Vulnerabilities

Hacktron researchers chained a libheif heap buffer overflow in Discourse with an OpenAI SSO misconfiguration to takeover employee accounts and access internal repositories, demonstrating how AI accelerates exploit development.

A critical vulnerability in the Cursor AI-assisted development environment has been exposed after 7 months of silence from the company. The vulnerability allows for arbitrary code execution with no user interaction required.

A security camera shipped with a GitHub admin token in its login page, exposing hundreds of repositories to potential security risks. The token was found in the camera's firmware, which was downloaded from the manufacturer's website.

A dormant stack‑use‑after‑free in the rtmutex implementation lets an unprivileged process hijack kernel control flow, affecting every Linux distro released since 2011.

A flaw in YouTube Studio’s Ask Studio AI lets a comment control the assistant, exposing private video titles to attackers.

A hidden authentication backdoor in Tenda router firmware grants admin access, potentially allowing attackers to gain control over devices. The issue, tracked as CVE-2026-11405, affects multiple firmware versions and can be exploited to bypass normal login checks.

Paradigm Shift’s usbliter8 exploit shows how a design flaw in the Synopsys DWC2 USB controller lets attackers overwrite SRAM and gain code execution in Apple’s A12/A13 SecureROM.

LLMs have leveled the playing field, turning the once‑sacred vulnerability report into just another issue ticket.