24 HIGH-severity CVEs dropped today. Key ones to watch: 🔥 AI/ML: CVE-2026-5241: huggingface/transformers ... RCE via trust_remote_code bypass when loading LightGlue models (even with trust_remote_code=False) 💥 Buffer Overflow → Root: CVE-2026-35085/84/83: gdv-serverconfig, dali-devconfig ... stack overflow → full root CVE-2022-49042/036: Synology ... local RCE via MinGW DLL & OpenSSL config 📁 Arbitrary File Ops (user → root): CVE-2026-35082/80/79/78/77/76: ugw-* & bac-scanresult ... read/terminate/delete arbitrary files & processes 🌐 Web/App: CVE-2025-15655: Mojoomla ... SQL injection CVE-2025-15654: Fox-themes Prague ... Reflected XSS CVE-2025-14772/73: ABB T-MAC Plus ... auth bypass + XSS 🔧 PrivEsc: CVE-2025-41259: SWUpdate ... TOCTOU → root CVE-2025-15656: Mojoomla ... privilege escalation 📡 Network: CVE-2026-37460: FRRouting ... crafted BGP UPDATE → DoS Patch priority: AI infra, Synology backups, ugw devices, SWUpdate, Mojoomla, ABB T-MAC.
Post summary
The post announces 24 new high‑severity CVEs with technical details but provides no proof‑of‑concept, exploitation tool, or evidence of active use, focusing primarily on disclosure and patch prioritization.
