Live Threat Intelligence Radar

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-63243 is an authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana devices (V2, V2X, SE). This flaw allows an attacker within Bluetooth range to connect to the affected device without prior pairing or authentication. The vulnerability affects version 1.30.260813.1100 of the product. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with low attack complexity and no user interaction required. There is no indication of a patch or vendor advisory specifying remediation status. No known exploits are reported in the wild.

CVE-2026-55981 is a critical firmware verification vulnerability affecting Creative Labs Creative Sound Blaster Katana V2, V2X, and SE devices. The flaw allows an attacker to modify a legitimate firmware image and upload the altered firmware to the device without proper verification. This can lead to complete compromise of the device's confidentiality, integrity, and availability.

The Iranian state-sponsored APT group known as Prince of Persia resumed operations in 2026 after a three-month pause coinciding with the Iran-US-Israel conflict. The group deployed a new Tornado malware command-and-control (C&C) server hosted in the United States for the first time since 2016, using shared hosting services rather than virtual private servers. Prince of Persia targets Iranian dissidents and government and private entities in the US, Europe, and the Middle East. The group uses malware capable of stealing files via Telegram bots. Semperis researchers have shared indicators of compromise and recommend monitoring for related activity.

A privilege management vulnerability exists in the Advanced Custom Fields: Extended WordPress plugin versions 0.9.2.7 up to but not including 0.9.2.8. The flaw allows unauthenticated visitors to bypass authorization checks in the front-end Forms module and take over administrator accounts by exploiting inconsistent request handling. Successful exploitation requires the site to have two separate front-end form configurations targeting visitor-submitted values.

The Advanced Custom Fields: Extended WordPress plugin versions before 0.9.2.8 contain a vulnerability that allows unauthenticated visitors to overwrite arbitrary posts via front-end form actions without capability checks. This can lead to arbitrary code execution on the server if a form is published that maps both the target post and its content to visitor input.

A Cross-Site Scripting (XSS) vulnerability exists in the Advanced Custom Fields: Extended WordPress plugin versions 0.8.9.4 up to but not including 0.9.2.8. The flaw arises because some form shortcode attributes are not properly validated or escaped, allowing users with contributor-level roles to inject arbitrary scripts. These scripts can execute in the browsers of users who visit crafted links or pages, including administrators. This issue is a partial fix of a previous vulnerability (CVE-2023-5292) and affects the handling of HTML wrapper attributes.

The Advanced Custom Fields: Extended WordPress plugin versions 0.9.2.7 up to but not including 0.9.2.8 contains an authorization flaw in its front-end Forms module. The plugin fails to verify if the requester is authorized to edit a targeted user account during the update-user action, except when the target account is an administrator. This allows unauthenticated visitors to overwrite credentials of any non-administrator user account and gain a session for that account if the site publishes a form that maps the user-update action's target to a visitor-submitted value.