | <1% | ||
CVE-2026-15901+2 related CVEs | Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 9.6 | <1% | ||
| CVE-2026-16157 | Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories | 7.8 | <1% | ||
| CVE-2026-16232 | Authentication Bypass in Check Point SmartConsole Grants Full Admin Access | 9.3 | 4% | KEV | KEV |
CVE-2026-16412+2 related CVEs | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152 | 9.8 | <1% | ||
| CVE-2026-16723 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83 | 9.0 | <1% | PoC ×3 | |
CVE-2026-23794+1 related CVE | Reflected XSS in Apache Syncope's Enduser Login page | 6.8 group max | <1% | ||
CVE-2026-32194+1 related CVE | Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code… | 9.8 | 1% | ||
| CVE-2026-42953 | The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an… | 8.4 | <1% | ||
| CVE-2026-42958 | The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files | 8.4 | <1% | ||
| CVE-2026-47056 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
| CVE-2026-48294 | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability | 7.4 | 2% | ||
| CVE-2026-49033 | The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code | 8.4 | <1% | ||
| CVE-2026-54052 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations | 9.9 | <1% | ||
| CVE-2026-54121 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network | 8.8 | <1% | PoC ×3 | |
| CVE-2026-57239 | The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate… | 7.8 | <1% | ||
| CVE-2026-57308 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope | 9.8 | <1% | ||
| CVE-2026-60217 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
| CVE-2026-60358 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
| CVE-2026-60360 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
| CVE-2026-60365 | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
| CVE-2026-60366 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
CVE-2026-60379+1 related CVE | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
| CVE-2026-60402 | Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component | 9.9 | <1% | ||
| CVE-2026-60644 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component | 10.0 | <1% | ||
| CVE-2026-61146 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component | 9.9 | <1% | ||
| CVE-2026-61211 | Vulnerability in the RDBMS component of Oracle Database Server | 9.9 | <1% | ||
| CVE-2026-62144 | Authentication Bypass in Check Point Security and Multi-Domain Security Management | 9.1 | 21% | ||
| CVE-2026-62145 | A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges | 7.5 | 8% | ||
| CVE-2026-64600 | Linux kernel: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both… | 7.8 | <1% | PoC ×2 | |
CVE-2026-64813+1 related CVE | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session | 10.0 | <1% | ||
| CVE-2026-65906 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | 10.0 | <1% | ||
CVE-2026-8085+3 related CVEs | A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component | 7.0 | <1% | ||
| CVE-2026-8933 | A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure… | 7.8 | <1% |
From the original article
11 min read at thehackernews.com
Monday starts with the usual promise that everything is under control. Then the logs wake up. This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.