Collecting Cyber-News from over 60 sources

Tag: flaw

Max severity Ni8mare flaw impacts nearly 60,000 n8n instances

Jan 12, 2026 4:02 PM

Tags: data-breach, flaw, vulnerability

Nearly 60,000 n8n instances exposed online remain unpatched against a maximum-severity vulnerability dubbed “Ni8mare.” First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-impacts-nearly-60-000-n8n-instances/
âš¡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More

Jan 12, 2026 4:02 PM

Tags: ai, automation, data-breach, espionage, exploit, flaw, tool

This week made one thing clear: small oversights can spiral fast. Tools meant to save time and reduce friction turned into easy entry points once basic safeguards were ignored. Attackers didn’t need novel tricks. They used what was already exposed and moved in without resistance.Scale amplified the damage. A single weak configuration rippled out to…
Critical React Router Flaws Could Let Attackers Access or Modify Server Files

Jan 12, 2026 11:01 AM

Tags: access, cve, cvss, cyber, flaw, router, vulnerability

A critical vulnerability has been discovered in React Router and Remix that could allow attackers to access or modify sensitive files on web servers. The flaw affects multiple packages and has received a severity rating of Critical with a CVSS score of 8.8/10. Field Details CVE ID CVE-2025-61686 Severity Critical CVSS Score 8.8/10 Vulnerability Overview The security issue stems from…
Critical Apache Struts 2 Flaw Could Let Attackers Steal Sensitive Data

Jan 12, 2026 11:01 AM

Tags: apache, attack, cve, cyber, data, flaw, vulnerability

A newly disclosed vulnerability in Apache Struts 2’s XWork component could expose sensitive data and open the door to denial”‘of”‘service and server”‘side request forgery (SSRF) attacks if left unpatched. The flaw, tracked as CVE-2025-68493, is rated Important and affects a wide range of Struts 2 versions, putting many Java web applications at risk. Field Details CVE ID CVE-2025-68493…
Critical InputPlumber Flaw Enables UI Input Injection and DenialService

Jan 12, 2026 8:01 AM

Tags: cve, cyber, flaw, injection, leak, linux, service, vulnerability

Security researchers have discovered critical vulnerabilities in InputPlumber, a Linux input device utility used in SteamOS, that could allow attackers to inject keystrokes, leak sensitive information, and cause denial-of-service conditions. The flaws, tracked as CVE-2025-66005 and CVE-2025-14338, affect InputPlumber versions before v0.69.0 and stem from inadequate D-Bus authorization checks. CVE ID Description Affected Versions Impact…
Critical zlib Flaw Let Attackers Can Trigger a Buffer Overflow via untgz

Jan 12, 2026 7:01 AM

Tags: cyber, flaw, vulnerability

A severe buffer overflow vulnerability has been discovered in the zlib untgz utility, affecting version 1.3.1.2, allowing attackers to trigger memory corruption via maliciously crafted command-line arguments. The vulnerability resides in the TGZfname() function, where an unbounded strcpy() call copies user-supplied archive names directly into a fixed-size global buffer of 1024 bytes without any length…
CISA Urges Emergency Patching for Actively Exploited HPE OneView Flaw

Jan 10, 2026 4:02 PM

Tags: cisa, exploit, flaw, infrastructure, kev, rce, remote-code-execution, update

CISA adds a critical HPE OneView flaw (CVE-2025-37164) to its KEV catalogue with a Jan 28 deadline. Learn how this 10.0 RCE bug puts server infrastructure at risk. First seen on hackread.com Jump to article: hackread.com/cisa-emergency-patching-exploit-hpe-oneview-flaw/
News brief: Browser security flaws pose growing risk

Jan 10, 2026 5:01 AM

Tags: flaw, risk

Check out the latest security news from the Informa TechTarget team. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366636759/News-brief-Browser-security-flaws-pose-growing-risk
Trend Micro fixed a remote code execution in Apex Central

Jan 9, 2026 9:02 PM

Tags: flaw, remote-code-execution, service, vulnerability

Trend Micro fixed three Apex Central flaws discovered by Tenable that could allow remote code execution or denial-of-service attacks. Trend Micro patched three flaws (CVE-2025-69258, CVE-2025-69259, CVE-2025-69260) in its Apex Central management console after Tenable disclosed details and PoC code. The researchers discovered the vulnerabilities in August 2025, which could enable remote code execution or denial-of-service attacks.…
Trend Micro Apex Central Flaws Enable Remote Code Execution

Jan 9, 2026 8:01 PM

Tags: flaw, remote-code-execution, service

Trend Micro patched three Apex Central flaws that could allow unauthenticated remote code execution or service disruption. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/trend-micro-apex-central-flaws-enable-remote-code-execution/
OWASP CRS Vulnerability Enables Charset Validation Bypass

Jan 9, 2026 7:02 PM

Tags: cyber, firewall, flaw, vulnerability, waf

A newly disclosed vulnerability in theOWASP Core RuleSet (CRS)allows attackers to bypass charset validation in web application firewalls (WAFs), enabling dangerous payloads to reach backend applications. Tracked asCVE-2026-21876, the flaw affects CRS rule922110and can expose applications tocross-site scripting (XSS)and other encoding-based attacks. Administrators are strongly advised to upgradeimmediatelyand review historical logs for suspicious multipart requests…
Trend Micro Apex Central Flaw Enable Remote Code Execution Attacks

Jan 9, 2026 7:02 PM

Tags: attack, cyber, flaw, remote-code-execution, update, vulnerability, windows

Trend Micro has issued a critical security update for Apex Central to address multiple remotely exploitable vulnerabilities, including a bug that allows unauthenticated attackers to execute code with SYSTEM-level privileges. Organizations running vulnerable builds are urged to patchimmediatelyto avoid both remote code execution anddenial-of-servicerisks.”‹ Critical flaws in Apex Central The update targets Apex Central for Windows and…
Telecom sector sees steady rise in ransomware attacks

Jan 9, 2026 6:01 PM

Tags: attack, flaw, intelligence, ransomware, threat

A new threat intelligence report described a potent mixture of unpatched flaws and lax perimeter controls. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/telecom-ransomware-spike-cyble/809224/
OWASP CRS Flaw Lets Encoded Attacks Slip Past WAFs

Jan 9, 2026 5:01 PM

Tags: attack, flaw, waf, xss

A critical OWASP CRS flaw allows encoded XSS attacks to bypass WAF charset validation. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/owasp-crs-flaw-lets-encoded-attacks-slip-past-wafs/
Botnets, Breaches, and Critical Flaws Define This Week in Cybersecurity

Jan 9, 2026 4:01 PM

Tags: botnet, breach, cybersecurity, flaw

Weekly summary of Cybersecurity Insider newsletters First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/weekly-roundup/botnets-breaches-and-critical-flaws-define-this-week-in-cybersecurity/
CISA flags max-severity bug in HPE OneView amid active exploitation

Jan 9, 2026 2:01 PM

Tags: api, authentication, cisa, endpoint, exploit, flaw, Hardware, intelligence, kev, monitoring, software, strategy, threat, update, vulnerability

Not an ‘apply and move on’ solution: While CISA’s KEV inclusion raised the priority immediately, enterprises can’t treat OneView like a routine endpoint patch. Management-plane software is often deployed on-premises, sometimes on physical servers, and tightly coupled with production workflows. A rushed fix that breaks monitoring, authentication, or integrations can be almost as dangerous as…
Breach Roundup: Firewalls Headed for Obsolescence

Jan 9, 2026 1:01 PM

Tags: breach, browser, chrome, firewall, flaw, infrastructure, malicious, microsoft

Also, Sedgwick Confirms Breach, Romanian Power Firm Hit, D-Link Flaws Exploited. This week, Moody’s said firewalls will be obsolete, Romanian critical infrastructure hacked, Sedgwick breach and a D-Link DSL flaw. Finland seized the Fitburg. Microsoft said Direct Send not to blame for Exchange phishing. Malicious Chrome extensions, European hotels targeted and health breaches. First seen…
Trend Micro warns of critical Apex Central RCE vulnerability

Jan 9, 2026 12:01 PM

Tags: cybersecurity, flaw, rce, remote-code-execution, software, vulnerability

Japanese cybersecurity software firm Trend Micro has patched a critical security flaw in Apex Central (on-premise) that could allow attackers to execute arbitrary code with SYSTEM privileges. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trend-micro-fixes-critical-rce-flaw-in-apex-central-console/
Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions

Jan 9, 2026 12:01 PM

Tags: cve, cvss, flaw, rce, remote-code-execution, update, vulnerability, windows

Trend Micro has released security updates to address multiple security vulnerabilities impacting on-premise versions of Apex Central for Windows, including a critical bug that could result in arbitrary code execution.The vulnerability, tracked as CVE-2025-69258, carries a CVSS score of 9.8 out of a maximum of 10.0. The vulnerability has been described as a case of…
Global DNS Crash Triggers Reboot Loops Across Cisco Small Business Switches

Jan 9, 2026 10:01 AM

Tags: business, cisco, dns, flaw, network, service

A DNS Crash disrupted networks around the world on January 8, 2026, after a flaw in the DNS client service caused multiple Cisco Small Business Switches to reboot repeatedly and, in some cases, completely core dump. The outage affected organizations of all sizes, from small IT teams managing a handful of switches to administrators responsible…
Global DNS Crash Triggers Reboot Loops Across Cisco Small Business Switches

Jan 9, 2026 10:01 AM

Tags: business, cisco, dns, flaw, network, service

A DNS Crash disrupted networks around the world on January 8, 2026, after a flaw in the DNS client service caused multiple Cisco Small Business Switches to reboot repeatedly and, in some cases, completely core dump. The outage affected organizations of all sizes, from small IT teams managing a handful of switches to administrators responsible…
Maximum Severity HPE OneView Flaw Exploited in the Wild

Jan 9, 2026 12:01 AM

Tags: cve, exploit, flaw, infrastructure, remote-code-execution

Exploitation of CVE-2025-37164 can enable remote code execution on HPE’s IT infrastructure management platform, leading to devastating consequences. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/maximum-severity-hpe-oneview-flaw-exploited
Breach Roundup: Firewalls Headed for Obsolesce

Jan 8, 2026 11:01 PM

Tags: breach, browser, chrome, firewall, flaw, infrastructure, malicious, microsoft

Also, Sedgwick Confirms Breach, Romanian Power Firm Hit, D-Link Flaws Exploited. This week, Moody’s said firewalls will be obsolete, Romanian critical infrastructure hacked, Sedgwick breach and a D-Link DSL flaw. Finland seized the Fitburg. Microsoft said Direct Send not to blame for Exchange phishing. Malicious Chrome extensions, European hotels targeted and health breaches. First seen…
The 2 faces of AI: How emerging models empower and endanger cybersecurity

Jan 8, 2026 8:02 PM

Tags: ai, api, attack, compliance, credentials, cyber, cybersecurity, data, deep-fake, defense, detection, endpoint, espionage, exploit, finance, flaw, framework, GDPR, google, governance, government, group, guide, hacker, HIPAA, incident response, injection, intelligence, LLM, malicious, malware, mandiant, microsoft, network, PCI, penetration-testing, privacy, risk, russia, scam, security-incident, service, social-engineering, strategy, tactics, threat, tool, vulnerability, zero-day

Self-modifying, evasive malware More recently, the researchers at Google Threat Intelligence Group (GTIG) identified a disturbing new trend: malware that uses LLMs during execution to dynamically alter its own behavior and evade detection. This is not pre-generated code, this is code that adapts mid-execution.In June 2025, GTIG identified an experimental malware called PROMPTFLUX, which connects…
The 2 faces of AI: How emerging models empower and endanger cybersecurity

Jan 8, 2026 8:02 PM

Tags: ai, api, attack, compliance, credentials, cyber, cybersecurity, data, deep-fake, defense, detection, endpoint, espionage, exploit, finance, flaw, framework, GDPR, google, governance, government, group, guide, hacker, HIPAA, incident response, injection, intelligence, LLM, malicious, malware, mandiant, microsoft, network, PCI, penetration-testing, privacy, risk, russia, scam, security-incident, service, social-engineering, strategy, tactics, threat, tool, vulnerability, zero-day

Self-modifying, evasive malware More recently, the researchers at Google Threat Intelligence Group (GTIG) identified a disturbing new trend: malware that uses LLMs during execution to dynamically alter its own behavior and evade detection. This is not pre-generated code, this is code that adapts mid-execution.In June 2025, GTIG identified an experimental malware called PROMPTFLUX, which connects…
Cisco ISE Flaw Lets Admins Access Restricted System Files

Jan 8, 2026 7:02 PM

Tags: access, cisco, data, flaw

A Cisco ISE flaw lets authenticated admins access restricted system files, risking sensitive data exposure. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cisco-ise-flaw-lets-admins-access-restricted-system-files/
Cisco Snort 3 Security Flaws Threaten Network Inspection

Jan 8, 2026 5:05 PM

Tags: attack, cisco, flaw, leak, network

Cisco Snort 3 flaws allow unauthenticated attacks that disrupt inspection or leak sensitive data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cisco-snort-3-security-flaws-threaten-network-inspection/
CISA flags actively exploited Office relic alongside fresh HPE flaw

Jan 8, 2026 4:01 PM

Tags: cisa, exploit, flaw, office

Max-severity OneView hole joins a PowerPoint bug that should’ve been retired years ago First seen on theregister.com Jump to article: www.theregister.com/2026/01/08/cisa_oneview_powerpoint_bugs/
Recently fixed HPE OneView flaw is being exploited (CVE-2025-37164)

Jan 8, 2026 4:01 PM

Tags: cisa, exploit, flaw, remote-code-execution, vulnerability

An unauthenticated remote code execution vulnerability (CVE-2025-37164) affecting certain versions of HPE OneView is being leveraged by attackers, CISA confirmed by adding the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/08/hpe-oneview-cve-2025-37164-exploited/
ThreatsDay Bulletin: RustFS Flaw, Iranian Ops, WebUI RCE, Cloud Leaks, and 12 More Stories

Jan 8, 2026 3:01 PM

Tags: cloud, flaw, hacker, Internet, iran, leak, rce, remote-code-execution, risk, scam, tool

The internet never stays quiet. Every week, new hacks, scams, and security problems show up somewhere.This week’s stories show how fast attackers change their tricks, how small mistakes turn into big risks, and how the same old tools keep finding new ways to break in.Read on to catch up before the next wave hits. Honeypot…