42
30
30
57
30
35
30
55
Vulnerability landscape in Q4 2025
60
35
55
30
Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Spy Through Microphone
Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing via Airoha SDK flaw CVE-2025-20701, enabling audio hijack and microphone capture.
CERT/CC vulnerability note VU#859658 describes insecure Bluetooth Classic (BR/EDR) pairing on Skullcandy Dime 3 (model S2DCW) firmware 1.0.0.28, linked to CVE-2025-20701 in the Airoha Bluetooth audio SDK. The NoInputNoOutput I/O capability lets unknown nearby devices pair without pairing mode, PIN, passkey or user interaction, then bond and automatically reconnect. An attacker can hijack the A2DP audio session and access Hands-Free or Headset profiles to capture live microphone audio. Firmware 1.0.0.30 reportedly fixes the flaw, but the earbuds cannot be updated through the Skullcandy app, leaving current users without a consumer-accessible patch path.
35
FortiSandbox Vulnerability Allows Attackers to Access Sensitive Information via Crafted HTTP Requests
Fortinet disclosed CVE-2026-26084 (CVSS 8.9), an unauthenticated information-disclosure flaw in the FortiSandbox web UI, urging upgrades.
Fortinet patched CVE-2026-26084, a CWE-284 improper access control flaw in the shared web UI of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS that lets unauthenticated attackers read sensitive data via crafted HTTP requests. Affected releases include FortiSandbox 5.0.0-5.0.5 and 4.4.0-4.4.8, Cloud 5.0.4-5.0.5, and PaaS 5.0.4-5.0.5; fixes arrive in 5.0.6+ and 4.4.9+, while FortiSandbox 5.2 and Cloud 4.4 are unaffected. The issue was found internally by Fortinet's Product Security team, and the company reports no evidence of exploitation in the wild. Disclosure carries only confidentiality impact, but exposed sandbox configurations and logs could aid follow-on attacks.
48
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.
Researchers Talal Haj Bakry and Tommy Mysk found that three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — bypass configured proxies and send traffic directly from the device. This leaks the user's real IP address in Safari and all WebKit-based iOS browsers and undermines iCloud Private Relay's dual-hop privacy design. Any website can trigger the leak via WebAuthn without user interaction or passkey use; a proof-of-concept site, leaks.psylo.app, demonstrates the issue. Apple investigated and patched the leaks in iOS 26.6.1 and macOS 26.6.2.
58
42
55
60
30
55
30
30
55
55
60
35
55
30
30
30
30
55
30
42
42
60
55
60
42
55