Decision Insights Threat Desk

Articles

Network Operator

CISA flags unauthenticated Bluetooth Classic pairing issue in Skullcandy Dime 3

Decision Insights Threat Desk September 8, 2026

Skullcandy Dime 3 firmware 1.0.0.28 can accept unauthenticated Bluetooth Classic pairing, enabling trusted reconnection and audio interruption.

Cybersecurity

CISA issues guidance on UEFI Shell Secure Boot bypass

Decision Insights Threat Desk September 8, 2026

UEFI Shell in SPI flash can be referenced via added boot entries to bypass Secure Boot and run unauthorized pre-boot code.

Data Center

CISA advises on Casdoor authorization bypass affecting versions 3.115.0

Decision Insights Threat Desk September 3, 2026

Casdoor versions 3.115.0 and earlier have an authorization bypass (CVE-2026-15630) that can bypass tenant isolation and enable cross-tenant admin actions.

Cybersecurity

CISA includes advisory on Transformers CVE-2026-80047 disk writes prior to consent

Decision Insights Threat Desk September 1, 2026

Hugging Face Transformers CVE-2026-80047 writes remote custom_generate Python files to ~/.cache/huggingface/modules before trust_remote_code checks.

Network Operator

CISA addresses Kaltura mwEmbedLoader issues enabling file read and RCE

Decision Insights Threat Desk August 25, 2026

Kaltura html5lib mwEmbedLoader.php has flaws in unsafe deserialization that enable arbitrary file read and remote code execution (CVE-2026-19912/19913).

Cybersecurity

CISA: Metal Gear Online 3 Remote Code Execution Fix Issued

Decision Insights Threat Desk August 24, 2026

Konami’s Metal Gear Online 3 (v1.1.2.8) has a lobby metadata overflow leading to possible remote code execution, fixed in v1.1.2.9.