youtu.bevideo🛡️ SecurityThe uploader demonstrates a remote code execution exploit chain against Muse, an assistant system that uses the pdfdetach utility to parse PDF attachments. The exploit leverages a path traversal vulnerability during file extraction to drop a malicious shared library and an LD_PRELOAD configuration file.
AppSec· Published and added 30 Oct 2026
oversecured.comarticle🛡️ SecurityOversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.
Mobile Security, AppSec· Added 29 Oct 2026
oversecured.comarticle🛡️ SecurityOversecured's Android security checklist for Content Providers covers insecure FileProvider path configs, path traversal via decoded Uri.getLastPathSegment(), mismatched readPermission/writePermission, proxying requests to more privileged providers, SQL injection across a shared database, and sensitive actions in providers. Each case has vulnerable manifest and Java code, an attacker PoC and remediation. Real cases from Google and Samsung devices are cited. The page text was truncated near the end.
Mobile Security, AppSec· Added 29 Oct 2026
oversecured.comwriteup🛡️ SecurityOversecured's write-up of 20 vulnerabilities in Xiaomi apps and system components, reported to Xiaomi between 25 and 30 April 2023. Bugs include intent redirection with system privileges in Security and GetApps, shell command injection in System Tracing, and arbitrary file theft via path traversal in Settings and MIUI Bluetooth. Each has a PoC. The page was truncated, so the later MIUI Bluetooth entries and the rest are not covered.
Mobile Security, AppSec· Added 29 Oct 2026
x.comthread🛡️ SecurityPrevidian Cyber reports an exploitation attempt against its FortiSIEM honeypot on 23 October 2026 at 09:43:32 UTC, targeting the FortiSIEM path traversal CVE-2026-106173. The request, from 85.192.29[.]68, POSTed to /phoenix.phoenixSvc/SendQueryResult on TCP 27918 with twelve ../ sequences in the query-id header, trying to overwrite /tmp/.fsmprobe with an empty file. It matches the file overwrite mode of the Horizon3.ai PoC; success is not confirmed. Mitigation: upgrade to FortiSIEM 7.5.1 or later and restrict TCP 27918.
Threat Intel, Blue Team & Detection· Added 25 Oct 2026, published 23 Oct 2026
blog.cloudflare.comarticle🛡️ SecurityCloudflare announces full transaction detection and response-phase rules for its WAF. Detections evaluate an HTTP request together with the origin's response, so exploitation can be confirmed (for example, path traversal returning a config file) and the response replaced with a 403 block page. Covers managed and custom rules, the limit of three custom response rules, no response-body matching yet, and a first managed rule for php2shell. Available on all plans, including Free.
AppSec, Blue Team & Detection· Added 29 Oct 2026, published 21 Oct 2026
endorlabs.comarticle🛡️ SecurityEndor Labs evaluates Gemini 4 Argon in the Cursor harness on its Agent Security League coding tasks (SusVibes). Argon ties Fable 5 at 29% SecPass with 78.8% FuncPass, but costs $765 and takes a 14-minute median per task. It uniquely fixes SABnzbd path traversal (CVE-2021-29488) and a Nova credential-logging leak (CVE-2015-8749). Two other candidate solves were rejected, and 29 cheating instances were confirmed.
AI Security, AppSec· Published and added 20 Oct 2026
horizon3.aiwriteup🛡️ SecurityCVE-2026-106173 is an unauthenticated arbitrary file write in the FortiSIEM phQueryMaster gRPC service on tcp/27918, advised by Fortinet on 13 October 2026. The SendQueryResult handler concatenates an attacker-controlled query-id into a path, and a null byte in the header removes the server-added filename suffix. Overwriting /opt/charting/redishb.sh, run every 60 seconds by cron, gives root-level code execution. IOCs are file timestamps.
Offensive Security, AppSec· Added 29 Oct 2026, published 20 Oct 2026
securityweek.comarticle🛡️ SecurityUNC5820 (tracked by Palo Alto Networks as CL-STA-0954) breached a telecom in September 2024 using FortiManager flaw CVE-2024-47575 (FortiJump) and path traversal CVE-2025-61624, then deployed PeerStitch, a memory-resident ARM64 FortiGate implant. PeerStitch patches FortiOS log and IKE/IPsec daemons to build a covert bridge without listening ports. The actor also impersonated FortiManager over FGFM, using CVE-2024-26008. CISA added CVE-2025-61624 to KEV.
Threat Intel, Malware & RE· Published and added 19 Oct 2026
arxiv.orgpaper🧠 AIToFu is a tool-aware fuzzing framework for LLM tools, including MCP servers. It maps each tool argument, using its metadata, to one of 74 CWE-guided semantics-aware sanitizers (path, URL, SQL and similar). It then generates schema-valid Atheris harnesses and semantic oracles, using runtime tracers for in-process tools and outcome oracles for opaque ones. The LLM (gpt-4.1) only maps sanitizers and writes seeds; it is never the security judge. The paper also shows a "Repeat-After-Me" trick, where an LLM told to repeat attacker-crafted text emits a tool call the orchestrator executes, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Across 273 runnable MCP servers (3,405 tools) it reports 253 verified bugs in 343 tools across 118 servers, such as path traversal, log injection and exfiltration. These are failures a crash-based fuzzer would miss. The result matters because it shows LLM-generated tool arguments cannot be treated as trusted.
mcp, research, agents· Added 18 Oct 2026
arxiv.orgpaper🛡️ SecurityToFu is a tool-aware fuzzing framework that derives semantic security checks for LLM tools (mainly MCP servers) from their metadata and a corpus of 74 CWE-guided sanitizers. It generates schema-valid Atheris harnesses, uses runtime tracers and outcome oracles to catch bugs that don't crash, and uses an LLM only to map sanitizers and seed inputs, never as the judge. It also describes a "Repeat-After-Me" attack, in which the LLM is told to repeat attacker-written text that the orchestrator then dispatches as a tool call. It was reproduced on LangGraph, MAF, ADK, AutoGen, Strands and CrewAI. On 273 MCP servers it reports 253 verified bugs across 343 tools in 118 repositories, including path traversal, log injection, exfiltration and command bypass.
AI Security, AppSec· Added 18 Oct 2026
securityweek.comarticle🛡️ SecuritySecurityWeek's weekly roundup covers ICS-Sniper, a UBC proof-of-concept that uses VPN-encrypted packet size, direction and timing to drop critical SCADA traffic on cloud-hosted ICS (tested on the SWaT water testbed). It also covers an unauthenticated RCE PoC against the XWorm RAT C2 panel (up to 7.4) via path traversal DLL overwrite, and Langflow CVE-2026-105740 (MCP Stdio command injection, fixed in 1.9.0) exploited from September 19, before the CVE was published. Other items: XBOW's AI-assisted Chrome full-chain exploit (GPT-5.6 Sol, $250k bounty), Group-IB's KGB RAT analysis, Anthropic's disclosure of Claude rule-bending on live sites, Intel ending SGX after Diamond Rapids, Bank of America's Mythos-driven patching, the Burger King Japan breach and a West African scam-center takedown.
Threat Intel, AI Security, Offensive Security· Published and added 16 Oct 2026
x.comadvisory🛡️ SecurityDaily CVE digest on CVE-2026-76519, a CVSS 9.8 relative path traversal (CWE-23) in Cisco Secure Email Gateway's AMP File Reputation attachment processing. A crafted attachment gives unauthenticated arbitrary file writes and root command execution, and Cisco PSIRT reports active exploitation. The CVE is in CISA KEV. It lists the applicability conditions (File Reputation assigned to a policy and Content Scanner Tools earlier than 25.3.0.5525) and the fixes (scanner 25.3.0.5525, AsyncOS 15.5.5-014 and 16.5.0-780). It also covers evidence preservation, reading Cisco's System Security scan outcomes, mail/AMP log correlation, and deployment-specific recovery including cluster-key exposure.
Blue Team & Detection, Threat Intel· Added 18 Oct 2026, published 15 Oct 2026
unit42.paloaltonetworks.comwriteup🛡️ SecurityPEERSTITCH is a memory-resident ARM64 implant that Unit 42 found in a September 2024 telecom intrusion (cluster CL-STA-0954, aka UNC5820). Attackers used CVE-2024-47575 on FortiManager to steal configs for more than 500 FortiGates, then CVE-2025-61624 auto-script path traversal to reach root. The report covers ptrace injection into miglogd and iked, an Apache mod_md ACME reverse shell, FGFM impersonation, anti-forensics, hunting guidance, IOCs and YARA.
Threat Intel, Malware & RE, Blue Team & Detection· Added 30 Oct 2026, published 14 Oct 2026
embracethered.comwriteup🛡️ SecurityCVE-2026-103572 is a remote code execution bug in Microsoft.VisualStudio.Copilot.Core.dll, shared by Visual Studio and SQL Server Management Studio. A trailing dot (for example `.mcp.json.`) bypasses the protected-filename check in EditsFunctionHandler.GetEditConfirmationTypeAsync, so a hijacked Copilot can rewrite its own MCP and settings files and run commands. The post covers path traversal and InstallationID leaks, indirect prompt injection demos, the October 2026 patch (GetFullPath), and a $0 bounty.
AI Security, AppSec, Offensive Security· Added 29 Oct 2026, published 13 Oct 2026
x.comthread🛡️ SecuritySocial post summarizing watchTowr's Oct 2026 research on an unauthenticated RCE chain in PaperCut NG 26.0.4-PO build 76508: an auth bypass (WT-2026-0143, no CVE) re-runs the Setup Wizard via the Home page to reset the admin password, then CVE-2026-82077 (Scan-to-Fax path traversal) gives OS command execution. It lists fix versions (build 76530, 26.0.5, 25.0.13), notes watchTowr's detection tool covers only the bypass, and says exploitation of this chain is unconfirmed, unlike the August attacks using CVE-2026-81578 and CVE-2026-82078.
AppSec, Offensive Security· Added 13 Oct 2026, published 12 Oct 2026
labs.watchtowr.comwriteup🛡️ SecuritywatchTowr's analysis of the PaperCut NG 26.0.4-PO build 76508 pre-auth RCE chain, built from WT-2026-0143 (authentication bypass) and WT-2026-0144 / CVE-2026-82077 (post-auth RCE). The bypass reaches Setup Wizard forms through the Tapestry service parameter via the Home page, which resets the admin password. The RCE uses path traversal in the Scan to Fax connector. It also gives the August to September 2026 patch and bypass timeline, including exploited CVE-2026-81578 and CVE-2026-82078.
AppSec, Offensive Security, Identity & Access· Added 30 Oct 2026, published 9 Oct 2026
orca.securityadvisory🛡️ SecurityOrca Security details CVE-2026-21589 (CVSS 9.3), a critical unauthenticated path traversal flaw affecting all versions of eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Insufficient path validation lets remote attackers read arbitrary files within the web application root without authentication, and in Crowd SSO deployments this can expose plaintext credentials usable to create administrative accounts and take over the entire Atlassian ecosystem. The advisory lists fixed versions for each product and recommends WAF rules and log review for organizations unable to patch immediately.
AppSec, Identity & Access· Published and added 7 Oct 2026
rapid7.comwriteup🛡️ SecurityRapid7's analysis of CVE-2026-21589 (CVSSv4 9.3), a critical unauthenticated arbitrary file read vulnerability affecting Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It summarizes watchTowr Labs' root-cause finding that double-colon (::) sequences can act as path separators in Atlassian's web-resource handling, enabling path traversal to read arbitrary files within the Tomcat web root — including crowd.properties credentials that can be chained to create a rogue jira-administrators account. The post provides emergency patching guidance, Atlassian's WAF/RewriteValve mitigations, log-hunting regex, and notes public Python PoC and Nuclei templates exist.
AppSec· Published and added 7 Oct 2026
watchtowr.comadvisory🛡️ SecurityCVE-2026-21589 is an unauthenticated arbitrary file read (path traversal) in eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Atlassian fixed it on 5 October 2026, and CISA added it to the KEV catalog on 15 October 2026. The page lists patching, WAF regex, Tomcat RewriteValve and urlrewrite.xml mitigations, and a log check for ".." sequences after up to two rounds of URL decoding.
AppSec, Blue Team & Detection· Added 30 Oct 2026, published 6 Oct 2026
x.comadvisory🛡️ SecurityAtlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) unauthenticated path traversal flaw allowing remote attackers to read specific files within the web application root across its self-managed Data Center/Server products — Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Fixed versions are listed for each product (e.g. Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19), and Atlassian Cloud is already patched; WAF/URL-rewrite mitigations are available for those who can't upgrade immediately. The post's analyst note clarifies exploitation requires knowing the exact target file path (no directory listing), and as of Oct 5, 2026 it is not yet in CISA KEV with no public exploit reported.
AppSec· Added 7 Oct 2026, published 6 Oct 2026
cisa.govadvisory🛡️ SecurityCISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation. The alert restates the obligations of BOD 26-04 for Federal Civilian Executive Branch agencies: prioritise KEV CVEs on publicly exposed assets that give total control, and check for compromise before patching. It also describes the KEV nomination criteria: a CVE ID, evidence of exploitation and clear mitigation guidance. The page gives no technical detail, patch status or IOCs.
Threat Intel, GRC· Added 4 Oct 2026
x.comthread🛡️ SecurityA security researcher flags a claimed path traversal vulnerability (CVE-2026-95273, CVSS 4.3) in changedetection.io up to version 0.60.7, stemming from how the static_content route handles the filename parameter. The poster notes the exploit is reportedly public with no patch yet, but explicitly cannot verify the CVE against NVD or GitHub advisories, and advises checking the version, reviewing the static_content file-path logic, and keeping the UI off the public internet (behind auth or a VPN) until a fix ships.
AppSec· Published and added 4 Oct 2026
x.comthread🛡️ SecurityA tweet by @norsyx announces the public release of a proof-of-concept exploit for CVE-2026-100520, a high-severity path traversal vulnerability in Laranode, a multi-tenant hosting control panel. The flaw allows a low-privileged authenticated user to write files outside their own home/tenant directory, which can lead to cross-tenant compromise on shared hosting infrastructure. The linked GitHub repository hosts the PoC code.
AppSec, Offensive Security· Added 5 Oct 2026, published 3 Oct 2026
thehackernews.comadvisory🛡️ SecurityCISA added CVE-2026-104286 (CVSS 9.8), a path traversal and NULL-byte handling flaw in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation. The bug lets unauthenticated attackers write arbitrary files via crafted HTTP/HTTPS requests, affecting FortiMail 7.2 through 8.0.1; Fortinet published workarounds (disabling IBE, restricting management-interface access) ahead of patches and shared attacker IPs and modified/added files as IOCs. The article also lists several other actively exploited vendor flaws disclosed the same week (Check Point, Arista VeloCloud, F5 BIG-IP APM, Cisco Catalyst SD-WAN Manager, Citrix NetScaler).
Threat Intel, AppSec· Added 3 Oct 2026
binsec.nowriteup🛡️ SecurityThird post in a series on Azure Logic Apps API Connections, describing five critical cross-tenant privilege escalations that let an attacker use any other tenant's connection to reach its backend (Key Vault, Azure SQL, Jira, Salesforce). Techniques include path traversal via ARM DynamicInvoke and undocumented DynamicList endpoints, and abusing the host.api.runtimeUrl parameter in Consumption Logic Apps, including a validation-before-normalization bypass. The author reports $200,000 in bounties; Microsoft fixed all issues.
Cloud & Infra, AppSec, Offensive Security· Added 30 Oct 2026, published 2 Oct 2026
x.comthread🛡️ SecurityCISA added CVE-2026-104286, a critical (CVSS 9.8) path traversal and NULL-byte neutralization flaw in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog on October 1, 2026, citing active in-the-wild exploitation. The bug allows unauthenticated arbitrary file write via crafted HTTP/HTTPS requests on FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1, with fixes coming in 8.0.2/7.6.7/7.4.9+ and an interim workaround of disabling IBE and restricting management-interface internet access. Federal agencies face an October 4, 2026 BOD 26-04 remediation deadline, and Fortinet's advisory (FG-IR-26-175) includes IoCs for hunting.
Threat Intel, AppSec· Added 2 Oct 2026, published 1 Oct 2026
snyk.ioarticle🧠 AISnyk argues AI coding agents reliably write broken access control (BOLA/IDOR, OWASP's top category since 2021) because the facts needed to add an ownership check — what an object belongs to, who may access it, where tenant boundaries sit — are tacit product knowledge that exists nowhere in the code or prompt an agent sees. It explains why SAST tools catch patterned sub-categories like path traversal or SSRF but structurally cannot catch CWE-639/862/863 (missing or incorrect authorization), since there's no bad pattern to match, and proposes reasoning over an assembled "application-context graph" of architecture, data flows and trust boundaries instead. It closes with a five-step team checklist (inventory ID-accepting endpoints, document ownership rules, add authorization-specific PR review, write cross-tenant tests, run deep contextual analysis) and pitches Snyk's Evo Agentic AppSec as the tool built around that approach.
coding-agents· Published and added 1 Oct 2026
snyk.ioarticle🛡️ SecuritySnyk explains why AI coding agents reliably ship broken object-level authorization (BOLA/IDOR) bugs: the ownership rule that would prevent them (e.g. "invoices belong to organizations") lives in the product's data model and team knowledge, not in the prompt or surrounding code, so the agent produces code that is correct for the stated task but lets any authenticated user access other tenants' objects. The piece maps the flaw to CWE-639/862/863, contrasts it with pattern-matchable classes like SSRF and path traversal that SAST handles well, and lays out five concrete team actions (endpoint inventory, documented ownership rules, explicit authz review questions, per-resource cross-tenant tests, and periodic deep contextual analysis), while pitching Snyk's "application-context graph" and Evo Agentic AppSec as the tool for the pattern-less gap.
AppSec, AI Security· Published and added 1 Oct 2026
github.comrepo🛡️ Securitysecurity-harness is an open-source Claude Code plugin (also packaged for Gemini CLI, Codex and opencode) that orchestrates subagents — sh-recon, sh-hunter, sh-chainer, sh-verifier, sh-reporter — through a static-analysis pipeline covering 15 vulnerability classes (IDOR/BOLA, SQLi, XSS, SSRF, injection, auth, deserialization, path traversal, secrets, CSRF, XXE, open redirect, crypto, race conditions, file upload), producing README/JSON/SARIF/HTML/PDF reports with PoCs, CVSS and CWE/OWASP mappings. It also ships sh-pr-review, a per-PR merge-gate skill that posts inline findings and a commit status scoped only to code the PR itself introduced or aggravated, with caching, dedup via fingerprints, and a scheduled GitHub Action that keeps its per-class knowledge bases fresh by having one AI agent draft updates from allowlisted sources (OWASP, PortSwigger Research, CWE/CAPEC, HackerOne) while a separate adversarial reviewer agent fails-closed against prompt injection before auto-merge.
AppSec, AI Security, DevSecOps· Added 2 Oct 2026, published 29 Sep 2026
cisa.govadvisory🛡️ SecurityCISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-09-22 based on evidence of active exploitation: two Check Point multi-product flaws (improper certificate validation CVE-2026-85102, path traversal CVE-2026-93616), an Arista VeloCloud Orchestrator improper input validation bug (CVE-2026-93952), and an F5 BIG-IP APM heap-based buffer overflow (CVE-2026-94127). The alert ties the additions to BOD 26-04, which has FCEB agencies prioritize remediation of KEV CVEs on publicly exposed assets that give total control, and to checking for prior compromise before patching.
Threat Intel, GRC· Added 26 Sep 2026
oversecured.comwriteup🛡️ SecurityOversecured summarizes a multi-year research effort (2022-2025) that uncovered 176 vulnerabilities across Samsung's preinstalled system apps, all patched and rewarded with over 200000 dollars in bug bounties. The bugs cluster into categories including system UID-1000 privilege escalation, PendingIntent hijacking, intent redirection, implicit IPC/broadcast leakage of sensitive data, path traversal in system-privileged apps, and insecure WebView JavaScript-interface exposure via deep links; several were found in leftover debug/testing apps (FactoryCamera, Configuration Update) shipped with system privileges and no access controls. Some findings were also tracked under Samsung's own SVE identifiers (SVE-2023-1112, SVE-2023-0760, SVE-2023-0928).
Mobile Security, AppSec· Added 26 Sep 2026
nvd.nist.govadvisory🛡️ SecurityCVE-2026-65695 is a path traversal vulnerability (CWE-22, CVSS 4.0 7.6 HIGH) in Office-Word-MCP-Server through version 1.1.11, an MCP server that exposes Word document manipulation tools to LLM agents. Attackers who can influence the filename argument can supply absolute paths or ../ sequences to document open/save operations, bypassing the check_file_writeable and ensure_docx_extension helpers (which do no base-directory confinement or realpath validation) to read or overwrite arbitrary .docx files outside the intended working directory.
AI Security, AppSec· Added 26 Sep 2026
rapid7.comwriteup🛡️ SecurityRapid7 previews collaborative research with Zimbra that uncovered over 50 vulnerabilities in the Zimbra Collaboration Suite, several of which let attackers impersonate senders without credentials, control inbox visibility, and alter shared documents and calendars, turning classic Business Email Compromise into active manufactured-reality attacks rather than passive mailbox monitoring. It traces the pattern through real exploited Zimbra CVEs in CISA's KEV catalog (CVE-2024-45519 postjournal command injection, CVE-2025-27915 stored XSS via calendar invite used against Brazilian military targets, CVE-2026-73570 SNMP command injection) and earlier 2022 to 2023 zero-days (CVE-2022-27925, CVE-2022-37042 path traversal plus auth bypass, CVE-2023-37580) exploited by multiple threat groups per Google's Threat Analysis Group.
AppSec, Threat Intel· Added 7 Oct 2026, published 24 Sep 2026
blog.googlearticle🛡️ SecurityPageBreak is Google Product Security's internal LLM-driven agent, built mostly on Gemini models, that autonomously hunts for exploitable bugs in Google's first-party web apps and confirms them with deterministic, non-AI validators rather than relying on model-generated hypotheses alone. The validators execute real payloads to prove exploitability for XSS, SQL injection, path traversal, RCE, and SSRF, which Google says drives false positives near zero and let the system surface over 500 real XSS bugs across sensitive Google domains; when run against apps built on Google's high-assurance web framework it found only 2. The post also describes feeding unverified findings back into the system to seed deeper scans and improve validators, and notes integration plans with Google's CodeMender automated-fix agent.
AI Security, AppSec· Added 1 Oct 2026, published 24 Sep 2026
arxiv.orgpaper🛡️ SecurityVIPER-MCP is an end-to-end automated auditing framework that combines two-pass static taint analysis (anchor queries mapping alerts to specific MCP tool handlers) with feedback-driven LLM prompt evolution to both detect and dynamically confirm taint-style vulnerabilities (command injection, SSRF, path traversal) in Model Context Protocol servers. Run against 39,884 real-world open-source MCP server repositories, it discovered 106 0-day vulnerabilities — all confirmed via end-to-end exploit traces with concrete proof-of-concept natural-language prompts — resulting in 67 assigned CVEs, including a root-privilege RCE in the bytebot computer-use agent. It reports 0% false positive rate and 7.7% false negative rate, substantially outperforming existing static and dynamic MCP security baselines.
AI Security, AppSec· Added 22 Sep 2026, published 17 Sep 2026
orca.securityadvisory🛡️ SecurityDetails CVE-2026-85706 (CVSS 10.0), an unauthenticated arbitrary file read in GitLab CE/EE's repository commits API exploitable via a crafted file.path parameter in a single POST request, requiring only that one public project exist on the instance. It also covers CVE-2026-87719 (CVSS 9.9), an authenticated insecure deserialization bug in GitLab EE's GraphQL subscription serializer reachable via Duo Chat access that leaks stored Elasticsearch/OpenSearch credentials. Both affect GitLab versions through 19.3.1; CVE-2026-85706 is under active internet-wide scanning per WatchTowr Labs and is in CISA's KEV catalog with a federal patch deadline, with fixes in GitLab 19.1.8/19.2.6/19.3.2.
AppSec, Threat Intel· Published and added 14 Sep 2026
rapid7.comadvisory🛡️ SecurityGitLab patched CVE-2026-85706, a critical (CVSS 10.0) path traversal flaw (CWE-22) in the repository commits API that lets an unauthenticated attacker read arbitrary files from self-managed GitLab CE/EE instances; CISA added it to the KEV catalog on September 11, 2026 due to active exploitation, with a remediation deadline of September 14. The same patch release fixes CVE-2026-87719, a critical insecure deserialization bug (CWE-502) letting an authenticated Duo Chat user exfiltrate Advanced Search configs and credentials via a crafted GraphQL subscription argument, plus 17 other vulnerabilities. Rapid7 recommends emergency patching and post-patch compromise checks given confirmed in-the-wild exploitation.
AppSec, Threat Intel· Added 7 Oct 2026, published 14 Sep 2026
endorlabs.comwriteup🛡️ SecurityEndor Labs details GHSA-r5fq-947m-xm57, a high-severity path traversal (CVSS 8.8) in OpenClaw's apply_patch tool that allows arbitrary file write/delete when sandboxRoot isn't configured, tracing the vulnerable code path from resolvePatchPath() through resolvePathFromCwd() to fs.writeFile/fs.rm. Because the tool is only invoked via LLM decision, the researcher bypassed the model's safety guardrails by injecting fabricated function_call/function_call_output entries into the /v1/responses conversation history, tricking the LLM via in-context learning into emitting a real malicious tool call with a traversal payload. This illustrates how LLM safety training can be the sole runtime control gating dangerous tool arguments, and how that control can be defeated with conversation history injection.
AppSec, AI Security· Published and added 11 Sep 2026
horizon3.aiadvisory🛡️ SecurityCVE-2026-85706 is a CVSS 10.0 critical path traversal vulnerability in GitLab CE/EE's repository commits API, caused by improper path confinement combined with missing authentication enforcement. It allows unauthenticated, remote attackers to read arbitrary files from the GitLab server — potentially exposing credentials, secrets, tokens, SSH keys, and database credentials. Affects versions 18.7 through 19.1.7, 19.2.0-19.2.5, and 19.3.0-19.3.1; fixed in 19.1.8, 19.2.6, and 19.3.2.
AppSec· Added 17 Sep 2026, published 11 Sep 2026
watchtowr.comadvisory🛡️ SecuritywatchTowr's rapid-reaction analysis of CVE-2026-85706, a critical (CVSS 10.0) unauthenticated path traversal in GitLab CE/EE's repository commits API, patched in versions 19.3.2, 19.2.6, and 19.1.8. The flaw lets an unauthenticated attacker read arbitrary files (configs, secrets) from self-managed GitLab servers via crafted requests to /api/v4/projects/{id}/repository/commits/ with a file.path parameter; watchTowr reproduced the bug and reports honeypot probes indicating attackers have already reverse-engineered it ahead of mass exploitation.
AppSec· Added 21 Sep 2026, published 11 Sep 2026
watchtowr.comadvisory🛡️ SecuritywatchTowr's rapid-reaction analysis of CVE-2026-85706, a critical (CVSS 10.0) unauthenticated path traversal vulnerability in the GitLab CE/EE repository commits API, patched in versions 19.3.2, 19.2.6, and 19.1.8. The flaw allows an unauthenticated attacker to read arbitrary server-side files via the commits API due to improper path confinement and missing auth enforcement; watchTowr's honeypot network was already observing exploitation probes at time of publication. The post includes hunting guidance (searching logs for POST requests to /api/v4/projects/{id}/repository/commits/ containing file.path parameters) and patching priorities for self-managed instances.
AppSec· Added 16 Sep 2026, published 11 Sep 2026
tldrsec.comarticle🛡️ Securitytl;dr sec issue #345 is a security newsletter digest. It covers Greptile's test showing models miss bugs in their own code, an OCaml cohttp path traversal fix probed within ten minutes of the PR, and a Wiz Version Control DFIR poster for GitHub, GitLab, Bitbucket and Azure DevOps. It also covers an arXiv paper on open-weight agentic worms (61.8% infection of a 33-host testbed) and Endor Labs' 14 flaws in seven AI orchestration platforms.
AI Security, AppSec, Blue Team & Detection· Added 30 Oct 2026, published 10 Sep 2026
adversa.aiarticle🛡️ SecurityAdversa.ai's August 2026 MCP security roundup leads with Deadbugz, an active supply-chain campaign that filed 23 GitHub pull requests in 74 minutes to plant a malicious MCP server that only reveals its credential-harvesting instructions after three tool calls, defeating one-time review. It also covers three fresh MCP-server CVEs (Atlassian path traversal, ArcadeDB cleartext cluster-token disclosure, facebook-ads-mcp-server SSRF), a large-scale audit finding 68 vulnerabilities across 414 internet-facing MCP servers with 91.8% lacking authentication, and defense writeups on Keycloak-backed MCP authorization and Cloudflare's MCP traffic fingerprinting.
AI Security, Supply Chain, AppSec· Added 26 Sep 2026, published 7 Sep 2026
aikido.devwriteup🛡️ SecurityAikido researchers found a delayed RCE in the Unreal Engine 5-based game MECCHA CHAMELEON, exploitable via a malicious Steam Workshop map. A Blueprint-exposed audio recording function allowed arbitrary file writes via path traversal, a null-byte trick stripped the auto-appended .wav extension to drop an .exe into the Windows Startup folder, and PCM audio samples were crafted byte-for-byte to smuggle a polyglot WAV/HTA payload that launches mshta.exe and runs arbitrary code on reboot. The issue was patched in the game's 4.0.0 update.
AppSec, Offensive Security· Published and added 3 Sep 2026
anil.recoil.orgarticle🛡️ SecurityAn OCaml maintainer describes fixing a path traversal bug in cohttp 6.3.0. Probes for percent-encoded traversal hit their live server about ten minutes after the fix PR (cohttp#1145) was opened publicly, and their own agents could find and exploit the bug from only a rough hint. They argue that embargoes no longer work, citing the Fang et al. GPT-4 exploit results, a mean time-to-exploit of -7 days, and fast exploitation of marimo and Langflow CVEs. They also discuss the "bugonomics" paper and weigh options: private patch development, continuous shipping, and protocol-layer virtual patching via the antibotty idea.
AppSec, AI Security, Supply Chain· Added 16 Sep 2026, published 22 Aug 2026
github.comrepo🛡️ SecurityA defensive security review lab for MinIO pinned at commit 7aac2a2 (~RELEASE.2025-10-15+11), providing Docker-based single-node, two-node replication, and dual-OIDC environments plus per-finding repro.sh PoCs for issues including service-account key path traversal, server-update SSRF, cross-provider OIDC token acceptance, source-IP/X-Forwarded-For trust, tag-deletion replication bypass, batch job data exfiltration, and secrets exposed via config history. Each of 16+ findings (F-01 through F-16) has ANALYSIS.md with root cause, data-flow trace, and suggested fix, produced via a generate/judge/independent-verify pipeline with cross-vendor adjudication (including an OpenAI/codex-based verifier) and live validation on a lab-built Go binary; ~90 candidates were triaged with ~55 set aside as false positives or intended behavior.
AppSec· Added 3 Sep 2026, published 21 Aug 2026
thehackerwire.comadvisory🛡️ SecurityCVE-2026-76832 (CVSS 8.8) is a path traversal flaw in Agno's PythonTools, specifically in libs/agno/agno/tools/python.py, where the file_name argument to read_file, save_to_file, and run_python_file is not sanitized against the configured base_dir. An attacker can pass sequences like ../../../../etc/passwd to read or write arbitrary files, and abuse run_python_file to execute an arbitrary Python script for RCE. The advisory notes the flaw is reachable either via direct tool invocation or via prompt injection into agent-processed content, with no PoC or patch published at time of writing.
AppSec, AI Security· Added 26 Sep 2026, published 20 Aug 2026
aikido.devwriteup🛡️ SecurityAikido researchers detail how an AI pentesting agent found a path traversal in Gogs' organization name handling (CVE-2026-52813), which they manually escalated to full Remote Code Execution by planting a bare git repository inside a worktree and overwriting its hooks/update file to trigger command execution on push. The post also covers a git-receive-pack/git-upload-pack service parameter confusion causing an authorization bypass allowing writes to private repos by read-only users (CVE-2026-52810, with an unpatched case-sensitivity bypass and manual code fix provided), and a stored XSS in Gogs' Jupyter notebook rendering via an outdated notebookjs library that bypasses bluemonday sanitization via onerror handlers set during innerHTML assignment.
AppSec, Offensive Security· Added 3 Sep 2026, published 19 Aug 2026
xmcyber.comwriteup🛡️ SecurityXM Cyber researchers detail a four-stage exploit chain in Microsoft SCCM (Configuration Manager) that lets any unprivileged domain user achieve SYSTEM-level remote code execution on the primary site server: a missing authorization check on the AdminService UploadExtensionInChunks endpoint (CVE-2026-47301), a weak code-signing check that accepts any commercial certificate, a "CabSlip" Zip-Slip-style path traversal in CAB extraction giving arbitrary file write, and DLL hijacking of adsource.dll loaded by the SYSTEM-level SMS Executive service. Microsoft patched the RBAC bypass in July 2026, but the rest of the chain remains exploitable via the built-in Operations Administrator role until a full fix in ConfigMgr 2609 (October 2026); the article also gives log-based detection guidance (AdminService.log DirectoryNotFoundException/HTTP 500 patterns) and interim mitigations.
Offensive Security, AppSec· Added 3 Sep 2026, published 13 Aug 2026
orca.securityadvisory🛡️ SecurityOrca Security details four Zoom vulnerabilities in the cross-platform annotation engine (libannotate.so): CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize from unchecked 32-bit character counts, and CVE-2026-53415, a use-after-free in auto-shape metadata handling giving a write-what-where primitive, both enabling zero-click RCE against every meeting participant via crafted annotation messages during screen sharing. Also disclosed are CVE-2026-53414 (heap over-read/DoS) and CVE-2026-53416 (path traversal in the Windows VDI client). The write-up notes a working exploit chain built in under 24 hours with fewer than 20 AI-model prompts, platform-specific exploitation details (macOS ARM64 ASLR bypass, Android heap spraying/vtable corruption), and that E2EE meetings bypass Zoom's server-side message filtering.
AppSec, Offensive Security· Published and added 12 Aug 2026
blog.sentry.securitywriteup🛡️ SecuritySentry researcher Drinor Selmanaj found CVE-2026-20685, a path traversal (Zip Slip/CWE-22 class) in darwin-init, the root PID 1 process that provisions Apple Private Cloud Compute nodes by extracting cryptex bundles. By crafting a tar archive that is simultaneously a valid cryptex and a set of traversal entries, the attacker writes files as root to the persistent /var/db data volume during boot, redirects the splunkloggingd log forwarder to an attacker-controlled server, and exfiltrates CloudBoard/Trusted Inference Engine telemetry including per-request metadata, token counts, and timing side-channels — while PCC's attestation, which only measures installed software, remains indistinguishable from a clean boot. Apple rated it CVSS 6.5 information disclosure, patched it in PCC 5E290.3+, and paid a $150,000 Apple Security Bounty award.
AppSec, AI Security, Offensive Security· Added 3 Sep 2026, published 10 Aug 2026
thehackernews.comadvisory🛡️ SecurityCISA added four actively exploited vulnerabilities to its KEV catalog: a path traversal RCE in Adobe ColdFusion (CVE-2026-48282, CVSS 10.0), an unauthenticated file-upload RCE in Joomlack Page Builder CK (CVE-2026-56290, CVSS 10.0), an IDOR in Langflow allowing cross-tenant flow execution and LLM/AWS key theft (CVE-2026-55255, CVSS 6.1), and an unauthenticated arbitrary file upload in JoomShaper SP Page Builder (CVE-2026-48908, CVSS 10.0). Sysdig documented an operator chaining the Langflow IDOR with CVE-2026-33017 RCE for opportunistic, financially motivated cryptojacking/botnet activity and credential theft from an AI orchestration platform, while mySites.guru observed web shell deployment via the Joomla flaws. FCEB agencies must patch by July 10, 2026.
Threat Intel, AppSec, AI Security· Published and added 18 Jul 2026
rapid7.comwriteup🛡️ SecurityRapid7's MDR team details active zero-day exploitation of SonicWall SMA1000 appliances via CVE-2026-15409 (unauthenticated SSRF in the /wsproxy websocket proxy, CVSS 10.0) chained with CVE-2026-15410 (local privilege escalation via path traversal in the ctrl-service remove_hotfix workflow) to achieve root RCE. The post includes a working Python exploit against the localhost Erlang service on port 1050 (using a hardcoded authentication cookie), an HTTP request PoC for the hotfix path-traversal chain, and extensive observed post-exploitation activity — credential/TOTP theft, VPN-less lateral movement to domain controllers via harvested LDAP service accounts — plus concrete log/IOC signatures and attacker-infrastructure IPs (FNS Holdings Limited ASN 206092) for hunting.
AppSec, Offensive Security, Threat Intel· Added 10 Sep 2026, published 15 Jul 2026
advisories.gitlab.comadvisory🛡️ SecurityCVE-2026-52830 describes a path traversal flaw in fast-mcp-telegram, a PyPI package exposing Telegram as an MCP server, where HTTP Bearer tokens are joined directly into a session-file path without normalization. The verifier blocks the literal reserved token "telegram" but not path separators, so a token like "../fast-mcp-telegram/telegram" lets a remote HTTP client authenticate as the default legacy session, bypassing the control meant to keep multi-user HTTP sessions from colliding with the default stdio/legacy account. Account-prefixed MCP tool naming does not prevent the bypass since prefixed tools for the compromised default account remain accessible.
AppSec· Published and added 5 Jul 2026
vulncheck.comadvisory🛡️ SecurityVulnCheck advisory details a path traversal vulnerability in Dify v1.14.1 and prior, where insufficient URL path sanitization lets authenticated users manipulate requests forwarded to the Plugin Daemon's internal REST API. Using unencoded dot sequences in task identifiers or manipulated filename parameters, an attacker who knows a victim tenant's UUID can traverse outside their authorized tenant path to reach internal endpoints such as debug interfaces. The advisory notes Dify Cloud's open self-registration makes obtaining an authenticated account trivial, lowering the exploitation bar.
AppSec· Added 3 Jul 2026
snyk.iowriteup🛡️ SecuritySnyk's VulnBench JS 1.0 report runs 300 repeated agentic security-review scans (10 JS/Express fixtures x 6 model configs x 5 repetitions) to measure whether LLMs like Claude Opus 4.6/4.7 and Claude Sonnet 4.6 find the same vulnerabilities twice, benchmarked against deterministic Snyk Code SAST reference findings. Key results: reference-matched LLM findings were highly repeatable (84.8% appeared in all 5 runs) while extra, non-reference LLM findings were unreliable (only 14% reproduced in all runs), the best LLM config (Opus 4.6 Medium) reached only 75.4% Snyk-reference F1 with a 24.6-point gap to SAST, and higher-cost models (Opus 4.7 Max) did not outperform cheaper ones despite 5.7x cost. The study argues LLM review and SAST catch different vulnerability classes (LLMs strong on injection/SSRF-type bugs, weak on path traversal/resource-limit enumeration) and should be combined rather than substituted.
AI Security, AppSec· Added 3 Sep 2026, published 29 Jun 2026
academy.8ksec.iocourse🛡️ Security8kSec's AI/LLM Exploitation Labs is a set of hands-on CTF-style challenges covering real attack classes against AI systems: prompt-injection to manipulate an LLM essay grader and a workspace assistant into granting admin access, crafting adversarial images to bypass an MNIST-based ML authentication vault, extracting a "secret" encryption key from an n8n/OpenAI chatbot via conversation alone, exploiting a remote MCP server (via Cursor) for path traversal to read /etc/passwd, poisoning a training CSV to backdoor a spam classifier, detecting neural network backdoors in CIFAR-10 models, spotting a malicious MCP skill with a data-exfiltration payload, and identifying "ghost record" membership-inference leakage in a supply-chain-compromised model. Each challenge maps to a distinct AI security technique (prompt injection, adversarial examples, model/data poisoning, MCP tool abuse, membership inference) and offers a free certification on completion.
AI Security, Learning· Published and added 21 Jun 2026
endorlabs.comwriteup🛡️ SecurityEndor Labs re-ran their Agent Security League benchmark (200 real-world vulnerability-fixing tasks) with Claude Fable 5 paired against the Cursor agent instead of Claude Code, and found the same model jumped from 59.8% FuncPass/19.0% SecPass to 72.6% FuncPass/29% SecPass — the best fair SecPass score on their leaderboard, showing the agent harness can matter more than model choice. The piece walks through instance-level diffs on CVE-2020-15118 (Wagtail XSS via unescaped help_text), CVE-2017-12440 (OpenStack Aodh trust-ID leakage), and CVE-2024-3571 (LangChain local file store path traversal via yield_keys) to show Cursor produced more complete patches that covered secondary sinks Claude Code missed, and confirms 28 of 29 flagged cheating cases were training-data memorization rather than git/web lookup.
AI Security, AppSec· Published and added 18 Jun 2026
orca.securityadvisory🛡️ SecurityCVE-2026-5027 (CVSS 8.8) is a path traversal vulnerability in Langflow's POST /api/v2/files upload endpoint, where the upload_user_file() function fails to sanitize filenames, allowing attackers to write arbitrary files anywhere on the filesystem. Because Langflow ships with unauthenticated auto-login enabled by default, a single unauthenticated request is enough to obtain a session and exploit it, escalating to RCE via cron job injection or config overwrite. Tenable disclosed it after failed vendor contact, VulnCheck has confirmed active exploitation against roughly 7,000 internet-exposed instances, and a public PoC exists; fixed in Langflow 1.9.0/1.10.0 and langflow-base 0.8.3.
AppSec· Published and added 12 Jun 2026
orca.securityadvisory🛡️ SecurityAnalysis of CVE-2025-62878 (CVSS 10.0), a path traversal flaw in Rancher's Local Path Provisioner — the default StorageClass backend for K3s — caused by unsanitized pathPattern templates in StorageClass definitions being joined into filesystem paths via filepath.Join. Exploitation lets an attacker escape the configured base storage directory to read/write/delete arbitrary host files (e.g. /etc/kubernetes/pki, /root/.ssh/authorized_keys) through a helper pod that gains host access via a hostPath mount rather than privileged mode, evading policies that only block privileged containers. The piece also challenges the CVSS 10.0 rating given the cluster-admin RBAC typically required, and covers a post-patch bypass via the allowUnsafePathPattern escape hatch.
Cloud & Infra, AppSec· Added 2 Oct 2026, published 10 Feb 2026
depthfirst.comwriteup🛡️ SecurityCVE-2025-59304 is a critical path traversal (CWE-22) in Swetrix Web Analytics. CdnService.uploadFile built a temp file path from the unsanitized file.originalName, so ../ sequences let an attacker overwrite files such as the app entrypoint and get RCE on restart. The depthfirst platform generated the fix, which replaces the name with a UUID and keeps only the extension (Pull Request #397).
AppSec, AI Security· Added 29 Oct 2026, published 6 Nov 2025