123 results for “REA”

CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP handshake, rated CVSS 3.1 9.8 and reachable by a remote unauthenticated peer on kernels back to 4.4. The post lists fixed stable releases (October 2026) and distribution patch status as of 31 October 2026, plus kernel and MPTCP listener checks. It gives interim nftables and iptables rules that drop IPv4 packets carrying options, and notes Anthropic's claim that Claude wrote a working exploit.

atlasum.netadvisoryAdded 1 Nov 2026, published 31 Oct 2026🛡️ Security

Unit 42 threat brief on PHP2Shell, two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2), both caused by longjmp() error handling that leaves memory uninitialized or freed. Cortex Xpanse counted over 22.6 million exposed instances. The 29 October 2026 update says attackers chained PHP2Shell with a Linux kernel privilege escalation against internet-exposed PAN-OS management interfaces. An earlier 23 October claim of post-compromise activity was retracted on 25 October.

unit42.paloaltonetworks.comadvisoryAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

CVE-2026-98432 is a Linux kernel use-after-free in the IPv4 TCP stack, tracked by Ubuntu (published 15 October 2026, updated 29 October 2026). ireq_opt/inet_opt were freed with plain kfree() while another CPU built a SYNACK under RCU, so ip_options_build() read freed memory; the fix uses kfree_rcu(). Ubuntu rates it High priority, CVSS v3.1 9.8 and v4.0 8.3. The page text does not list per-release package status.

ubuntu.comadvisoryAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

CVE-2026-101767 is a CVSS 9.8 unauthenticated SQL injection in Oracle E-Business Suite's Application Object Library, reachable through the /OA_HTML/AppsTCFServer servlet (GanttDataServer) and chainable to OS command execution. It affects versions 12.2.3 to 12.2.15 and was fixed in the October 2026 Critical Patch Update. Horizon3.ai found it, and Defused saw probing on honeypots on 27 October 2026. Interim mitigation is removing the servlet from the URL firewall allowlist.

orca.securityadvisoryPublished and added 28 Oct 2026🛡️ Security

CVE-2026-111497 is a high-severity out-of-bounds write in the Node.js Brotli decoder, reported by Orca Security. It affects all supported release lines (22.x, 24.x, 26.x) and can be triggered by malformed Brotli data processed through node:zlib or fetch(). Impacts named are crashes, memory disclosure and remote code execution in cloud workloads; patching is advised. The fetched text covers only the executive summary.

orca.securityadvisoryPublished and added 27 Oct 2026🛡️ Security

CVE-2026-115905 is a ZIP cloaking flaw in the Rust zip crate (zip-rs/zip2), rated CVSS v4.0 10.0 and affecting versions below 9.0.5. ZipArchive reads central-directory metadata while ZipStreamReader reads local headers, so a crafted archive can pass filename inspection and then overwrite a different file during streaming extraction. Version 9.0.5 adds consistency checks, but ZipStreamReader::new leaves them off by default, and extraction is not atomic, so files can be written before an error is raised. The post covers CWE-20 and CWE-436, KEV and EPSS status, Debian status and a six-step investigation trail.

x.comadvisoryAdded 29 Oct 2026, published 27 Oct 2026🛡️ Security

CVE-2026-111497 (Broccoli2Shell, also Node2Shell and HTTP2Shell) is an out-of-bounds write in the upstream Brotli C decoder. It affects Node.js, Bun, Envoy Proxy, Istio and Python packages, and can lead to memory corruption, information disclosure, crashes or RCE when untrusted Brotli data is decompressed. Wiz reports 91% of cloud environments have vulnerable resources. The post lists patching, inventory, rebuild and temporary mitigation steps.

wiz.ioadvisoryPublished and added 25 Oct 2026🛡️ Security

Railway's preliminary report on a security incident between 20 and 22 October 2026, in which an attacker reached internal systems and decrypted stored environment variables. At most 1.85% of workspaces (about 100,000) were confirmed affected. The attacker was after AI provider API keys for distillation. Railway notified vendors such as GitHub and Anthropic, rolled all keys, moved to single-tenant builders and advised customers to rotate secrets. Exploit details are withheld.

blog.railway.comadvisoryAdded 24 Oct 2026, published 23 Oct 2026🛡️ Security

GHSA-9v8h-qqgm-4m35 is a critical buffer overflow (CVSS v4 9.2) in the Google Brotli decoder (c/dec/decode.c), affecting versions 1.0.3 through 1.2.0 on all platforms. A crafted compressed stream lets an unauthenticated remote attacker corrupt adjacent decoder state, leak memory, crash the process, or possibly execute code. Fixed in 1.0.10, 1.1.1 and 1.2.1. The page does not mention curl or Git, despite the title.

github.comadvisoryAdded 25 Oct 2026, published 23 Oct 2026🛡️ Security

ENISA Technical Advisory for Software Bill of Materials (October 2026, TLP:CLEAR) is non-mandatory guidance for organisations, especially SMEs, starting SBOM adoption. It covers SBOM data models (CycloneDX, SPDX), a mapping of BSI TR-03183-2 fields to CISA minimum elements, lifecycle and CI/CD integration, an SBOM threat model, and security recommendations. It supports Cyber Resilience Act obligations but is not a legal interpretation.

enisa.europa.euadvisoryAdded 23 Oct 2026🛡️ Security

ENISA Technical Advisory for Software Bill of Materials is practical guidance on SBOM adoption for organizations, especially micro, small and medium enterprises and open-source stewards. It sets out an SBOM implementation architecture and data flows across a defined lifecycle, an indicative SBOM threat model with targeted risks, and measures for the SBOM ecosystem. It aligns with the ENISA Secure by Design and Default Playbook and supports Cyber Resilience Act compliance.

enisa.europa.euadvisoryAdded 23 Oct 2026🛡️ Security

CVE-2026-114625 is a critical (CVSS 3.1 9.9) SQL injection in on-prem Arista VeloCloud Orchestrator, the SD-WAN management portal, covered in Arista Security Advisory 0199 of 22 October 2026. Any authenticated user, even the lowest Enterprise Read Only tenant role, can become a local superuser operator, and Arista says it is exploited in the wild. On-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12; two attacker IPs are listed.

x.comadvisoryAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

CyberForge CVE of the Day #084 analyses CVE-2026-76466, a CVSS 9.8 flaw in clustered Cisco Expressway-C and Expressway-E. Persistent database cookies and weak client-certificate validation allow root OS command execution over the network. The fix is X15.5.20 (X14 and earlier must migrate), with no workaround. It adds a per-peer SOC investigation trail, reachability checks and exposure status from CISA SSVC, KEV and EPSS.

x.comadvisoryAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Solidity advisory on a Yul optimizer bug in the KnowledgeBase, present in versions 0.8.19 to 0.8.37 and fixed in 0.8.38. Stale cached address offsets let LoadResolver and EqualStoreEliminator treat coinciding memory or storage slots as distinct, so loads return outdated values or needed stores are dropped. It includes a pure-Solidity reproducer for --via-ir, a Sourcify scan with no differing bytecode, and checks for deployed contracts. Rated low severity.

soliditylang.orgadvisoryPublished and added 22 Oct 2026🛡️ Security

Railway's security disclosure of 21 October 2026 says an unauthorized third party may have accessed encrypted customer environment variables and decrypted some of them. Railway links it to a series of attacks on platform companies aimed at compromising AI inference providers, and has asked upstream providers to revoke keys. It tells all users to roll every environment variable, API key and registry credential, and it paused all deployments. The notice gives no technical details of the intrusion.

blog.railway.comadvisoryAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

AWS bulletin 2026-143-AWS covers CVE-2026-109618 and CVE-2026-109619, critical PHP web runtime flaws that let an unauthenticated remote caller run code, read process data or cause denial of service. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 5.4 to 8.1 get no fix. It gives status for WorkMail, Elastic Beanstalk, Amazon Linux and Lightsail, plus AWS WAF rules, including a custom "PHP2Shell" rule matching PHP_SESSION_UPLOAD_PROGRESS and PHPSESSID.

aws.amazon.comadvisoryAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

PHP 8.2.35 is a security release of the PHP 8.2 branch that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The notes say no complete mitigations exist and updating is the only safe choice. PHP 8.2 reaches end of life on 31 December 2026, after which it gets no security fixes.

github.comadvisoryAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

PHP2SHELL is Aikido Security's advance notice of two critical remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, with all versions treated as affected. The PHP security team will release fixes at 14:00 UTC on 21 October 2026, a day early after details leaked on 20 October. The post withholds exploitation details and workarounds.

aikido.devadvisoryPublished and added 21 Oct 2026🛡️ Security

Unit 42 threat brief on active exploitation of CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass added to CISA KEV on May 13, 2026. It lists IP addresses, host IDs and PoC-derived client values to hunt in GlobalProtect logs. The October 2026 updates cover Qilin and Inc ransomware operators, MFA bypass, pivots to vCenter and ESXi with offline VMDK credential dumping, and management interface exposure on ports 4443 and 3879.

unit42.paloaltonetworks.comadvisoryAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

CVE-2026-77932 affects DB-GPT through 0.8.2 (dbgpt-app). The /api/v1/chat/react-agent route accepts unauthenticated requests because get_user_from_headers returns an admin-role user, and the ReAct agent can reach unsandboxed Python and shell tools. Lasso reported root in the webserver container in a lab. The post gives CVSS 9.8 and 9.3, no verified fix (0.8.2 is still the latest release), no KEV match, no EPSS data, and a SOC hunting trail.

x.comadvisoryAdded 23 Oct 2026, published 20 Oct 2026🛡️ Security

CyberForge CVE of the Day #080 covers CVE-2026-99999 ("PwnEscape"), a Linux kernel IPv4 checksum-completion flaw. Crafted checksum metadata can trigger a deferred write into an already-validated IPv4 header, which allows host memory disclosure from a guest or microVM over virtio-net and TAP. It gives upstream fixed branches (5.10.272 to 7.2.11), Amazon Linux, Red Hat and Ubuntu status, CVSS 9.3, EPSS 0.211% and a SOC investigation trail. No IOCs were verified.

x.comadvisoryAdded 19 Oct 2026, published 17 Oct 2026🛡️ Security

ConnectWise Cloud Backup (formerly SkyKick Backup, AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) had its multitenant OAuth app compromised, per Microsoft Threat Intelligence. On 15 October 2026 the actor authenticated broadly as the service principal from 144.172.64[.]128, likely using customer-granted permissions such as Directory.ReadWrite.All, then ran Graph API reconnaissance and tried to add credentials to the service principal as a backdoor. The post lists IOCs, Defender alerts and hunting advice.

x.comadvisoryAdded 20 Oct 2026, published 17 Oct 2026🛡️ Security

S2W post on CVE-2026-97229, a CVSS 10.0 remote code execution flaw in the GitLab CE/EE CI/CD regex compiler, disclosed October 13, 2026. Insufficient regex validation plus an integer overflow during encoding conversion lets an attacker who can add CI/CD config use a malicious regex and a UTF-8 repository path to run commands as the git user. Affects self-managed 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Rapid7 published analysis and a public PoC exists, with no in-the-wild exploitation confirmed as of October 15. No workaround exists, so patch or restrict access to a management network or VPN.

x.comadvisoryAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Summary of Vercel's Oct 14, 2026 out-of-band Next.js security release fixing two critical unauthenticated RCEs: one in App Router apps with Cache Components where a "use cache" function returns multiple typed arrays (GHSA-673q-mjm6-r5xr, upstream React GHSA-xqc2-xf4c-x3h3, no workaround), and one in the Image Optimization API handling SVG on glibc Linux via a memory bug in a library used through sharp (CVE-2026-96889 / GHSA-2464-fhr4-w9xw, workaround sharp 0.35.5+). Also covers a high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r). Fixes ship in two supported Next.js LTS lines. No in-the-wild exploitation reported.

x.comadvisoryAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Daily CVE digest on CVE-2026-76519, a CVSS 9.8 relative path traversal (CWE-23) in Cisco Secure Email Gateway's AMP File Reputation attachment processing. A crafted attachment gives unauthenticated arbitrary file writes and root command execution, and Cisco PSIRT reports active exploitation. The CVE is in CISA KEV. It lists the applicability conditions (File Reputation assigned to a policy and Content Scanner Tools earlier than 25.3.0.5525) and the fixes (scanner 25.3.0.5525, AsyncOS 15.5.5-014 and 16.5.0-780). It also covers evidence preservation, reading Cisco's System Security scan outcomes, mail/AMP log correlation, and deployment-specific recovery including cluster-key exposure.

x.comadvisoryAdded 18 Oct 2026, published 15 Oct 2026🛡️ Security

Orca Security analysis of CVE-2026-97229, a CVSS 10.0 flaw in GitLab CE/EE. An integer overflow (CWE-190) in the CI/CD regular expression compiler gives memory corruption and code execution as the git user. It is triggered by a crafted regex in .gitlab-ci.yml combined with a UTF-8 repository path, with no authentication needed on instances that allow public project creation or self-registration. Lists affected branches (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2), the absence of a workaround, interim mitigations, and a Rapid7 PoC against GitLab CE 19.4.1 with ASLR on. Notes a prior max-severity GitLab bug (CVE-2026-85706) was probed in the wild within hours and later added to CISA KEV.

orca.securityadvisoryPublished and added 14 Oct 2026🛡️ Security

Alert thread on CVE-2026-35029 (CVSS v4.0 8.7) in LiteLLM Proxy, versions before 1.83.0. A low-privilege authenticated user can bypass admin authorization on /config/update, change runtime settings, read server files, take over admin credentials and run Python through remotely loaded modules (S3/GCS-hosted). Check Point Research published a full execution chain on October 13 after the April 2026 disclosure. The post lists hunting pointers (non-admin POSTs to /config/update, env-var changes, unexpected pass-through endpoints, cloud module loading) and advises upgrading to 1.83.9 or later and rotating credentials.

x.comadvisoryPublished and added 13 Oct 2026🛡️ Security

Rootshell Security Bulletin #22 (Aug 1998) reports an ICQ authentication flaw found by a Linux ICQ clone developer. The Mirabilis server stores 8-character passwords, and sending a password of 9 or more characters (e.g. "123456789") overflows the buffer and logs the client in as any UIN not already online. This gives full account takeover, including receiving offline messages. It is not spoofing, and it works with unofficial clients such as zicq, since the official client enforces the length limit client-side.

opennet.ruadvisoryAdded 17 Oct 2026, published 13 Oct 2026🛡️ Security

Official changelog for the Model Context Protocol 2026-07-28 specification. Major changes: protocol-level sessions and the initialize handshake are removed to make MCP stateless, with version and capabilities carried in _meta on every request, plus a new server/discover RPC and subscriptions/listen replacing the GET stream and resource subscribe calls. It introduces Multi Round-Trip Requests (InputRequiredResult) in place of server-initiated sampling, roots and elicitation requests, moves tasks into an extension, and deprecates Roots, Sampling, Logging, HTTP+SSE and Dynamic Client Registration. Minor changes add cache hints (ttlMs/cacheScope), new Mcp-Method/Mcp-Name headers, OpenTelemetry trace context, RFC 9207 iss validation and an error-code allocation policy.

modelcontextprotocol.ioadvisoryAdded 10 Oct 2026🧠 AI

Joint FBI/CISA/NSA and allied-agency advisory on China-linked actors enabled by Integrity Technology Group (overlapping with Flax Typhoon, Ethereal Panda, Red Juliett). It details their TTPs: open-source scanners and the MicroScan exploit-script app, an XSS credential-harvesting payload dropping live700_v1.exe, EBurst password spraying against Exchange/O365, SoftEther VPN persistence, DCSync via DC.exe, and email theft via the Curlc4.txt PHP bot and the office-cli utility. It also provides IOCs, MITRE ATT&CK mappings, CVEs, incident response steps, and mitigations.

cisa.govadvisoryAdded 9 Oct 2026🛡️ Security

Alert summarizing Socket Threat Research's disclosure that a malicious version of the Tensorlake npm SDK (an AI-agent infrastructure package) was published with a preinstall hook delivering Shai-Hulud/ChainDrop credential-stealing malware. The payload targets GitHub, npm, AWS, Kubernetes and Vault credentials, persists via a gh-token-monitor mechanism, and spreads through compromised publishing accounts. It lists IOCs (lib/setup.mjs, lib/Math_Symbol.js) and warns to remove the persistence before revoking stolen GitHub tokens, since revocation triggers a destructive routine. Socket detected the release about 11 minutes after publication.

x.comadvisoryAdded 11 Oct 2026, published 9 Oct 2026🛡️ Security

Security-focused release notes for go-ethereum (Geth) v1.17.8, patching several denial-of-service vulnerabilities in the eth/snap p2p protocol handlers, hardening JUMPDEST analysis caching against post-Amsterdam-fork attacks, requiring IP verification before accepting discovery statements, fixing a rogue-STUN-server crash, and closing a DoS vector tied to BAL accounts. Most issues only become exploitable after the Amsterdam fork activates, and the release also includes RPC correctness fixes (eth_simulateV1, eth_createAccessList) and a Sparse Blobpool (EIP-8070) correctness bug.

github.comadvisoryAdded 8 Oct 2026🛡️ Security

Cisco Talos discloses eight vulnerabilities patched by vendors: a Photoshop installer privilege escalation (CVE-2026-48388), a macOS CoreWLAN information disclosure bug, two Foxit Reader flaws including a JavaScript CBF_Widget remote code execution (CVE-2026-57256) and an Array use-after-free (CVE-2026-91799), and four Windows kernel-driver bugs — NETIO.sys information disclosure (CVE-2026-50475), two Cloud Files Mini Filter Driver issues (use-after-free CVE-2026-58613 and type confusion CVE-2026-80093), and a tcpip.sys out-of-bounds read (CVE-2026-49177). Each advisory gives the affected version and trigger mechanism, and Talos notes Snort coverage is available for detection.

blog.talosintelligence.comadvisoryPublished and added 7 Oct 2026🛡️ Security

Orca Security details CVE-2026-21589 (CVSS 9.3), a critical unauthenticated path traversal flaw affecting all versions of eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Insufficient path validation lets remote attackers read arbitrary files within the web application root without authentication, and in Crowd SSO deployments this can expose plaintext credentials usable to create administrative accounts and take over the entire Atlassian ecosystem. The advisory lists fixed versions for each product and recommends WAF rules and log review for organizations unable to patch immediately.

orca.securityadvisoryPublished and added 7 Oct 2026🛡️ Security

Atlassian patched CVE-2026-21589 (CVSS 9.3), an unauthenticated arbitrary file access flaw affecting all versions of Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center. WatchTowr researcher Yordan Ganchev notes that organizations using Crowd for SSO are especially at risk because authentication details are stored in plaintext at a predictable path, letting attackers mint admin accounts if Crowd endpoints are internet-reachable. Fixed versions are listed for each product; Atlassian recommends immediate patching or disconnecting internet-facing instances, with WAF rules as a stopgap.

securityweek.comadvisoryPublished and added 7 Oct 2026🛡️ Security

OpenAI's system card accompanying the October 2026 ChatGPT rollout of GPT-6 Sol and GPT-6 Luna, replacing GPT-5.6 Sol and Luna for free and paid users (Codex and ChatGPT Work retain the September versions). It details Preparedness Framework results (High capability in Cybersecurity and Biological/Chemical domains, below High in AI Self-Improvement), multiturn jailbreak and GPT-Red prompt-injection robustness, alignment evaluations on respecting Auto-review/warnings and deceptive disclosure, hallucination rates, and health/mental-health benchmarks (HealthBench, HealthBench Professional, MentalHealthBench), alongside some noted regressions in self-harm, sexual content, gore and teen (U18) safety categories.

deploymentsafety.openai.comadvisoryPublished and added 7 Oct 2026🧠 AI

CVE-2026-21589 is an unauthenticated arbitrary file read (path traversal) in eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Atlassian fixed it on 5 October 2026, and CISA added it to the KEV catalog on 15 October 2026. The page lists patching, WAF regex, Tomcat RewriteValve and urlrewrite.xml mitigations, and a log check for ".." sequences after up to two rounds of URL decoding.

watchtowr.comadvisoryAdded 30 Oct 2026, published 6 Oct 2026🛡️ Security

CVE-2026-21589 is an unauthenticated arbitrary file read in eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye Data Center. Attackers must know the exact file path, and watchTowr Intel observed exploitation by 6 October 2026. The FAQ covers the timeline (Atlassian advisory 5 October 2026), upgrade and WAF mitigations, and log searches for two dots next to a slash, backslash or double colon.

watchtowr.comadvisoryAdded 30 Oct 2026, published 6 Oct 2026🛡️ Security

Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) unauthenticated path traversal flaw allowing remote attackers to read specific files within the web application root across its self-managed Data Center/Server products — Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Fixed versions are listed for each product (e.g. Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19), and Atlassian Cloud is already patched; WAF/URL-rewrite mitigations are available for those who can't upgrade immediately. The post's analyst note clarifies exploitation requires knowing the exact target file path (no directory listing), and as of Oct 5, 2026 it is not yet in CISA KEV with no public exploit reported.

x.comadvisoryAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

Denmark's CPR administration (Det Centrale Personregister) disclosed that unauthorized actors abused a Danish company's legitimate, authorized access to the CPR system to extract names, addresses and CPR (national ID) numbers for roughly 8.8 million registered citizens. Records of individuals with name/address protection were not exposed. CPR has revoked the company's access, notified the Danish Data Protection Agency (Datatilsynet), and the incident is being investigated by police alongside relevant authorities.

cpr.dkadvisoryPublished and added 5 Oct 2026🛡️ Security

Release notes for v2.2.0 of the official Model Context Protocol TypeScript SDK. Upgrade notes: machine-to-machine OAuth providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider) should now be given expectedIssuer, and fetchToken() throws AuthorizationServerMismatchError when client information is bound to a different authorization server. listTools/listPrompts/listResources/listResourceTemplates now follow nextCursor automatically, capped by listMaxPages. Fixes include CommonJS type-checking of the DPoP jose types, unhandled rejections in Client.listen(), createMcpHandler stack overflow and subscriptions/listen handling, .localhost loopback for OAuth token endpoints, and v1-to-v2 codemod comment preservation.

github.comadvisoryAdded 1 Oct 2026🧠 AI

Unit 42 threat brief on CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) in NetScaler ADC and Gateway, both CVSS v4.0 9.5 and exploited as zero-days from August 2026. It details version fingerprinting, .deb and PHP web shells, a three-stage log-poisoning chain through ns_monuploadd_err.pl, httpd.conf persistence, IOCs, and 50,277 exposed instances as of 27 September 2026.

unit42.paloaltonetworks.comadvisoryAdded 30 Oct 2026, published 30 Sep 2026🛡️ Security

OpenAI's system card addendum for GPT-6.1 Sol, a fast and affordable model in the GPT-6 family with capabilities comparable to GPT-6 Astra, reports Preparedness Framework determinations (Critical cybersecurity, High biological and chemical capability, sub-High AI self-improvement) and the same safeguards stack as Astra. It details extensive safety and alignment evaluations including safe-completion benchmarks, jailbreak and prompt-injection robustness, HealthBench and MentalHealthBench scores, deceptive-behavior and monitor-evasion tests, and chain-of-thought monitorability and controllability results, comparing GPT-6.1 Sol against GPT-6 Astra, GPT-6 Sol, GPT-6 Luna, and the GPT-5.6 series.

deploymentsafety.openai.comadvisoryAdded 7 Oct 2026, published 29 Sep 2026🧠 AI

CVE-2026-87902 (CVSS 9.2) is an unauthenticated WordPress vulnerability where get_page_template() page-template resolution can be tricked into including an attacker-chosen local .php file outside the active theme directory, leading to RCE when a theme has a page-* top-level directory and a readable local PHP file (e.g. pearcmd.php) exists. Attackers began exploiting it within hours of the September 22, 2026 patch, including pearcmd.php to write PHP web shells to /tmp and /var/tmp and pulling a GitHub-hosted uploader payload, per honeypot telemetry from Previdian and Patchstack with tracked source IPs. CISA added the flaw to its KEV catalog on September 25, 2026, mandating FCEB remediation by September 28; fixed in WordPress 7.1.2, 7.0.6, 6.9.9, and 6.8.10.

thehackernews.comadvisoryAdded 26 Sep 2026🛡️ Security

VulDB entry for CVE-2026-90617, a remote OS command injection (CWE-78) in GH05TCREW PentestAgent. The flaw is in run_task in interface/main.py of the MCP HTTP Server, affects everything up to commit cf882dab, and has a public exploit. The product uses rolling releases, so no version ranges exist, and the fix is an unmerged pull request. The analysis suggests compensating controls: restrict network access to the MCP server, run with least privilege, and validate input upstream.

vuldb.comadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-85787 affects awslabs postgres-mcp-server before 1.1.7. The SQL validation component uses an incomplete list of disallowed inputs. Crafted SQL placed in content submitted while an authenticated user interacts with the MCP server can bypass the read-only restriction and modify data in PostgreSQL. The fix is to upgrade to 1.1.7 or later. VulDB's added analysis is generic: it points to SQL injection (CWE-89) and recommends least-privilege database accounts and parameterized queries.

vuldb.comadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-85661 affects excel-mcp-server 0.1.8. In stdio mode with EXCEL_FILES_PATH unset, the server does not confine file paths, so a client can pass relative or absolute paths to the read and write tools. That gives arbitrary file read and write with the privileges of the server process. The page classifies it as CWE-22 (ATT&CK T1083) and recommends canonical path checks against a base directory, making EXCEL_FILES_PATH mandatory, and running with least privilege.

vuldb.comadvisoryAdded 26 Sep 2026🛡️ Security

ServiceNow patched CVE-2025-12420, nicknamed BodySnatcher, a CVSS 9.3 flaw in its Now Assist AI Agents (sn_aia) and Virtual Agent API (sn_va_as_service) that let an unauthenticated attacker impersonate any user via just an email address. Discovered by Aaron Costello of AppOmni, the bug chains a hardcoded platform-wide secret with account-linking logic to bypass MFA and SSO, letting an attacker remotely drive privileged agentic AI workflows, impersonate admins, and create backdoor accounts. Fixed in sn_aia 5.1.18+/5.2.19+ and sn_va_as_service 3.15.2+/4.0.4+, patched October 30, 2025 with no known in-the-wild exploitation.

thehackernews.comadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-75130 describes a prompt injection flaw in Context7 (through v2.1.2), an MCP server that serves library documentation to AI coding agents. The vulnerability lies in the Custom AI Instructions feature, which fails to sanitize content before injecting it into agent context; attackers can poison these instructions so that a routine documentation lookup triggers the agent to exfiltrate credentials from environment files and delete files on the victim's machine. Researchers at Noma Security and VulnCheck published independent technical breakdowns of the attack chain.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-65695 is a path traversal vulnerability (CWE-22, CVSS 4.0 7.6 HIGH) in Office-Word-MCP-Server through version 1.1.11, an MCP server that exposes Word document manipulation tools to LLM agents. Attackers who can influence the filename argument can supply absolute paths or ../ sequences to document open/save operations, bypassing the check_file_writeable and ensure_docx_extension helpers (which do no base-directory confinement or realpath validation) to read or overwrite arbitrary .docx files outside the intended working directory.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-55544 describes an authorization bypass (IDOR/BOLA) in NextCRM CRM version 0.12.1, where MCP campaign tool handlers accept user-generated Bearer API tokens but query and mutate campaigns purely by object ID, ignoring the authenticated user's ownership scope. A low-privileged user with a valid MCP token can enumerate, read, modify, delete, or trigger/pause campaigns belonging to other users. Fixed in NextCRM 0.12.2.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-52869 describes a session-hijacking flaw in the MCP Python SDK (PyPI package mcp) prior to version 1.27.2: the SSE and stateful Streamable HTTP transports (mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager) route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header, without checking that the requesting principal matches the session's original authenticated bearer-token client. This lets a different authenticated client that learns or guesses a valid session ID inject JSON-RPC messages into another user's MCP session. CVSS 3.1 base score 7.1 (High); fixed in mcp 1.27.2.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-49291 affects mcp-memory-service prior to version 10.65.3: its HTTP MCP JSON-RPC endpoint at /mcp only enforced OAuth 'read' scope before dispatching tools/call requests, so a client holding only read access could invoke mutating tools like store_memory and delete_memory even though the equivalent REST endpoints correctly required 'write' scope. The flaw is a classic missing-authorization bug (CWE-862) surfacing specifically in an MCP tool-dispatch layer, scored CVSS 3.1 8.1 (High) with confidentiality unaffected but integrity and availability impacted. Fixed in 10.65.3.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-16498 is a critical (CVSS 3.1: 10.0) exposure-of-sensitive-information flaw (CWE-488) in HashiCorp's terraform-mcp-server prior to version 1.1.0. In stateless streamable-HTTP transport mode, one user's Terraform API token could be reused to execute tool calls on behalf of a different, subsequent user, breaking tenant isolation in shared MCP server deployments. Fixed in terraform-mcp-server 1.1.0; further detail is tracked in HashiCorp's HCSEC-2026-23 advisory.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-14748 is a low-severity (CVSS 4.0: 2.1) server-side request forgery flaw in AIAnytime's Awesome-MCP-Server, specifically in the mcp-wiki/wiki-summary component's server.py, where the url argument is not validated before the server fetches it. A remote, low-privilege attacker can abuse this to make the MCP server issue arbitrary outbound requests; the exploit has already been published via GitHub issues and the maintainer has not responded to the disclosure.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

CVE-2026-14541 describes an authentication bypass (CWE-287) in the Google OAuth provider of Google's mcp-toolbox for databases v1.4.0, an MCP server that lets LLM agents query databases. When the Google authService is configured with mcpEnabled: true but no explicit audience or clientId, the ValidateMCPAuth pipeline skips audience checks for opaque tokens, so any valid Google OAuth access token — even one issued for an unrelated app — is accepted, letting unauthorized clients reach protected tools and data backends.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

GHSA advisory for SiYuan v3.7.1 (CVE-2026-66012) describing how the kernel's POST /mcp route registers 31 MCP tools — including a file tool with full read/write/delete/rename/copy over the workspace — gated only by CheckAuth with no admin or read-only check. When the Publish server runs in anonymous mode (a documented configuration for public docs sites), the Publish reverse proxy attaches an anonymous RoleReader JWT to every proxied request, letting an unauthenticated attacker reach /mcp, exfiltrate accessAuthCode/api.token/cookieKey from conf.json, escalate to Administrator, and plant a malicious Electron plugin (nodeIntegration:true, contextIsolation:false) for RCE on the desktop client. Includes a full working PoC and remediation (CheckAdminRole gate, proxy path allowlist, restricting the file tool).

github.comadvisoryAdded 26 Sep 2026🛡️ Security

A GitHub Security Advisory (GHSA-5p9g-j988-pcwv) documents a session poisoning flaw in the Ruby MCP SDK's Streamable/SSE HTTP transport: the server never validates that a POST to /messages/{session_id} actually belongs to the caller, so an attacker who obtains a victim's session ID (e.g. via logs or network sniffing) can silently execute tool calls whose responses are delivered into the victim's own SSE stream. The advisory includes a working PoC (attacker/legitimate client scripts against the SDK's example streamable_http_server.rb), notes that csharp-sdk and go-sdk correctly bind sessions to user identity while ruby-sdk does not, and distinguishes the bug from the related "Stream Replacement" advisory (GHSA-qvqr-5cv7-wh35), which disconnects rather than poisons the victim's stream.

github.comadvisoryAdded 26 Sep 2026🛡️ Security

GHSA advisory for jovancoding/network-ai disclosing that its MCP HTTP transport (bin/mcp-server.ts, lib/mcp-transport-sse.ts) accepts JSON-RPC tools/call requests with zero authentication, session, or origin checks, and binds to 0.0.0.0 by default. The PoC shows an unauthenticated attacker can enumerate 22 registered tools and invoke privileged ones - config_get/config_set to read and mutate live orchestrator configuration, agent_list/agent_spawn/agent_stop, token_create/token_revoke, budget_set_ceiling, and blackboard_write/delete - with curl requests against a local Docker deployment. Remediation recommended enforcing bearer-token auth in _handlePost() before dispatch, defaulting to 127.0.0.1 binding, and gating state-mutating tools behind authorization checks.

github.comadvisoryAdded 26 Sep 2026🛡️ Security

GHSA-9hgc-g3w5-67cm details a DNS TOCTOU race in IBM mcp-context-forge's /admin/gateways/test endpoint: validate_gateway_test_url() resolves and vets a hostname against private/cloud-metadata IP ranges, but the actual request is made with httpx (via ResilientHttpClient), which independently re-resolves DNS at connection time with no IP pinning. An attacker with gateways.read permission can exploit DNS rebinding (short-TTL record flipping from a public IP to 169.254.169.254) to bypass SSRF protections and reach cloud instance metadata, exfiltrating IAM credentials where IMDSv1 is enabled. The advisory notes the codebase already acknowledges the gap in two comments and a tracked TODO (ICACF-15), and recommends pinning the validated IP into the connection.

github.comadvisoryAdded 26 Sep 2026🛡️ Security

Belgian CCB advisory on CVE-2026-48710 ("BadHost", CVSS 6.5), an authentication bypass in Starlette versions before 1.0.1. The Host header was not validated when request.url was rebuilt, so request.url.path could differ from the routed path. Middleware and endpoints that enforce access control on request.url could therefore be bypassed. The flaw affects FastAPI, LiteLLM, vLLM, MCP servers and other Python LLM infrastructure, and may expose stored third-party credentials. The advisory recommends upgrading to 1.0.1 or later and increasing monitoring, and links to the badhost.org scanner and to the GitHub, OSTIF, X41 D-Sec and Ars Technica write-ups.

ccb.belgium.beadvisoryAdded 26 Sep 2026🛡️ Security

AWS bulletin 2026-105-AWS discloses CVE-2026-87912 and CVE-2026-87913: the AWS Security Agent plugin (aws-agents-for-devsecops, <1.1.0) and its MCP server (<0.2.0) write scan output to a predictably-named S3 bucket (security-agent-scans-<account-id>-<region>) without verifying bucket ownership. An attacker who pre-registers that bucket name in their own account can obtain the victim's private source archive, including embedded credentials and infrastructure state. AWS recommends upgrading to 0.2.0 and manually verifying/pre-creating the scan bucket to prevent squatting.

aws.amazon.comadvisoryAdded 26 Sep 2026🛡️ Security

AWS bulletin for CVE-2026-87911, an OS command injection flaw in awslabs.postgres-mcp-server (Python, PyPI) versions before 1.1.7. The server's read-only enforcement in its SQL validation component can be bypassed with a crafted `COPY ... TO PROGRAM` statement, letting an unauthenticated actor run OS commands on a self-managed PostgreSQL host when the configured connection role holds superuser or pg_execute_server_program privileges. Fixed in 1.1.7; AWS also recommends connecting the MCP server with a least-privilege, non-superuser role as defense in depth.

aws.amazon.comadvisoryAdded 26 Sep 2026🛡️ Security

WordPress 7.1.2 patches CVE-2026-87902 (GHSA-7hp8-65ch-5whp), a critical unauthenticated path-traversal flaw where page template resolution can be manipulated to include an attacker-chosen readable local PHP file outside the active theme directory. Under certain server and active-theme preconditions this local file inclusion escalates to remote code execution. The security fix was backported to all WordPress branches back to 4.7; discovery credited to researcher Robert Ressl.

wordpress.orgadvisoryAdded 28 Sep 2026, published 22 Sep 2026🛡️ Security

Copy Fail (CVE-2026-31431) is a 9-year-old Linux kernel logic bug in algif_aead, reachable via the AF_ALG crypto API and chained through splice() into a 4-byte page-cache write to achieve local root, affecting kernels built between 2017 and the fix. The site publishes a 732-byte stdlib-only Python PoC that roots multiple distributions unmodified, identifies the fixing mainline commit a664bf3d603d, and gives interim mitigation (disable algif_aead / seccomp-block AF_ALG for untrusted workloads). The bug was found by Xint Code's AI-assisted fuzzing against the Linux crypto/ subsystem in roughly an hour of scan time.

copy.failadvisoryAdded 17 Sep 2026🛡️ Security

Rapid7's emerging threat response write-up on CVE-2026-76461, a critical (CVSS 9.8) SQL injection vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows an unauthenticated remote attacker to achieve root command execution by sending a specially crafted email. Cisco confirmed active zero-day exploitation and the vulnerability was added to CISA's KEV catalog the same day it was disclosed; the post provides mitigation guidance (emergency patching to 16.5.0-780) and a log-grep IOC (searching mail_logs for COPY.*TO PROGRAM) to detect exploitation attempts.

rapid7.comadvisoryAdded 7 Oct 2026, published 15 Sep 2026🛡️ Security

Details CVE-2026-85706 (CVSS 10.0), an unauthenticated arbitrary file read in GitLab CE/EE's repository commits API exploitable via a crafted file.path parameter in a single POST request, requiring only that one public project exist on the instance. It also covers CVE-2026-87719 (CVSS 9.9), an authenticated insecure deserialization bug in GitLab EE's GraphQL subscription serializer reachable via Duo Chat access that leaks stored Elasticsearch/OpenSearch credentials. Both affect GitLab versions through 19.3.1; CVE-2026-85706 is under active internet-wide scanning per WatchTowr Labs and is in CISA's KEV catalog with a federal patch deadline, with fixes in GitLab 19.1.8/19.2.6/19.3.2.

orca.securityadvisoryPublished and added 14 Sep 2026🛡️ Security

GitLab patched CVE-2026-85706, a critical (CVSS 10.0) path traversal flaw (CWE-22) in the repository commits API that lets an unauthenticated attacker read arbitrary files from self-managed GitLab CE/EE instances; CISA added it to the KEV catalog on September 11, 2026 due to active exploitation, with a remediation deadline of September 14. The same patch release fixes CVE-2026-87719, a critical insecure deserialization bug (CWE-502) letting an authenticated Duo Chat user exfiltrate Advanced Search configs and credentials via a crafted GraphQL subscription argument, plus 17 other vulnerabilities. Rapid7 recommends emergency patching and post-patch compromise checks given confirmed in-the-wild exploitation.

rapid7.comadvisoryAdded 7 Oct 2026, published 14 Sep 2026🛡️ Security

CVE-2026-85706 is a CVSS 10.0 critical path traversal vulnerability in GitLab CE/EE's repository commits API, caused by improper path confinement combined with missing authentication enforcement. It allows unauthenticated, remote attackers to read arbitrary files from the GitLab server — potentially exposing credentials, secrets, tokens, SSH keys, and database credentials. Affects versions 18.7 through 19.1.7, 19.2.0-19.2.5, and 19.3.0-19.3.1; fixed in 19.1.8, 19.2.6, and 19.3.2.

horizon3.aiadvisoryAdded 17 Sep 2026, published 11 Sep 2026🛡️ Security

watchTowr's rapid-reaction analysis of CVE-2026-85706, a critical (CVSS 10.0) unauthenticated path traversal in GitLab CE/EE's repository commits API, patched in versions 19.3.2, 19.2.6, and 19.1.8. The flaw lets an unauthenticated attacker read arbitrary files (configs, secrets) from self-managed GitLab servers via crafted requests to /api/v4/projects/{id}/repository/commits/ with a file.path parameter; watchTowr reproduced the bug and reports honeypot probes indicating attackers have already reverse-engineered it ahead of mass exploitation.

watchtowr.comadvisoryAdded 21 Sep 2026, published 11 Sep 2026🛡️ Security

watchTowr's rapid-reaction analysis of CVE-2026-85706, a critical (CVSS 10.0) unauthenticated path traversal vulnerability in the GitLab CE/EE repository commits API, patched in versions 19.3.2, 19.2.6, and 19.1.8. The flaw allows an unauthenticated attacker to read arbitrary server-side files via the commits API due to improper path confinement and missing auth enforcement; watchTowr's honeypot network was already observing exploitation probes at time of publication. The post includes hunting guidance (searching logs for POST requests to /api/v4/projects/{id}/repository/commits/ containing file.path parameters) and patching priorities for self-managed instances.

watchtowr.comadvisoryAdded 16 Sep 2026, published 11 Sep 2026🛡️ Security

Wiz Research documents active in-the-wild exploitation of three JFrog Artifactory vulnerabilities: CVE-2026-42018 (exposes an internal anonymous-user JWT via POST /access/api/v1/aws/token/), CVE-2026-42016 (token scope validation flaw allowing that JWT to be escalated to admin via POST /access/api/v1/tokens), and CVE-2026-82329 (unauthenticated admin access via POST /access/api/v1/registry/join, added to CISA KEV). Attackers chained the first two to create persistent admin accounts, deploy malicious Groovy plugins for RCE, and drop Rust-based C2 backdoors, while CVE-2026-82329 was exploited independently for configuration exfiltration, cluster join-key theft, and credential/SSH-key persistence. The post includes exact request sequences, detection signatures, affected/fixed version ranges, and remediation guidance.

wiz.ioadvisoryPublished and added 10 Sep 2026🛡️ Security

The Solidity team disclosed a compiler bug (fixed in Solidity 0.8.37) where the IR pipeline's stack-to-memory spill mechanism can assign the same fixed memory offset ("spill slot") to two simultaneously-live local variables when a contract's call graph contains mutual recursion, silently corrupting values without any revert or warning. The bug requires --via-ir compilation plus a narrow set of conditions (mutual recursion, >16 live locals in reachable non-recursive functions, a variable read back after the recursive call) and affects Solidity 0.7.2 through 0.8.36; a rescan of ~319,000 Sourcify-verified contracts found no affected deployments. The writeup includes full technical detail on the buggy depth-first slot allocator, an annotated PoC contract reproducing the silent overwrite, and the strongly-connected-component fix.

soliditylang.orgadvisoryAdded 29 Sep 2026, published 10 Sep 2026🛡️ Security

The Solidity team discloses a bug (reported by Cantina Security via the Ethereum Foundation bug bounty) where the IR-based (--via-ir) code generator pushed named custom-error arguments in call-site order instead of declaration order before ABI-encoding, corrupting revert data for require(condition, ErrorName({...})) calls with reordered named parameters. Introduced in Solidity 0.8.26 and fixed in 0.8.37, the bug produces silently swapped or type-confused values in decoded revert data with no compiler warning, and can cause misaligned encoding in multi-slot-argument cases that either reverts with undecodable data or produces a plausible-but-wrong payload - a real concern for standards like ERC-3668 (CCIP Read) that treat revert data as part of the contract interface. Severity was rated "very low" since the affected transaction is already reverting and there is no attacker-controlled exploitation path, but audits of via-ir contracts using named custom-error arguments should check for it.

soliditylang.orgadvisoryAdded 29 Sep 2026, published 10 Sep 2026🛡️ Security

OpenAI's system card for ChatGPT Images 2.5, powered by GPT-Image-2.5-Sunburst and GPT-Image-2.5-Flare, covering training data handling, a multi-layer image safety stack with upstream policy refusals and a downstream multimodal safety-reasoning monitor for input and output blocking, adversarial safety evaluation results versus ChatGPT Images 2.0, and Preparedness Framework capability assessments for biological and cyber risk adapted to the image modality. It also details image provenance measures including C2PA metadata conformance and Google DeepMind's SynthID watermarking.

deploymentsafety.openai.comadvisoryAdded 7 Oct 2026, published 8 Sep 2026🧠 AI

OpenAI's system card for ChatGPT Images 2.5, covering the GPT-Image-2.5-Sunburst and GPT-Image-2.5-Flare models, details a multi-layer image safety stack (upstream LLM policy refusals, a multimodal safety reasoning model for input/output blocking) built to counter heightened deepfake realism risks. It reports adversarial-prompt evaluation results against ChatGPT Images 2.0, Preparedness Framework assessments for biological and cyber capability (image-modality adaptations of existing LLM evals, neither model crossing the "High" threshold but biological-risk mitigations still applied precautionarily), and expanded provenance tooling via C2PA metadata and Google DeepMind's SynthID watermarking.

deploymentsafety.openai.comadvisoryAdded 7 Oct 2026, published 8 Sep 2026🛡️ Security

StepSecurity discovered that all 53 tags of the popular actions-cool/issues-helper GitHub Action (and all 15 tags of actions-cool/maintain-one-comment) were re-pointed to dangling imposter commits containing malicious code. The payload downloads the Bun runtime, reads Runner.Worker process memory to harvest decrypted CI/CD secrets, and exfiltrates them via HTTPS to t.m-kosche.com — meaning any workflow referencing the actions by tag (rather than a pinned commit SHA) pulls the malicious code on its next run.

stepsecurity.ioadvisoryAdded 5 Sep 2026🛡️ Security

GitHub Security Lab discloses GHSL-2026-203 / CVE-2026-84973, a same-second time-of-check-to-time-of-use race condition in the jupyterlab/maintainer-tools update-snapshots-checkout GitHub Action. The action compares one-second-precision pushed_at and comment created_at timestamps to detect post-authorization pushes, but a strict greater-than check lets an attacker push a malicious commit in the same second as an authorized "please update snapshots" comment, causing the action to check out and later execute attacker-controlled code (including a local composite action and jlpm-driven package scripts) with the workflow's GITHUB_TOKEN (contents: write, pull-requests: write) in the jupyter/notebook repository. The issue was fixed in v1.0.0 and is a variant of the "pwn request" class of GitHub Actions vulnerabilities.

securitylab.github.comadvisoryAdded 20 Sep 2026, published 4 Sep 2026🛡️ Security

Grafana patched CVE-2026-19516 (CVSS 9.1), a critical SSRF in the Grafana MCP server's grafana_api_request tool where a caller-supplied X-Grafana-URL header could control the method, path and body of outbound requests, letting an attacker reach internal-only services from the server's network position. Pillar Security researchers chained this with a second flaw — the MCP server accepting unauthenticated "session-shaped IDs" it never issued — and demonstrated using it to hit the AWS IMDSv2 endpoint and retrieve cloud credentials via a two-step PUT/TTL token request. Grafana MCP v1.1.0 adds optional bearer-token auth to close the session-forgery gap; Pillar frames MCP servers broadly as "identity brokers" that need explicit outbound destination policies and mandatory auth for remote deployments.

scworld.comadvisoryAdded 26 Sep 2026, published 3 Sep 2026🛡️ Security

OpenAI's system card for GPT-6 Astra, the first model to reach "Critical" cybersecurity capability under OpenAI's Preparedness Framework, detailing new safeguards (checkpoint encryption, universal CoT monitoring, blocking alignment evaluations) and a suite of alignment evaluations measuring metagaming, oversight gaming, honeypot exploitation (ExploitGym, tied to a Hugging Face incident), and respect for restrictions like Auto-review. It also reports comparative robustness results against GPT-5.6 Sol on static/multiturn jailbreaks, Gray Swan indirect-prompt-injection benchmarks, HealthBench/HealthBench Professional, under-18 safety evaluations, and hallucination rates, while flagging that Astra's chain-of-thought monitorability has decreased under adversarial conditions. Appendices (added later) cover related models GPT-6 Sol, GPT-6 Luna, and an agent product called "dots" built on Astra. Note: analysis is based on the first 40,000 of 222,175 characters, so later sections (deployment simulations, full appendices) are not reflected here.

deploymentsafety.openai.comadvisoryAdded 7 Oct 2026, published 3 Sep 2026🧠 AI

Pillar Security details CVE-2026-73554, a critical authentication bypass in DoltHub's remote Dolt MCP server (versions 0.3.1–0.3.6) that let unauthenticated attackers reach tool dispatch and execute database operations under the server's own credentials. The bug combined a JWT middleware missing a return statement (so a 401-rejected request kept processing) with the bundled mark3labs/mcp-go library's InsecureStatefulSessionIdManager, which accepted any attacker-forged mcp-session-<uuid> value without verifying server issuance. DoltHub confirmed and patched within a day, issuing GHSA-mgpq-fxxc-h49q; fixed in Dolt MCP 0.3.7.

pillar.securityadvisoryPublished and added 1 Sep 2026🛡️ Security

CVE-2026-81735 is a CVSS 10 unauthenticated RCE in the mcp-http-server package used by UI-TARS-desktop. The Streamable HTTP/SSE transport defaulted to binding on '::' with no authentication middleware applied by the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points, so any network client could invoke the exposed run_command tool (which pipes input straight into child_process.exec) for arbitrary command execution, or use the filesystem tool for unauthenticated arbitrary file read/write. The fix, landed in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, changes the default listen address to 127.0.0.1 without bumping the package version, so affected instances can't be identified by version number alone.

thehackerwire.comadvisoryAdded 26 Sep 2026, published 27 Aug 2026🛡️ Security

Endor Labs researchers found a critical type confusion vulnerability (GHSA-864f-rcv7-6rh4) in isolated-vm, the Node.js library used to run untrusted JavaScript inside a separate V8 Isolate. A TOCTOU bug in ExternalCopy's transferList handling — where a malicious getter returns a valid ArrayBuffer on a validating pass but an attacker-controlled value on the unchecked second pass — lets guest code escalate from a controlled-address crash to full host control-flow hijack, given only a single ivm.Reference. The bug is fixed in isolated-vm 7.0.1/6.2.0; affected downstream users include n8n, Activepieces, Mastra, Budibase, Sim.ai, Directus, and Rocket.Chat, which rely on isolated-vm to sandbox user- and model-generated code.

endorlabs.comadvisoryAdded 3 Sep 2026, published 20 Aug 2026🛡️ Security

CVE-2026-76832 (CVSS 8.8) is a path traversal flaw in Agno's PythonTools, specifically in libs/agno/agno/tools/python.py, where the file_name argument to read_file, save_to_file, and run_python_file is not sanitized against the configured base_dir. An attacker can pass sequences like ../../../../etc/passwd to read or write arbitrary files, and abuse run_python_file to execute an arbitrary Python script for RCE. The advisory notes the flaw is reachable either via direct tool invocation or via prompt injection into agent-processed content, with no PoC or patch published at time of writing.

thehackerwire.comadvisoryAdded 26 Sep 2026, published 20 Aug 2026🛡️ Security

Aikido security research describes CVE-2026-18171, a flaw allowing supposedly read-only mounts in Docker-based sandboxes to be written to, potentially enabling sandbox escape or persistence. Full page content was unavailable at fetch time, so specifics of the exploitation chain and affected versions could not be verified from the source text.

aikido.devadvisoryPublished and added 13 Aug 2026🛡️ Security

Orca Security details four Zoom vulnerabilities in the cross-platform annotation engine (libannotate.so): CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize from unchecked 32-bit character counts, and CVE-2026-53415, a use-after-free in auto-shape metadata handling giving a write-what-where primitive, both enabling zero-click RCE against every meeting participant via crafted annotation messages during screen sharing. Also disclosed are CVE-2026-53414 (heap over-read/DoS) and CVE-2026-53416 (path traversal in the Windows VDI client). The write-up notes a working exploit chain built in under 24 hours with fewer than 20 AI-model prompts, platform-specific exploitation details (macOS ARM64 ASLR bypass, Android heap spraying/vtable corruption), and that E2EE meetings bypass Zoom's server-side message filtering.

orca.securityadvisoryPublished and added 12 Aug 2026🛡️ Security

Grafana advisory for CVE-2026-19516, a critical (CVSS 9.1) SSRF in mcp-grafana. A caller able to invoke the grafana_api_request tool can set the X-Grafana-URL header to redirect outbound requests, choosing method, path and body, to internal, loopback and link-local services including cloud metadata endpoints, and read the responses. The earlier fix for CVE-2026-15583 only stopped the service-account token leaking to other destinations and did not restrict the destinations; the fix is in version 1.1.0 and later.

grafana.comadvisoryAdded 12 Aug 2026🛡️ Security

OpenAI system card update for the August 2026 release of GPT-5.6 Sol and GPT-5.6 Luna in ChatGPT, reporting safety eval results for disallowed content, new under-18 safety benchmarks, jailbreak and prompt injection robustness, HealthBench scores, and hallucination rates compared to GPT-5.5 Instant. It also reports Preparedness Framework capability testing, rating both models High capability in Biological/Chemical and Cybersecurity domains using evals such as SecureBio virology troubleshooting, ProtocolQA, protein binding prediction, CTF challenges, CVE-Bench, and cyber range exercises, while staying below Critical and below High for AI self-improvement.

deploymentsafety.openai.comadvisoryAdded 7 Oct 2026, published 6 Aug 2026🧠 AI

Endor Labs' active-tracking advisory on an npm supply-chain worm that compromised keyv, flat-cache, and file-entry-cache (500M+ combined weekly downloads) via the jaredwray/Cacheable GitHub Actions OIDC trusted-publishing pipeline, injecting a preinstall hook (setup.mjs) that fetches a legitimate Bun binary to run an obfuscated ~727KB stage-2 payload (Math_Symbol.js/math_init.js) stealing AWS, npm, GitHub, and Vault tokens. The stolen tokens were used to self-propagate the same payload to 384+ packages and 1,136+ versions across unrelated maintainer accounts, including scopes belonging to companies like ServiceTitan, Qlik, and Picsart. The post includes IOCs (file hashes), affected package/version lists, and mitigation guidance (lockfile/CI log checks, --ignore-scripts).

endorlabs.comadvisoryAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

Aikido Security reports that Keyv and several related npm packages were compromised as part of the ongoing Shai-Hulud supply-chain attack, in which malicious versions were published to npm to spread a self-replicating worm across the ecosystem. The write-up details the affected packages and versions and the worm's propagation mechanism via compromised maintainer credentials and postinstall scripts.

aikido.devadvisoryAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security