Malwarehigh
⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
- CVEs
- CVE-2025-20333CVE-2025-20362CVE-2026-40372CVE-2026-33626CVE-2026-5760CVE-2026-5752CVE-2026-3517CVE-2026-3518CVE-2026-3519CVE-2026-4048CVE-2026-21876CVE-2026-32173CVE-2026-25262CVE-2025-24371CVE-2026-5754CVE-2026-40872CVE-2026-27654CVE-2026-5756CVE-2026-5757CVE-2026-41651CVE-2026-33824CVE-2026-21571CVE-2026-33871
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-20333+1 related CVE | Authenticated Buffer Overflow RCE in Cisco ASA/FTD VPN Web Server | 9.9 group max | 71% | KEV | KEV |
| CVE-2025-24371 | CometBFT: In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing… | 7.1 | <1% | ||
| CVE-2026-21571 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of… | 9.4 | 1% | ||
| CVE-2026-21876 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls | 5.3 | 18% | PoC | |
| CVE-2026-25262 | Memory corruption in Qualcomm primary bootloader via crafted ELF | 6.3 | <1% | PoC | |
| CVE-2026-27654 | Buffer Overflow in NGINX ngx_http_dav_module via DAV MOVE/COPY with Alias | 8.8 | 25% | ||
| CVE-2026-32173 | Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network | 7.5 | <1% | ||
| CVE-2026-33626 | SSRF in LMDeploy vision-language module exposes cloud metadata and internal networks | 7.5 | 45% | PoC | |
| CVE-2026-33824 | Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension | 9.8 | 77% | KEV | KEV |
| CVE-2026-33871 | Netty: A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames… | 8.7 | 1% | ||
CVE-2026-3518+3 related CVEs | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute… | 7.2 | 20% | ||
| CVE-2026-40372 | Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network | 9.1 | 11% | ||
| CVE-2026-40872 | mailcow: dockerized is an open source groupware/email suite based on docker | 9.3 | <1% | ||
| CVE-2026-41651 | PackageKit: PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on… | 8.8 | <1% | PoC ×3 | |
| CVE-2026-5752 | Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal | 9.3 | <1% | ||
| CVE-2026-5754 | Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the… | 6.1 | <1% | ||
| CVE-2026-5756 | Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration… | 7.5 | <1% | ||
| CVE-2026-5757 | Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap… | 7.5 | <1% | ||
| CVE-2026-5760 | SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the… | 9.8 | <1% | PoC |
From the original article
12 min read at thehackernews.com
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.