Do Son Critical Lexmark printer flaws CVE-2025-65078 (CVSS 9.3) & CVE-2025-65077 allow remote code execution. Update firmware immediately to protect your network.
IoT security
Hikvision patches high-severity command injection (CVE-2026-0709) in DS-3WAP access points. Authenticated attackers can execute code. Update now.
Critical KiloView flaw CVE-2026-1453 (CVSS 9.8) allows unauthenticated admin takeover. Broadcast feeds at risk. Check affected E1/E2 versions immediately.
TP-Link patches CVE-2025-14756 (CVSS 8.5) in Archer MR600 routers. This command injection flaw allows full device takeover. Update firmware now.
Akamai reveals critical Vivotek camera flaw CVE-2026-22755. Unauthenticated command injection allows root access. Update legacy firmware now.
TP-Link patches critical VIGI camera flaw (CVE-2026-0629). LAN attackers can reset admin passwords and hijack feeds. Update firmware now.
WhisperPair flaw (CVE-2025-36911) exposes Google Fast Pair devices to hijacking and tracking. Update your headphone firmware now to block silent attacks.
Canon warns of 7 critical flaws (CVSS 9.8) in imageCLASS & i-SENSYS printers. Unauthenticated RCE risk. Update firmware immediately to secure devices.
Two CVSS 10 flaws (CVE-2025-69425 & CVE-2025-69426) hit Ruckus vRIoT. Hardcoded secrets allow attackers to seize root access. Update to v3.0.0.0 now.
Apache NimBLE flaws (CVE-2025-62235) allow Bluetooth spoofing and eavesdropping. Update to v1.9.0 now to secure your IoT devices against attacks.
Critical flaw in EOL TOTOLINK EX200 opens unauthenticated root Telnet on error. CVE-2025-65606 exposes your network to total compromise. Replace it now.
CVE-2026-0625: Unpatchable D-Link routers face critical RCE attacks. Hackers are actively exploiting this zero-day. Replace legacy DSL models immediately.
MediaTek's Jan 2026 bulletin reveals critical modem flaws and memory corruption risks across dozens of chipsets. Update your device to stay safe!
Apache NuttX patches a moderate Use After Free (CVE-2025-48769) and a DoS flaw in its filesystem. Network-exposed devices must upgrade to v12.11.0.
CloudSEK uncovers the RondoDoX botnet's expansion into enterprise Next.js apps via the React2Shell exploit, alongside global IoT compromises.
A Linksys zero-day (CVE-2025-52692) allows attackers to bypass login screens and enable Telnet for root access. No patch planned!
With 1.8 million infected Android TVs, Kimwolf issued 1.7 billion commands in 3 days, using Ethereum ENS to become a nearly un-killable cyber threat.
Critical alert: Twonky Server suffers unpatched flaws (CVE-2025-13315/16) allowing full takeover. Vendor has no fix; isolate your server immediately.
Critical Unpatched Flaw: Vivotek EOL IP Cameras Exposed to Unauthenticated RCE via Command Injection
Critical Unpatched Flaw: Vivotek EOL IP Cameras Exposed to Unauthenticated RCE via Command Injection
A critical, unpatched flaw in EOL Vivotek IP Cameras allows unauthenticated RCE via command injection in eventtask.cgi. Firmware versions 0100c–0305a4 are vulnerable and will not receive fixes.
Trend Micro discovered RondoDox, a new botnet leveraging 50+ exploits (including the Pwn2Own TP-Link flaw) in an "exploit shotgun" approach to compromise routers, DVRs, and IoT globally.
D-Link warns of a critical command injection flaw (CVSS 9.8) in its EOL DIR-series routers. A PoC is public, and since no patch is available, devices must be replaced.
A critical command injection flaw (CVE-2025-57105) has been found in D-Link's end-of-life DI-7400G+ router series. Because the devices are unsupported, no patch is coming.