Vulnerabilitycritical
⚡ Weekly Recap: IoT Exploits, Wallet Breaches, Rogue Extensions, AI Abuse & More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-13915 | IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the… | 9.8 | 9% | ||
| CVE-2025-14346 | WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections | 9.3 | 6% | ||
| CVE-2025-47411 | A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap… | 8.1 | 16% | ||
| CVE-2025-48769 | Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two… | 8.1 | 2% | ||
| CVE-2025-52691 | Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail | 10.0 | 86% | KEVRansomwarePoC ×2 | KEV |
CVE-2025-52871+1 related CVE | An out-of-bounds read vulnerability has been reported to affect License Center | 1.3 group max | <1% | ||
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
CVE-2025-59887+1 related CVE | Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to… | 8.6 group max | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | jysync.info | h embedded "loader.dll" that downloads encryption keys from jysync[.]info, retrieves encrypted payload, decrypts using AES-CBC + XO |
| domain | mail.microsoft | the official Microsoft Teams sender address (no-reply@teams.mail[.]microsoft), they may bypass user suspicion and email filters," Trus |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Jan 05, 2026 Hacking News / Cybersecurity The year opened without a reset. The same pressure carried over, and in some places it tightened. Systems people assume are boring or stable are showing up in the wrong places.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.