TL;DR CERT/CC disclosed six FrodoBots EarthRover vulnerabilities on November 9, 2026, in firmware version 6.2.4_6.2.5_0.614.0 of the EarthRover Mini+. The small internet-connected robot carries a camera, microphone and motors. According to CERT/CC, the flaws "may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices." Hard-coded cloud keys and an MQTT command channel let an attacker run root commands on every EarthRover Mini+ in the fleet.

TL;DR CERT/CC published a vulnerability note on October 27, 2026, disclosing an unpatched Xerj authentication bypass tracked as CVE-2026-97406. This flaw allows attackers with existing bearer tokens to mint persistent credentials without required passkey verifications. Consequently, unauthorized users can maintain permanent administrative access even after administrators revoke the initial token. Why It Matters Xerj serves as an open-source search engine tailored for artificial intelligence agents using the Elasticsearch API.

TL;DR CERT/CC published a vulnerability note on October 27, 2026, disclosing an unpatched Xerj authentication bypass tracked as CVE-2026-97406. This flaw allows attackers with existing bearer tokens to mint persistent credentials without required passkey verifications. Consequently, unauthorized users can maintain permanent administrative access even after administrators revoke the initial token. Why It Matters Xerj serves as an open-source search engine tailored for artificial intelligence agents using the Elasticsearch API.

TL;DR CERT/CC and security researcher Louis Sanchez of Voke Cyber disclosed three high-risk Bisheng vulnerabilities affecting the open-source LLM DevOps platform by DataElement. Tracked as CVE-2026-96679, CVE-2026-96681, and CVE-2026-100156, these flaws allow unauthenticated super-administrator takeover and cross-user AI credential theft. While the vendor patched two flaws in versions 2.5.0 and 3.0.0, CVE-2026-96679 remains unpatched and requires manual mitigation. Why These DataElement Bisheng Vulnerabilities Matter…

TL;DR CERT/CC disclosed CVE-2026-104937 on October 13, 2026, a stored XSS flaw in Shopware 6.7. The Shopware vulnerability can lead to stolen admin tokens and remote code execution. No patch exists yet. Why It Matters Shopware powers online stores, so a breach can expose customer and order data. According to CERT/CC vulnerability note VU#157374, the bug "can lead to administrator credential compromise and remote code execution."

TL;DR CERT/CC and maintainers at mogh.tech disclosed CVE-2026-110005, a critical OS command injection flaw in the Komodo Periphery agent. The Komodo Periphery vulnerability carries a CVSS 3.1 base score of 9.9 and lets authenticated low-privileged users run root commands. Administrators must update all deployments to version 2.3.0 immediately. Why CVE-2026-110005 Matters for Docker Infrastructure Self-hosted and multi-server environments use the open-source Komodo platform to manage Docker containers.

TL;DR CERT/CC published a note on October 12, 2026, listing 11 Thelia vulnerabilities in the open-source e-commerce platform. Seven of them can lead to remote code execution by an authenticated back-office user. No patch exists yet, because CERT/CC could not reach the vendor. Why It Matters Thelia runs online storefronts, so a compromise can expose customer and order data. CERT/CC warns that "exploitation of any of these issues can result in complete compromise of the underlying application environment with the privileges of the web server."

CERT/CC warns that Skullcandy Dime 3 earbuds running firmware 1.0.0.28 accept Bluetooth pairing from nearby unpaired devices without user interaction, exposing users to rogue device access and audio hijacking. The flaw, tracked as CVE-2025-20701 in the Airoha Bluetooth Audio SDK, was fixed in firmware 1.0.0.30, but existing customers currently have no consumer-accessible way to update affected units. #CERTCC #SkullcandyDime3 #CVE202520701 #AirohaBluetoothAudioSDK

A missing authentication flaw in Calix GS7 XGS (GS5239XG) routers lets remote attackers create port-forwarding rules and expose home-network devices to the internet without logging in. Security researcher Brian Khan Quintana disclosed CVE-2026-75501 after vendor contact attempts failed, and the current workaround is to disable UPnP or ask the ISP to do so. #Calix #GS5239XG #CVE-2026-75501 #CERTCC #BrianKhanQuintana

ESET identified 11 old Microsoft-signed UEFI shim bootloaders that can bypass UEFI Secure Boot on systems trusting the Microsoft Corporation UEFI CA 2011 certificate. Microsoft revoked the vulnerable shims in its June 9, 2026 Patch Tuesday update, closing a path that could enable bootkit deployment such as BlackLotus, Bootkitty, and HybridPetya. #Microsoft #CERTCC #BlackLotus #Bootkitty #HybridPetya

A hidden authentication backdoor in multiple Tenda router firmware versions can let an attacker gain full administrative access to the web management panel by supplying a special password. CERT/CC says CVE-2026-11405 affects several Tenda routers, no patch is available yet, and users are advised to disable remote web management and reduce LAN exposure. #Tenda #CVE-2026-11405 #CERTCC

CERT/CC warned that several Tenda firmware versions contain an undocumented authentication backdoor tracked as CVE-2026-11405, allowing attackers to bypass password checks and gain full administrative access to the web management interface. The flaw is still unpatched, and users are advised to disable remote management and change the default LAN IP address...

Microsoft is accused of quietly fixing an Azure Backup for AKS privilege escalation flaw after rejecting the researcher’s report and helping block a CVE. Justin O'Leary says the issue let a low-privileged Backup Contributor gain cluster-admin access through Trusted Access, while Microsoft denies a vulnerability and says no product changes were made. #AzureBackupforAKS #AKS #JustinOLeary #MSRC #CERTCC #MITRE

ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities.

ESET researchers have discovered a vulnerability that affects the majority of UEFI-based systems and allows bypassing UEFI Secure Boot.

Eyal Estrin unread, 12:08 PM (20 minutes ago)    to https://thehackernews.com/2026/01/certcc-warns-binary-parser-bug-allows.html Eyal Estrin CISSP, CCSP, CISM, CISA, CDPSE, CCSK Blog: https://security-24-7.com | Books: https://amzn.to/42Xai9A | https://amzn.to/3Sggbtv Twitter: @eyalestrin | Bluesky: @eyalestrin.bsky.social Reply all Reply to author Forward

TL;DR CERT/CC published an advisory on July 21, 2026 for a Plane authorization bypass. Tracked as CVE-2026-15342, it lets a user in one workspace read, copy, or delete another workspace's files. No patch exists, because CERT/CC could not reach the vendor. Why it matters Plane is an open-source project management platform. It promises multi-tenant isolation, so each workspace stays walled off.

TL;DR CERT/CC published vulnerability note VU#492466 on 23 July 2026, covering six flaws in the Logto identity platform. The Logto vulnerabilities let attackers hijack accounts through unverified email linking, skip locally configured MFA, and replay SAML assertions. No patch exists yet, because CERT/CC could not reach the vendor. Why it matters Logto, built by Silverhand Inc., handles authentication for SaaS and AI applications.

TL;DR CERT/CC published vulnerability note VU#326070 on July 16, 2026. It details an SGLang vulnerability, CVE-2026-14890, rated CVSS 9.1. An unauthenticated attacker can run code on the host, and no patch exists. Why it matters SGLang serves large language models such as Qwen, DeepSeek, and Mistral. It also speaks the OpenAI API format. So it sits inside plenty of production AI stacks.