NewsThe Hacker News13.10.2026SME

LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware

Other advisories

Not ratedosv:CVE-2026-86055Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
HighCVE-2026-113711ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
HighCVE-2026-113711ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
Not ratedosv:CVE-2026-111075JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
Not ratedosv:CVE-2026-111074JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()
Not ratedosv:CVE-2026-113711ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
Not ratedosv:CVE-2026-108062Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
HighCVE-2026-91972Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api

Other news entries

Source: https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html

More on Pre-Auth

Other advisories

Other news entries