Wazafak — Vulnerabilities

A critical vulnerability in the Cursor AI-assisted development environment has been exposed after 7 months of silence from the company. The vulnerability allows for arbitrary code execution with no user interaction required.

A security camera shipped with a GitHub admin token in its login page, exposing hundreds of repositories to potential security risks. The token was found in the camera's firmware, which was downloaded from the manufacturer's website.

A dormant stack‑use‑after‑free in the rtmutex implementation lets an unprivileged process hijack kernel control flow, affecting every Linux distro released since 2011.

A hidden authentication backdoor in Tenda router firmware grants admin access, potentially allowing attackers to gain control over devices. The issue, tracked as CVE-2026-11405, affects multiple firmware versions and can be exploited to bypass normal login checks.

An anonymous GitHub account is mass-dropping exploit PoCs framed as undisclosed 0-days, with a note telling readers to report them and take credit for the CVE themselves. This raises concerns about coordinated disclosure and the potential impact on defenders.

Paradigm Shift’s usbliter8 exploit shows how a design flaw in the Synopsys DWC2 USB controller lets attackers overwrite SRAM and gain code execution in Apple’s A12/A13 SecureROM.

LLMs have leveled the playing field, turning the once‑sacred vulnerability report into just another issue ticket.