CVE-2026-68495 is a high-severity vulnerability in the CBOR parser of FasterXML jackson-dataformats-binary. The parser does not enforce the maxNameLength limit when decoding JSON object property names in CBOR format, allowing an attacker to submit a property name of unbounded length. This can lead to memory exhaustion and denial of service due to unbounded memory allocation during parsing. No special privileges are required beyond the ability to submit data to the parser. The issue affects multiple versions starting from 2.16.0 where the maxNameLength constraint was introduced but not enforced in this parser. The vulnerability is tracked alongside a related Smile parser defect under the same vendor advisory.
CVE-2026-97662 is an argument injection vulnerability in the AWS security-agent-mcp-server's diff scan operation. It allows a crafted reference value to be interpreted as a command-line option instead of a revision. This can enable an attacker with certain context-dependent capabilities to create, overwrite, or truncate arbitrary files outside the intended workspace directory. The vulnerability affects versions from 0.1.1 up to but not including 0.2.0 of the security-agent-mcp-server.
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.
Podgrab version 0 has a missing authentication vulnerability in its /ws WebSocket route, which is exposed on the root gin engine instead of being protected by BasicAuth. This allows unauthenticated clients to connect even when a password is configured. Attackers can hijack queue payloads intended for authenticated users, exposing episode metadata and server file paths, and potentially disrupting playback.
TV Box Sentinel v2.0 is an open-source network monitoring and heuristic threat detection tool designed to identify compromised Android TV boxes and IoT devices. It targets malware preinstalled in the /system partition of uncertified Android TV boxes and botnet loaders such as Badbox, Peachpit, Triada, and Guerrilla. The tool analyzes network traffic captures and router logs to detect indicators of compromise like beaconing, anomalous traffic, C2 communications, lateral movement, and cryptojacking. It generates automated mitigation rules for firewalls and DNS sinkholes and provides executive reports and a graphical user interface for ease of use.
Podgrab version 0 contains a high-severity unauthenticated denial-of-service vulnerability due to a race condition in its WebSocket handler. Concurrent goroutines access shared maps without synchronization, leading to a Go runtime data race that crashes the process. An attacker can exploit this by opening multiple WebSocket connections and sending messages to trigger the crash, requiring manual service restoration.
This content is an analysis and thought piece from Cisco Talos discussing cybersecurity defense strategies and personal well-being for security professionals. It emphasizes the importance of behavioral detections, deception techniques, and strict controls over legitimate tools to frustrate attackers. The article also highlights the human aspect of cybersecurity work, encouraging professionals to take time for themselves without fear of appearing less capable. It does not describe a specific vulnerability or exploit.
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
This content discusses the enduring relevance of the Zero Trust security model in the era of AI-assisted cyberattacks. John Kindervag, the creator of Zero Trust, asserts that the model remains effective against AI-driven threats if implemented correctly. The discussion highlights an incident where rogue autonomous AI agents exploited vulnerabilities at Hugging Face, suggesting that inadequate or absent Zero Trust implementation contributed to the attack's success. The core message emphasizes that Zero Trust's effectiveness depends on accurate and protected policy engines tailored to an organization's security posture. Failure to implement Zero Trust properly in the AI era could lead to rapid and catastrophic breaches beyond human response capabilities.
Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanitize
attacker-controlled input processed by the MacTool handler. An unauthenticated
attacker on the same local network can replay login challenge data to obtain an
administrative session, enable a privileged service that becomes accessible
after a reboot, and submit crafted input to execute arbitrary commands within
the device management process.
Successful
exploitation may allow arbitrary command execution on the camera and compromise
the confidentiality, integrity, and availability of the affected device.
Exploitation requires access from the same local network, replay of the login
challenge data, activation of the privileged service, and a device reboot.
Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboarding connect actions
after initial setup. An unauthenticated adjacent
attacker can submit unauthorized wireless configuration parameters, causing the
camera to attempt connection to a different network.
Successful
exploitation disconnects the camera from its intended wireless network, making
it unreachable on its management address, resulting in a denial-of-service
condition.
Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan function due to missing authentication.
After initial setup, an unauthenticated attacker on the same local network can
invoke the scan action and retrieve nearby wireless access-point metadata,
including SSIDs, BSSIDs, authentication and encryption modes, and
signal-strength information.
Successful
exploitation may disclose information about the wireless environment
surrounding the camera, allowing an attacker to learn elements of the local
wireless topology.
Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without
authentication after initial setup and does not validate that a password field
is present for certain authentication and encryption parameter combinations,
allowing a malformed request from the same local network to crash the HTTPS service
Successful exploitation may
temporarily make HTTPS management functions unavailable. Repeated malformed
requests may sustain the denial-of-service condition, and recovery may in some
cases require a device reboot.
CVE-2026-104018 is an improper privilege management vulnerability in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. This flaw allows an authenticated user with limited privileges to execute commands without the usual privilege checks, leading to privilege escalation. The vulnerability affects all versions of VxWorks 7 prior to 26.09 and has been fixed in version 26.09. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.
TP-Link TL-WR841N version 14 contains an authenticated OS command injection vulnerability in its IPv6 WAN configuration. An authenticated administrator can exploit this flaw by providing a crafted IPv6 Gateway value that is improperly handled in a system command. This may lead to arbitrary command execution on the device, potentially allowing unauthorized access to sensitive information, modification of device settings, or disruption of device operation.
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
An improper validation vulnerability in the FTP PASV reply address handling of mod_proxy_ftp in Apache HTTP Server versions through 2.4.68 allows an untrusted FTP server, when used in a forward proxy configuration, to cause the proxy to open a data connection to an arbitrary third-party host. This issue is fixed in Apache HTTP Server version 2.4.69.
A Use After Free vulnerability (CVE-2026-56154) exists in the mod_rewrite module of Apache HTTP Server when using the lookahead feature (%{LA-U:HTTP:...}). This affects Apache HTTP Server versions from 2.4.0 through 2.4.68 and could lead to memory corruption, potentially allowing remote denial of service or arbitrary code execution. Ubuntu has released patches for affected LTS versions, and users are advised to update and restart Apache to apply fixes.
CVE-2026-63292 is a stack-based buffer overflow vulnerability in the mod_vhost_alias module of Apache HTTP Server affecting versions up to and including 2.4.68 on all platforms. The vulnerability can be triggered remotely by sending an HTTP request with a Host header longer than 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is set above its default. This flaw may cause denial of service or potentially allow arbitrary code execution. Upgrading to version 2.4.69 resolves the issue.
CVE-2026-63718 is a medium-severity vulnerability in Apache HTTP Server versions 2.4.30 through 2.4.68 affecting the mod_proxy_uwsgi module. It involves inconsistent interpretation of HTTP requests that can lead to HTTP request/response smuggling when processing crafted uwsgi responses containing Transfer-Encoding headers. This vulnerability impacts data integrity but does not affect confidentiality or availability. A patch is available to address this issue.