VulnHub

Eufy has identified multiple vulnerabilities in its Omni C20 and Omni X10 Pro devices that could be exploited by attackers. These flaws, which include command injection and improper certificate validation, allow unauthenticated users to execute system commands and potentially run arbitrary code. The affected versions are those prior to 1.6.4. Users are strongly advised to upgrade to this version or later to mitigate the risks. Although these vulnerabilities have been disclosed, there are currently no reports of them being actively exploited in the wild. This situation underscores the need for users to keep their devices updated to ensure security.

Botslab G980H dashcams have several serious vulnerabilities that could allow attackers to bypass authentication and gain unauthorized access to sensitive data and device functions. The affected models include the G980H dash cam series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+. Vulnerabilities identified include issues with session management, predictable session identifiers, and weak authentication mechanisms, which could be exploited by attackers within range of the device. Botslab has not yet responded to requests for mitigation strategies, leaving users vulnerable. It's crucial for owners of these dashcams to reach out to Botslab for guidance on securing their devices against these threats.

SolarWinds has addressed two serious vulnerabilities in its Observability Self-Hosted product, identified as CVE-2026-28324 and CVE-2026-28325. These flaws allow attackers to execute remote code without needing authentication, posing a significant risk to users of the software. The vulnerabilities could potentially lead to unauthorized access and control over affected systems, making it crucial for organizations using this product to take immediate action. SolarWinds has released patches to fix these issues, and users are urged to apply these updates as soon as possible to safeguard their environments. This incident serves as a reminder of the importance of promptly addressing software vulnerabilities to prevent exploitation.

A serious vulnerability in WordPress, identified as CVE-2026-87902, has been exploited by attackers within hours of its public disclosure. This flaw, which has a CVSS score of 9.2, allows unauthenticated users to execute remote code by manipulating the get_page_template() function to include a local PHP file chosen by the attacker. This means that websites using WordPress could be at risk, particularly those that do not have the latest security updates. The rapid exploitation of this vulnerability highlights the urgent need for website administrators to assess their systems and apply necessary patches to prevent unauthorized access. Ignoring this vulnerability could lead to significant data breaches or further exploitation of compromised sites.

Check Point has reported that hackers are actively exploiting a serious vulnerability known as CVE-2026-85102, which allows for remote code execution (RCE) in the VPN certificate-handling feature of its Security Gateway product. This flaw is particularly concerning because it can be exploited without authentication, meaning attackers do not need a valid username or password to take advantage of it. Organizations using affected versions of the Security Gateway are at risk, as this vulnerability could allow attackers to execute malicious code remotely. Users are urged to take immediate action to secure their systems, as the exploitation is already happening in the wild. Ensuring that security measures are in place is crucial to prevent potential breaches.

A critical vulnerability in WordPress, identified as CVE-2026-87902, is currently being exploited by hackers. Initially, attackers were probing for sites that were vulnerable, but they have now escalated to exploiting the flaw to write files to disk that can execute shell commands when accessed. This puts numerous WordPress installations at risk, particularly those running outdated or unpatched versions of the software. Users and website administrators need to take this threat seriously, as the exploitation can lead to unauthorized access and control over affected sites. This situation underscores the importance of timely updates and security measures in maintaining website integrity.

Researchers have identified a serious vulnerability affecting MikroTik routers that allows attackers to gain full administrative control without needing a password or SSH key. Known as the MikroTrick chain, this issue arises from two flaws in the RouterOS software: an SSH state-machine vulnerability (CVE-2026-67279) and an argument-injection bug in the login process (CVE-2026-86060). These vulnerabilities can be exploited on routers that are exposed to the internet, putting numerous devices at risk. Users of MikroTik routers should take immediate action to secure their devices, as the potential for unauthorized access could lead to significant data breaches or network disruptions.

F5 Networks has reported a serious vulnerability in its BIG-IP Access Policy Manager (APM) that allows attackers to execute arbitrary code on systems without authentication. This flaw, identified as CVE-2026-94127, specifically impacts systems where APM functions as an OAuth authorization server, which is responsible for generating access tokens for applications. F5 disclosed this issue on September 22, 2023, and has since released hotfixes to address the vulnerability. Organizations using affected versions of BIG-IP APM are urged to apply these updates promptly to protect against potential exploitation. The situation is critical as attackers are actively taking advantage of this flaw, posing significant risks to the security of OAuth servers.

A Chinese hacking group known as UTA0565 has been exploiting a recently discovered exploit chain affecting Google Chrome and Microsoft Windows. The attacks, which took place on September 3 and 4, 2026, take advantage of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one in Windows (CVE-2026-85880). By using fake websites, the attackers are able to deploy a malware variant named CLEANGULP. This is concerning as it indicates a coordinated effort to target users of these widely-used platforms, potentially compromising sensitive information and system integrity. Users of both Chrome and Windows should be vigilant and consider updating their systems promptly to mitigate the risks associated with these vulnerabilities.

On July 23, attackers exploited a zero-day vulnerability in Check Point's Security Management Server, identified as CVE-2026-93616. This flaw allows unauthorized users to execute scripts on the server's web service without needing to log in, posing a significant risk to organizations using this system. Check Point, which oversees firewall policies through this server, confirmed that the vulnerability was part of targeted attacks. To address this issue, the company released a patch on September 22, aimed at securing the affected systems. Organizations utilizing Check Point's Security Management Server should prioritize applying this update to mitigate potential exploitation.

A serious vulnerability has been discovered in Bifrost, an open-source AI gateway that connects to over 20 large language model (LLM) providers. This flaw, identified as CVE-2026-90898, carries a CVSS score of 9.8, indicating its severity. It allows attackers to execute arbitrary commands on the gateway server without needing any credentials, simply by sending a single HTTP request. All versions of Bifrost HTTP transport prior to 2.1.0 are affected. This vulnerability could lead to significant risks for organizations using Bifrost, as it could enable attackers to manipulate or compromise systems that rely on this gateway. Users and administrators are urged to take immediate action to secure their deployments.

D-Link has issued a warning about a serious vulnerability, identified as CVE-2026-86296, that affects its legacy DIR-822A dual-band Wi-Fi routers. This zero-day bug has been assigned the highest severity rating, and there is currently no patch available to fix the issue. With proof-of-concept exploit code publicly accessible, attackers could potentially exploit this vulnerability to compromise these devices. Users of the DIR-822A routers should take immediate precautions to secure their networks, as the lack of a fix leaves them vulnerable to attacks. D-Link's warning emphasizes the need for users to remain vigilant and consider upgrading to more secure router models.

A newly discovered vulnerability in the VeloCloud Orchestrator (VCO), identified as CVE-2026-93952, is being actively exploited by attackers. This flaw affects on-premises VCO systems, particularly those configured to authenticate Edge devices using certificates. The vulnerability allows remote attackers to access internal functions without needing login credentials, which could compromise the VCO host. This is a significant concern for organizations using VeloCloud's SD-WAN solutions, as it could lead to unauthorized access and potential data breaches. Users of VeloCloud should take immediate action to protect their systems from this exploitation.