Vulnerabilities
Public Exploit Grants Root Access and Bootloader Unlock on Amazon Fire TV Cube 3
A developer released a package enabling persistent root access on third-gen Fire TV Cube devices running firmware PS7717 or older, according to reports.
Threat Times Exposure Desk
The Threat Times Exposure Desk is the part of the Threat Times newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 425 articles so far. See the editorial policy or report an error.
Vulnerabilities
Siemens Industrial Edge Device Kit Flaw Allows Unauthorized Internal API Access
A critical CVE in Siemens Industrial Edge Device Kit versions through 1.15 permits authenticated attackers to access restricted internal APIs.
Vulnerabilities
Siemens SIMATIC CPUs face critical web server code execution flaw
A critical vulnerability in Siemens industrial controllers allows attackers to run malicious scripts via crafted trace files.
Vulnerabilities
Siemens Drive Controllers Have Critical Cross-Site Scripting Flaw
A critical vulnerability in Siemens industrial controllers allows attackers to execute JavaScript via crafted trace files, risking PLC operations.
Vulnerabilities
Siemens Drive Controllers Face Critical Cross-Site Scripting Flaw in CSV Import
A critical vulnerability in Siemens SIMATIC hardware allows attackers to execute code via crafted CSV files imported by authorized users.
Vulnerabilities
One-in-five CISOs skip Patch Tuesday to avoid burnout, says Socura
A new survey reveals cybersecurity leaders are calling in sick or taking leave to evade the stress of monthly security update deployments.
Vulnerabilities
GitHub Fixes npm Trusted Publishing Flaw Exposing 1,500 Packages to Takeover
Researchers found that npm’s Trusted Publishing feature allowed attackers to publish malicious updates without stealing credentials by claiming abandoned repository names.
Vulnerabilities
Critical OS Command Injection Flaw Found in Wavlink WL-WN592AX6 Router Firmware
The National Vulnerability Database lists a critical OS command injection flaw in Wavlink router firmware, noting that the exploit has been published and the vendor was notified early.
Vulnerabilities
Critical Remote Overflow in Wavlink Router Firmware Exposes Device to Exploitation
The National Vulnerability Database lists a CVSS 10 critical flaw in Wavlink WL-WN530BE1-A firmware version 251117, allowing remote attackers to exploit a buffer overflow via HTTP headers.
Vulnerabilities
Critical-Severity Os Command Injection Flaw in Wavlink WL-WN530BE1-A Tracked as CVE-2026-109108
A newly published critical vulnerability in Wavlink WL-WN530BE1-A carries a CVSS score of 9.4. Here is what is affected and how to respond.
Vulnerabilities
VMware launches HyperArmor to manage AI-discovered flaws and enforce MFA
Broadcom’s VMware introduces a new security add-on to help customers cope with the surge of monthly patches driven by AI vulnerability discovery.
Vulnerabilities
Researcher Discovers Remote Code Execution Flaw in Google Developer Sites
A security researcher found that Google’s developer documentation sites exposed an OAuth secret that allowed unauthenticated remote code execution via pickle deserialization.
Vulnerabilities
Critical Signature Verification Flaw Found in D-Link DCS-930L Firmware Recovery
A critical vulnerability in D-Link’s DCS-930L allows remote attackers to bypass cryptographic signature verification via the emergency recovery server.
Vulnerabilities
Industry veterans urge applying cybersecurity playbook to AI safety challenges
Experts argue that decades of security experience can help prevent irreversible consequences in the emerging AI landscape.
Vulnerabilities
IBM Fixes Two Critical RCE Flaws in Verify Access Appliance and Container Deployments
IBM released patches for 22 vulnerabilities in Verify Access, addressing two critical remote code execution bugs that require no authentication.
Vulnerabilities
Booz Allen Frontier AI Models Clear All Eight OT Attack Objectives in Lab Test
Booz Allen demonstrated that frontier AI models can autonomously breach industrial control systems and manipulate physical equipment within minutes.
Vulnerabilities
Attackers Exploit SonicWall SMA 1000 SSRF Flaw Days After Disclosure
Unauthenticated attackers are actively exploiting a critical server-side request forgery flaw in SonicWall appliances, shortly after public disclosure.
Vulnerabilities
Perforce Helix HAS Default Token Flaw Enables Remote Code Execution
A critical vulnerability in Perforce Helix Authentication Service allows attackers to exploit default credentials and chain flaws for remote code execution.
Vulnerabilities
Bitdefender researchers disclose four LG webOS flaws enabling root access
Security experts revealed four vulnerabilities in LG smart TVs that allow remote attackers to bypass authentication and execute commands as root.
Vulnerabilities
Attackers Target Maximum-Severity SSRF Flaw in SonicWall SMA 1000 Appliances
Threat actors are currently targeting a maximum-severity server-side request forgery vulnerability in SonicWall SMA 1000 network security appliances.
Vulnerabilities
SAP MII Flaw Allows Admins to Escalate Privileges on Java Server
A critical vulnerability in SAP Manufacturing Integration and Intelligence lets administrators gain full control of the underlying Java application server.
Vulnerabilities
SAP S/4HANA Rule Processing Flaw Allows Arbitrary ABAP Code Execution
A critical vulnerability in SAP S/4HANA allows authenticated attackers with specific privileges to execute arbitrary ABAP code via crafted input.
Vulnerabilities
SAP NetWeaver Visual Composer Flaw Allows Low-Privilege Attackers to Compromise Remote Systems
A critical authorization bypass in SAP NetWeaver Visual Composer 7.50 lets attackers invoke internal operations on remote systems, risking full compromise.
Vulnerabilities
Critical OAuth2 SSRF in SAP Cloud SDK for Python Exposes Client Credentials
A vulnerability in the SAP Cloud SDK for Python allows attackers to redirect token requests, leading to credential theft in multi-tenant BTP applications.