⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More
- CVEs
- CVE-2026-3909CVE-2026-3910CVE-2026-3913CVE-2026-21666CVE-2026-21667CVE-2026-21668CVE-2026-21672CVE-2026-21708CVE-2026-21669CVE-2026-21671CVE-2026-27577CVE-2026-27493CVE-2026-27495CVE-2026-27497CVE-2026-26127CVE-2026-21262CVE-2019-17571CVE-2026-27685CVE-2026-3102CVE-2026-27944CVE-2025-67826CVE-2026-26224CVE-2026-26225CVE-2026-29000CVE-2026-23813CVE-2025-12818CVE-2026-2413CVE-2026-0953CVE-2026-25921CVE-2026-2833CVE-2026-2835CVE-2026-2836CVE-2026-24308CVE-2026-3059CVE-2026-3060CVE-2026-3989CVE-2026-0231CVE-2026-20040CVE-2026-20046CVE-2025-65587CVE-2026-3497CVE-2026-26123CVE-2025-61915
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-17571 | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code… | 9.8 | 69% | ||
| CVE-2025-12818 | Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an… | 5.9 | <1% | ||
| CVE-2025-61915 | OpenPrinting CUPS: A user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process… | 6.7 | <1% | PoC | |
| CVE-2025-67826 | An issue was discovered in K7 Ultimate Security 17.0.2045 | 7.7 | <1% | ||
| CVE-2026-0231 | An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to obtain and modify sensitive information by… | 5.7 | <1% | ||
| CVE-2026-0953 | The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon | 9.8 | <1% | ||
CVE-2026-20040+1 related CVE | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying… | 8.8 | <1% | ||
| CVE-2026-21262 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network | 8.8 | 2% | ||
| CVE-2026-21669 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server | 9.9 group max | 1% | ||
| CVE-2026-21672 | A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers | 8.8 | <1% | ||
| CVE-2026-23813 | A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to… | 9.8 | <1% | ||
| CVE-2026-2413 | The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3 | 7.5 | 2% | ||
| CVE-2026-24308 | Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information… | 7.5 | 1% | ||
| CVE-2026-25921 | Gogs: Overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously… | 9.3 | <1% | PoC | |
| CVE-2026-26123 | Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally | 5.5 | <1% | ||
| CVE-2026-26127 | Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network | 7.5 | 2% | ||
| CVE-2026-26224 | Intego Log Reporter, a macOS diagnostic utility bundled with Intego security products that collects system and application logs for support analysis, contains… | 8.5 | <1% | ||
| CVE-2026-26225 | Intego Personal Backup, a macOS backup utility that allows users to create scheduled backups and bootable system clones, contains a local privilege escalation… | 8.5 | <1% | ||
CVE-2026-27493+3 related CVEs | n8n is an open source workflow automation platform | 9.5 group max | 1% | ||
| CVE-2026-27685 | SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could… | 9.1 | <1% | ||
| CVE-2026-27944 | Unauthenticated Backup Download and Key Disclosure in Nginx UI | 9.8 | 23% | PoC ×2 | |
CVE-2026-2835+2 related CVEs | An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests | 9.3 group max | <1% | ||
| CVE-2026-29000 | pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that… | 9.3 | 6% | PoC ×3 | |
CVE-2026-3059+2 related CVEs | SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using… | 9.8 group max | 2% | PoC | |
| CVE-2026-3102 | A vulnerability was determined in exiftool up to 13.49 on macOS | 2.1 | 4% | PoC ×2 | |
| CVE-2026-3497 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions | 6.9 | 2% | ||
| CVE-2026-3909 | Out-of-Bounds Write in Google Chrome's Skia Rendering Engine | 8.8 | 2% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |
| CVE-2026-3913 | Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | appsflyer.com | icious JavaScript instead of the legitimate SDK from websdk.appsflyer[.]com," Profero said . "The malicious payload appears to have b |
| domain | filebulldogs.com | , the payloads are hosted on a public file-sharing service, filebulldogs[.]com, while stolen data is uploaded to MEGA storage using the |
From the original article
12 min read at thehackernews.com
Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.