⚡ Weekly Recap: Instagram Account Hacks, Android Zero
- CVEs
- CVE-2025-48595CVE-2026-28318CVE-2026-39210CVE-2026-39217CVE-2026-20245CVE-2026-20230CVE-2026-3300CVE-2026-8501CVE-2026-10629CVE-2026-7299CVE-2026-10621CVE-2026-10622CVE-2026-0826CVE-2026-8206CVE-2026-23479CVE-2026-23631CVE-2026-25243CVE-2026-25588CVE-2026-25589CVE-2026-49200CVE-2026-49201CVE-2026-8874CVE-2026-8876CVE-2026-8878CVE-2026-8879CVE-2026-8881CVE-2026-8888CVE-2026-8889CVE-2026-10881CVE-2026-10882CVE-2026-10883CVE-2026-41722CVE-2026-41723CVE-2026-41724CVE-2026-34908CVE-2026-34909CVE-2026-4372CVE-2026-45495CVE-2026-42253CVE-2026-9614CVE-2026-48019CVE-2026-5386CVE-2026-5509CVE-2026-4387CVE-2026-8633CVE-2026-9739
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-48595 | Integer Overflow Local Privilege Escalation in Android Framework | 8.4 | 2% | KEV | KEV |
| CVE-2026-0826 | Buffer Overflow RCE in HP Poly Linux Voice Products When ICE Is Enabled | 9.2 | 32% | ||
| CVE-2026-10621 | Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via a crafted ZIP archive | 7.5 | <1% | ||
| CVE-2026-10622 | Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/*… | 8.2 | <1% | ||
| CVE-2026-10629 | SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server… | 7.4 | <1% | ||
CVE-2026-10881+2 related CVEs | Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted… | 9.6 group max | <1% | ||
| CVE-2026-20230 | SSRF in Cisco Unified Communications Manager Enables Root Escalation | 8.6 | 89% | KEVPoC | KEV |
| CVE-2026-20245 | Command Injection as Root in Cisco Catalyst SD-WAN Manager | 7.8 | 25% | KEV | KEV |
CVE-2026-25243+2 related CVEs | Redis: In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated… | 7.7 group max | 4% | ||
| CVE-2026-25588 | RedisTimeSeries: The module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker… | 7.7 | 1% | ||
| CVE-2026-25589 | RedisBloom: The module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker… | 7.7 | 1% | ||
| CVE-2026-28318 | Unauthenticated DoS in SolarWinds Serv-U via crafted Content-Encoding: deflate POSTs | 7.5 | 44% | KEV | KEV |
| CVE-2026-3300 | Unauthenticated RCE via PHP Code Injection in Everest Forms Pro WordPress Plugin | 9.8 | 39% | ||
CVE-2026-34908+1 related CVE | Improper Access Control in Ubiquiti UniFi OS Devices (CVE-2026-34908) | 10.0 | 88% | KEVPoC | KEV |
CVE-2026-41723+2 related CVEs | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or… | 8.0 group max | <1% | ||
| CVE-2026-42253 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web | 6.1 | 1% | ||
| CVE-2026-4372 | A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0 | 7.8 | <1% | PoC | |
| CVE-2026-4387 | StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and… | 2.0 | <1% | ||
| CVE-2026-45495 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 9.8 | <1% | ||
| CVE-2026-48019 | CRLF Injection in Laravel Email Validation Allows Outbound Email Interference | 8.9 | <1% | ||
CVE-2026-49200+1 related CVE | The acer_cgi.log file in the device firmware is accessible without authentication via the web interface | 10.0 | <1% | ||
| CVE-2026-5386 | The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset | 9.1 | <1% | ||
| CVE-2026-5509 | An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system… | 8.5 | 2% | ||
| CVE-2026-7299 | Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated… | 5.4 | <1% | PoC | |
| CVE-2026-8206 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions… | 9.8 | 1% | PoC | |
| CVE-2026-8501 | Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM… | 7.8 | <1% | ||
| CVE-2026-8633 | IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server… | 9.8 | <1% | ||
| CVE-2026-8888 | Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new… | 7.5 group max | <1% | ||
| CVE-2026-9614 | An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative… | 8.8 | 1% | ||
| CVE-2026-9739 | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790) | 9.4 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dmca-chrome-extensions.click | t removal and urging them to appeal by clicking on a link ("dmca-chrome-extensions[.]click") within 48 hours. "After you enter your extension's ID t |
From the original article
13 min read at thehackernews.com
Monday again. The weekend was meant to be quiet. It wasn't.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.