A critical vulnerability in Linksys E1700 firmware allows remote OS command injection via IPv6 inputs, with no vendor response or fix confirmed.
A CVSS 9.4 vulnerability in Linksys E1700 firmware allows remote command injection via static route settings, with public exploits available.
A critical stack-based buffer overflow in Linksys E1700 firmware allows remote attacks, but the vendor has not responded to disclosure attempts.
A critical vulnerability in Linksys E1700 firmware allows remote attackers to trigger a stack-based buffer overflow via the MAC filter component.
CERT-EU urges immediate upgrades for self-managed GitLab instances after a critical remote code execution flaw was disclosed.
A race condition in Discourse’s image upload pipeline enables arbitrary file access for Trust Level 0 users via crafted uploads.
Research reveals autonomous AI agents conducting end-to-end cyber intrusions, achieving root access and stealing data while deleting traces.
Patchstack reports active wild exploitation of CVE-2026-85097, a maximum-severity flaw in Bricksforge allowing unauthenticated remote code execution on WordPress sites.
Researchers disclosed a vulnerability chain in LG’s smart TV operating system that enables unauthorized remote command execution with root privileges.
GitLab issued urgent updates on October 8, 2026, to address multiple vulnerabilities, including a remote code execution flaw in CI/CD regular expressions.
A critical vulnerability in OTRS allows attackers to maintain access using valid JWTs even after user accounts are deactivated or passwords changed.
A critical flaw in OTRS Community Edition 6 allows remote attackers to bypass authentication and impersonate users without valid credentials.
Researchers disclosed two vulnerabilities in Discourse’s image handling that enable local file access and script execution, with patches released before publication.
Patricia Almonte-Frías and Rineldys Feliciano Díaz-Cuevas face cyberstalking charges after being extradited from the Dominican Republic to Puerto Rico.
TRENDnet confirms a critical OS command injection flaw in three end-of-life routers, noting the devices were discontinued in 2011 and no patch will be issued.
Researchers found that AI-generated security fixes frequently pass crash checks but fail the specific tests written by project maintainers.
The Cybersecurity and Infrastructure Security Agency added five new entries to its Known Exploited Vulnerabilities catalog, setting a remediation deadline of October 11, 2026.
Florida, Iowa, Montana, Nebraska and Texas allege TP-Link misled consumers about device security and ties to Chinese affiliates.
Splunk released updates for Enterprise on October 7, 2026, fixing 22 vulnerabilities, including a CVSS 9.8 flaw allowing remote code execution.
A high-severity vulnerability in React 19 allows attackers to freeze Next.js servers using crafted HTTP POST requests without authentication.
Attackers leveraged large language model agents and a known privilege escalation exploit to seize full system control without deploying new malware.
Attackers are using two unpatched flaws in Ahsay Cloud Backup Server to gain SYSTEM-level access and deploy malicious software on exposed infrastructure.
A new survey shows developers rely on AI tools yet remain skeptical about accuracy and source attribution in generated code.
Threat actors including Qilin and Settra are abusing a Palo Alto Networks authentication bypass to create stealthy, unauthorized VPN sessions.