VulnHub

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a serious vulnerability in HPE OneView that is currently being exploited in the wild. This flaw could allow attackers to gain unauthorized access to sensitive systems and data, posing significant risks to organizations using HPE's management software. Users of HPE OneView should be particularly vigilant, as this vulnerability could lead to severe disruptions or data breaches. Companies utilizing affected systems are advised to take immediate action to secure their environments. The situation underscores the critical need for timely updates and patch management to protect against active threats.

Hackers are taking advantage of a serious zero-day vulnerability in D-Link DSL routers that are no longer supported. This flaw allows attackers to execute arbitrary commands on the devices, posing significant risks to users still relying on these outdated models. As these routers are not receiving security updates, individuals and businesses using them are particularly vulnerable to unauthorized access and potential data breaches. Users are urged to consider replacing their D-Link routers with more secure, supported options to mitigate these risks. The exploitation of such vulnerabilities underscores the importance of using updated technology in a cybersecurity landscape that is constantly evolving.

The jsPDF library, widely used for generating PDF documents in JavaScript applications, has a critical vulnerability that allows attackers to access sensitive data from a user's local filesystem. This flaw enables malicious actors to embed local files into generated PDFs, potentially leading to data breaches. Developers using jsPDF in their applications should be particularly vigilant, as this could affect any application relying on this library for PDF generation. The implications are serious, as sensitive information could be easily extracted without user consent. Users of applications built with jsPDF need to be aware of this risk and ensure that they update to the latest version as soon as a fix is available.

A serious vulnerability in n8n, known as Ni8mare (CVE-2026-21858), has been identified, allowing attackers to gain full control over affected instances without any authentication. This flaw has a maximum severity score of 10.0, indicating a high level of risk for users. Researchers from Cyera discovered this vulnerability, raising concerns about the security of workflow automation processes that many organizations rely on. If exploited, this could lead to unauthorized access, data breaches, and significant operational disruptions. Users and companies utilizing n8n should take immediate steps to secure their systems to prevent potential exploitation.

Taiwan's National Security Bureau has reported a significant increase in daily cyber intrusion attempts, attributing the surge to what they describe as a Chinese 'cyber army.' The number of attacks rose by 6% in 2025, with the energy and healthcare sectors experiencing the most substantial impacts. This uptick raises concerns about the security of critical infrastructure and sensitive data in Taiwan, especially as these sectors are vital for public welfare and national stability. The situation underscores the ongoing cyber tensions between Taiwan and China, highlighting the need for enhanced cybersecurity measures in the face of persistent threats. Taiwanese authorities are likely to heighten their defenses to safeguard against these intrusions.

Security teams have made significant advancements in identifying and blocking harmful bots, but a new concern is emerging: legitimate bot traffic. This type of traffic, often used for various business functions, is becoming a security blind spot. While these bots can enhance user experience, they also pose risks as they can be exploited by attackers to bypass security measures. Companies may inadvertently allow these bots to operate unchecked, leaving systems vulnerable to abuse. As organizations increasingly rely on automation and bots, it's crucial for them to improve their detection capabilities to differentiate between helpful and harmful bot activity.

In 2025, Taiwan reported an alarming increase in cyber intrusion attempts on its critical infrastructure, averaging 2.63 million per day, primarily attributed to Chinese attackers. This surge has raised significant concerns about the security of Taiwan's energy sector and other vital systems, as such attacks could lead to disruptions in services and pose risks to national security. The frequency and intensity of these cyber intrusions suggest a coordinated effort to undermine Taiwan's infrastructure, which could have serious implications for the region's stability. As the situation evolves, it is crucial for Taiwanese authorities and organizations to bolster their defenses against these persistent cyber threats to protect their critical assets.

Researchers have identified a severe vulnerability in n8n, a widely-used workflow automation platform, allowing unauthenticated attackers to take full control of affected instances. This flaw, tracked as CVE-2026-21858 and given a maximum CVSS score of 10.0, has been named Ni8mare by Cyera Research Labs. The issue poses a significant risk as it could enable attackers to manipulate workflows and access sensitive data without any authentication. Users of n8n need to take this threat seriously, as the implications of such a breach could be extensive, impacting data integrity and privacy. Immediate action is recommended to safeguard systems until a patch is made available.

Veeam has issued security updates to address several vulnerabilities in its Backup & Replication software, including a significant remote code execution (RCE) flaw. This critical vulnerability could allow attackers to gain control over backup servers, posing a serious risk to organizations relying on this software for data protection. The flaws affect various versions of the Backup & Replication software, potentially exposing many users to exploitation if they do not update promptly. This situation is concerning as backup servers are vital for data recovery and integrity, and any compromise could lead to severe operational disruptions. Users are urged to apply the latest patches to safeguard their systems.

A newly discovered vulnerability in discontinued D-Link devices poses a serious risk, allowing attackers to execute arbitrary shell commands without authentication. This critical-severity flaw affects users of these outdated devices, which may still be in use despite not being supported or receiving updates from the manufacturer. The fact that the vulnerability is being actively exploited means that users should take immediate action to safeguard their networks. If left unaddressed, this could allow attackers to gain control over affected devices, potentially leading to larger network breaches. Users of D-Link products are advised to assess their device usage and consider replacing unsupported hardware to mitigate these risks.

Veeam has addressed a serious remote code execution (RCE) vulnerability in its Backup & Replication software, identified as CVE-2025-59470, which has a high severity score of 9.0 on the CVSS scale. This flaw allows Backup or Tape Operators to execute arbitrary code remotely as the postgres user, potentially leading to significant security breaches. Alongside this critical issue, Veeam also patched several other vulnerabilities in the same software suite. Users of Veeam Backup & Replication should prioritize applying these patches to safeguard their systems from potential exploitation. The swift response by Veeam reflects the importance of maintaining updated software to prevent unauthorized access and data breaches.

Hackers are exploiting a serious vulnerability in older D-Link DSL routers, identified as CVE-2026-0625. This flaw allows attackers to execute commands remotely, potentially compromising users' devices and networks. The vulnerability has a high severity score of 9.3, which indicates that it poses a significant risk. Users of legacy D-Link DSL routers need to be aware of this issue as it could lead to unauthorized access and control over their internet-connected devices. As attackers actively exploit this flaw, it is crucial for affected users to take immediate action to protect their systems.

A serious security vulnerability has been identified in legacy D-Link DSL gateway routers, specifically affecting the 'dnscfg.cgi' endpoint. This flaw, known as CVE-2026-0625, has a high severity score of 9.3 and allows unauthenticated remote attackers to execute commands through improper handling of user-provided DNS configuration inputs. Current reports indicate that this vulnerability is actively being exploited in the wild, putting users of these older routers at risk. It is crucial for individuals and organizations using these devices to be aware of the potential for unauthorized access and control. The situation underscores the need for users to assess their network security and consider upgrading their hardware to mitigate these risks.

Taiwan's National Security Bureau has reported a significant increase in cyberattacks from China targeting its energy sector, with incidents rising tenfold in 2025 compared to the previous year. This surge in attacks raises serious concerns about the security of Taiwan's critical infrastructure, particularly as tensions between the two nations continue to escalate. The energy sector is vital for maintaining the country's operations, and disruptions could have widespread implications for both the economy and public safety. Taiwan's government is likely to enhance its cybersecurity measures to protect against these aggressive tactics. This situation highlights the ongoing cyber conflict in the region and the need for robust defenses against state-sponsored threats.

CERT/CC has issued a warning about a serious vulnerability in the TOTOLINK EX200 Wi-Fi range extender, identified as CVE-2025-65606. This flaw allows a remote authenticated attacker to take complete control of the device, posing a significant risk to users. As this vulnerability remains unpatched, anyone using the TOTOLINK EX200 is advised to take immediate action to secure their networks. The potential for exploitation means that attackers could manipulate settings, access sensitive data, or use the device as a foothold into larger networks. Users need to be aware of this threat and consider alternative security measures while awaiting a fix.