x.comadvisorylnd v0.20.7 and v0.21.6 are Lightning Network Daemon releases announced by Clio Bitcoin Bank. They include a Go-specific mitigation, with the MPTCP flag turned off, for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code. The post recommends all users update. It gives no exploit or impact detail.
Cloud & Infra· Published and added 31 Oct 2026
status.bunny.netadvisoryBunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.
Threat Intel, Cloud & Infra· Added 31 Oct 2026, published 30 Oct 2026
cisa.govadvisoryCISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation: CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (generation of predictable numbers or identifiers). The alert restates BOD 26-04, which requires federal civilian agencies to remediate KEV-listed flaws on exposed assets and check for prior compromise. It also links the KEV nomination form.
Threat Intel, GRC· Published and added 30 Oct 2026
cisa.govadvisoryCISA alert of 29 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on evidence of active exploitation: CVE-2026-97229, an integer overflow in GitLab CE/EE, and CVE-2026-76418, a NULL pointer dereference from an unchecked return value in Cisco Secure Firewall ASA and FTD. It restates BOD 26-04 remediation duties for federal civilian agencies and links the KEV nomination form.
Threat Intel, GRC· Published and added 29 Oct 2026
unit42.paloaltonetworks.comadvisoryUnit 42 threat brief on PHP2Shell, two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2), both caused by longjmp() error handling that leaves memory uninitialized or freed. Cortex Xpanse counted over 22.6 million exposed instances. The 29 October 2026 update says attackers chained PHP2Shell with a Linux kernel privilege escalation against internet-exposed PAN-OS management interfaces. An earlier 23 October claim of post-compromise activity was retracted on 25 October.
Threat Intel, AppSec· Added 30 Oct 2026, published 29 Oct 2026
ubuntu.comadvisoryCVE-2026-98432 is a Linux kernel use-after-free in the IPv4 TCP stack, tracked by Ubuntu (published 15 October 2026, updated 29 October 2026). ireq_opt/inet_opt were freed with plain kfree() while another CPU built a SYNACK under RCU, so ip_options_build() read freed memory; the fix uses kfree_rcu(). Ubuntu rates it High priority, CVSS v3.1 9.8 and v4.0 8.3. The page text does not list per-release package status.
Cloud & Infra· Added 30 Oct 2026, published 29 Oct 2026
x.comadvisoryCVE-2026-103780 is a stack-based buffer overflow (CWE-121) in Dell PowerProtect Data Domain / DD OS. An unauthenticated remote attacker could get command execution (CVSS 3.1 9.8, Dell DSA-2026-416). The post lists affected and fixed builds for four release trains (Feature Release, LTS2024, LTS2025, LTS2026). It adds KEV, EPSS and SSVC status, plus six defensive checks. The vulnerable service is not public.
Blue Team & Detection, Cloud & Infra· Added 31 Oct 2026, published 29 Oct 2026
orca.securityadvisoryCVE-2026-101767 is a CVSS 9.8 unauthenticated SQL injection in Oracle E-Business Suite's Application Object Library, reachable through the /OA_HTML/AppsTCFServer servlet (GanttDataServer) and chainable to OS command execution. It affects versions 12.2.3 to 12.2.15 and was fixed in the October 2026 Critical Patch Update. Horizon3.ai found it, and Defused saw probing on honeypots on 27 October 2026. Interim mitigation is removing the servlet from the URL firewall allowlist.
AppSec, Threat Intel· Published and added 28 Oct 2026
cisa.govadvisoryCISA advisory ICSA-26-302-03, republished from Hitachi Energy PSIRT 8DBD000258, covers OS command injection (CVE-2026-13162) and the Dirty Frag vulnerability (CVE-2026-43284) in Hitachi Energy CoreTec. CoreTec5 up to 3.4.0 and 5.0.0 are affected by both, and CoreTec4 up to 3.4.0 by CVE-2026-13162. The advisory was released 27 October 2026 and lists generic ICS mitigations. SSVC rates exploitation as none.
Hardware & RF· Added 29 Oct 2026, published 28 Oct 2026
cisa.govadvisoryICSA-26-302-02 is a CISA republication of Hitachi Energy PSIRT advisory 8DBD000224 on the TRO600 series. It covers CVE-2026-10756 and CVE-2026-106087, which allow remote code execution and disclosure of sensitive information. Affected versions are TRO600 up to 9.2.1.6 and 9.1.1.0, plus 9.2.2.1 and 9.1.2.0. The page gives no per-CVE detail or CVSS scores, only general ICS hardening advice. Released 27 October 2026.
Hardware & RF· Added 29 Oct 2026, published 28 Oct 2026
cisa.govadvisoryICSA-26-302-01 republishes Siemens SSA-137528 on the Mendix SAML module, which has an authentication bypass (CVE-2026-89209). An unauthenticated remote attacker can replay a valid SAML assertion in IdP-initiated flows to gain unauthorized access. Fixed in 4.2.4 for Mendix 10 and 11, and 3.6.29 for Mendix 9. Initial release was 26 October 2026.
Identity & Access, AppSec· Added 29 Oct 2026, published 28 Oct 2026
cisa.govadvisoryCISA alert of 28 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities Catalog on evidence of active exploitation: CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux kernel missing variable initialization). It restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise. It also links the KEV nomination form.
Threat Intel, GRC· Added 29 Oct 2026, published 28 Oct 2026
horizon3.aiadvisoryCVE-2026-20362 is an unauthenticated server-side request forgery in Cisco Finesse (CVSS 3.1 score 7.2), found by Horizon3 researchers Noah King and Brandon Peterson. The embedded Apache Shindig content proxy fetches attacker-supplied URLs, including loopback services such as the Finesse REST API at 127.0.0.1:8082, which returns SystemInfo with node hostnames and the XMPP domain. Cisco published its advisory on 7 October 2026. Fixes are planned for January and February 2027, and no workaround exists.
AppSec· Added 29 Oct 2026, published 28 Oct 2026
x.comadvisoryCVE-2026-92885 is a critical (CVSS 3.1 9.8, CWE-287) authentication bypass in the Qode Membership WordPress plugin, versions through 2.0.6.2. A misspelled variable in the Facebook token-verification guard skips provider checks, so an unauthenticated attacker with a public nonce can get a session cookie for an existing account, including an administrator. The post gives the fix (2.0.6.3, bundled in Bridge 30.9), KEV/EPSS/SSVC status, and a SOC log-correlation and remediation plan.
AppSec, Identity & Access, Blue Team & Detection· Added 31 Oct 2026, published 28 Oct 2026
x.comadvisoryVeeam patched five vulnerabilities across Backup & Replication, Veeam Agent for Linux and Veeam ONE. The worst is CVE-2026-108142 (CVSS 9.1), an unauthenticated authorization bypass in the CDP Coordinator Service affecting Backup & Replication 13.0 and 13.1. Other fixes cover Linux agent privilege escalation, two path-traversal file writes, and a Veeam ONE MFA bypass; fixed builds are listed.
AppSec, Identity & Access· Added 30 Oct 2026, published 28 Oct 2026
cisa.govadvisoryCISA alert of 27 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog on evidence of active exploitation: CVE-2026-48356, an unrestricted upload of a dangerous file type in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value in Google Brotli. It restates BOD 26-04, which makes federal civilian agencies prioritise KEV flaws on exposed assets and check for prior compromise. No technical detail or IOCs are given.
AppSec, GRC· Added 29 Oct 2026, published 27 Oct 2026
orca.securityadvisoryCVE-2026-111497 is a high-severity out-of-bounds write in the Node.js Brotli decoder, reported by Orca Security. It affects all supported release lines (22.x, 24.x, 26.x) and can be triggered by malformed Brotli data processed through node:zlib or fetch(). Impacts named are crashes, memory disclosure and remote code execution in cloud workloads; patching is advised. The fetched text covers only the executive summary.
AppSec· Published and added 27 Oct 2026
x.comadvisoryCVE-2026-115905 is a ZIP cloaking flaw in the Rust zip crate (zip-rs/zip2), rated CVSS v4.0 10.0 and affecting versions below 9.0.5. ZipArchive reads central-directory metadata while ZipStreamReader reads local headers, so a crafted archive can pass filename inspection and then overwrite a different file during streaming extraction. Version 9.0.5 adds consistency checks, but ZipStreamReader::new leaves them off by default, and extraction is not atomic, so files can be written before an error is raised. The post covers CWE-20 and CWE-436, KEV and EPSS status, Debian status and a six-step investigation trail.
AppSec, Blue Team & Detection· Added 29 Oct 2026, published 27 Oct 2026
cisa.govadvisoryCISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on 26 October 2026: CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state). It also updated its PHP alert on critical vulnerabilities requiring immediate patching. The alert restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise.
AppSec, GRC· Added 29 Oct 2026, published 26 Oct 2026
cisa.govadvisoryCISA advisory ICSA-26-300-02 covers four vulnerabilities in Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. CVE-2023-4863 (CWE-787 out-of-bounds write) allows code execution; CVE-2026-16436 and CVE-2026-16437 allow authentication bypass; CVE-2026-16438 allows arbitrary operations. Fixes are 10.97.3, 10.98 and GENESIS 11.04. MC Works64, GENESIS32 and BizViz are affected in all versions, and MC Works64 has no fix planned. Mitigations include removing the ClientChallengeTable.dat or SecurityChallenges.dat file contents. The fetched text was truncated, so later content is not covered.
Offensive Security, Identity & Access· Added 29 Oct 2026, published 26 Oct 2026
cisa.govadvisoryCISA ICS advisory ICSA-26-300-01 (October 27, 2026) covers EPICS Base release 7.0.10 and earlier, with CVE-2026-114595 through CVE-2026-114598. Flaws include integer overflow, length parameter inconsistency and type confusion, allowing denial of service, memory corruption, information disclosure or remote code execution (CVSS v3.1 9.8). The fix is EPICS Base 7.0.11, with patches in epics-base and pvDataCPP pull requests.
AppSec· Added 29 Oct 2026, published 26 Oct 2026
x.comadvisoryCVE-2026-106173 is a critical (CVSS 9.4) unauthenticated arbitrary file write in FortiSIEM's phQueryMaster gRPC service on port 27918/TCP. The SendQueryResult method builds a path from the query-id parameter without validation, so "../" sequences escape the directory and a null byte drops the appended filename and extension. Overwriting /opt/charting/redishb.sh, which runs every 60 seconds, gives remote command execution. Horizon3.ai published the analysis and a PoC.
Offensive Security, AppSec· Added 27 Oct 2026, published 26 Oct 2026
wiz.ioadvisoryCVE-2026-111497 (Broccoli2Shell, also Node2Shell and HTTP2Shell) is an out-of-bounds write in the upstream Brotli C decoder. It affects Node.js, Bun, Envoy Proxy, Istio and Python packages, and can lead to memory corruption, information disclosure, crashes or RCE when untrusted Brotli data is decompressed. Wiz reports 91% of cloud environments have vulnerable resources. The post lists patching, inventory, rebuild and temporary mitigation steps.
AppSec, Cloud & Infra· Published and added 25 Oct 2026
cisa.govadvisoryCISA alert on CVE-2026-109618 and CVE-2026-109619 ("php2shell"), unauthenticated remote code execution flaws affecting PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updated 23 October 2026 with a Sigma rule, partner advisories (NSA, NCSC-UK, ASD ACSC, NCSC-NL, NCSC-NZ, Cyber Centre) and guidance to inventory PHP, patch internet-facing systems first, and watch for PHP workers spawning shells. No in-the-wild exploitation had been observed.
AppSec, Blue Team & Detection· Added 24 Oct 2026
aikido.devadvisoryPython2Shell is the Python-side impact of CVE-2026-111497 (Node2Shell), a Brotli decoder flaw (CVSS 4.0 9.2) in DecodeBlockTypeAndLength() that mixes an unchecked return value with an out-of-bounds write. Brotli 1.2.0 and earlier, and brotlicffi 1.2.0.x, are affected through urllib3, requests, httpx, aiohttp and Scrapy. Fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0; as of 23 October 2026 advisory databases do not map the CVE to either package. The post lists checks and workarounds.
AppSec, Supply Chain· Published and added 23 Oct 2026
horizon3.aiadvisoryPHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, critical unauthenticated RCE flaws in PHP core fixed on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The page explains the out-of-memory corruption and stale global state causes, mod_php and PHP-FPM exposure, interim mitigations, hunting guidance, exploitation reports from October 2026, and the 23 October CVE-2026-115560 upload-progress advisory. Horizon3 also announced a non-exploiting NodeZero check.
AppSec, Blue Team & Detection· Added 29 Oct 2026, published 23 Oct 2026
blog.railway.comadvisoryRailway's preliminary report on a security incident between 20 and 22 October 2026, in which an attacker reached internal systems and decrypted stored environment variables. At most 1.85% of workspaces (about 100,000) were confirmed affected. The attacker was after AI provider API keys for distillation. Railway notified vendors such as GitHub and Anthropic, rolled all keys, moved to single-tenant builders and advised customers to rotate secrets. Exploit details are withheld.
Threat Intel, DevSecOps, Blue Team & Detection· Added 24 Oct 2026, published 23 Oct 2026
x.comadvisoryCVE-2026-115560 is a PHP code execution bug reported two days after the PHP2Shell emergency patches. The post says those releases do not fix it and no emergency fix is planned. Only apps that switch session.serialize_handler to php via ini_set() before session_start() are exposed. The mitigation is session.upload_progress.enabled=0, which also covers anyone who applied it for the 21 October advisory. The post gives no technical root-cause detail.
AppSec· Added 25 Oct 2026, published 23 Oct 2026
github.comadvisoryGHSA-9v8h-qqgm-4m35 is a critical buffer overflow (CVSS v4 9.2) in the Google Brotli decoder (c/dec/decode.c), affecting versions 1.0.3 through 1.2.0 on all platforms. A crafted compressed stream lets an unauthenticated remote attacker corrupt adjacent decoder state, leak memory, crash the process, or possibly execute code. Fixed in 1.0.10, 1.1.1 and 1.2.1. The page does not mention curl or Git, despite the title.
AppSec· Added 25 Oct 2026, published 23 Oct 2026
x.comadvisoryCVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js (CWE-787, CWE-252), rated CVSS v4.0 9.2 by the Google CNA and High by the Node.js project. Fixes are Node 22.23.4, 24.22.1 and 26.12.1, and 24.22.1 still labels Brotli 1.2.0 because the fix was cherry-picked. The post gives a SOC trail from input to worker, with remediation and verification steps. It notes no KEV match, CISA SSVC exploitation none, and only unverified public lab claims.
Blue Team & Detection, AppSec· Added 26 Oct 2026, published 23 Oct 2026
enisa.europa.euadvisoryENISA Technical Advisory for Software Bill of Materials (October 2026, TLP:CLEAR) is non-mandatory guidance for organisations, especially SMEs, starting SBOM adoption. It covers SBOM data models (CycloneDX, SPDX), a mapping of BSI TR-03183-2 fields to CISA minimum elements, lifecycle and CI/CD integration, an SBOM threat model, and security recommendations. It supports Cyber Resilience Act obligations but is not a legal interpretation.
Supply Chain, GRC· Added 23 Oct 2026
enisa.europa.euadvisoryENISA Technical Advisory for Software Bill of Materials is practical guidance on SBOM adoption for organizations, especially micro, small and medium enterprises and open-source stewards. It sets out an SBOM implementation architecture and data flows across a defined lifecycle, an indicative SBOM threat model with targeted risks, and measures for the SBOM ecosystem. It aligns with the ENISA Secure by Design and Default Playbook and supports Cyber Resilience Act compliance.
Supply Chain, GRC· Added 23 Oct 2026
horizon3.aiadvisoryCVE-2026-76268 is a critical (CVSS 9.8) missing authentication flaw (CWE-306) in the Patroni REST API on Splunk Enterprise search head cluster members. An unauthenticated attacker with network access can run operating-system commands. Affected: 10.4.0 to 10.4.2 and 10.2.0 to 10.2.6. Fixed in 10.4.3 and 10.2.7. Splunk (SVD-2026-1001, 7 October 2026) suggests disabling the PostgreSQL sidecar as a workaround.
Offensive Security, Cloud & Infra· Added 29 Oct 2026, published 22 Oct 2026
x.comadvisoryCVE-2026-114625 is a critical (CVSS 3.1 9.9) SQL injection in on-prem Arista VeloCloud Orchestrator, the SD-WAN management portal, covered in Arista Security Advisory 0199 of 22 October 2026. Any authenticated user, even the lowest Enterprise Read Only tenant role, can become a local superuser operator, and Arista says it is exploited in the wild. On-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12; two attacker IPs are listed.
Threat Intel, AppSec· Added 24 Oct 2026, published 22 Oct 2026
aikido.devadvisoryNode2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled with Node.js and Bun, triggered by malformed compressed input and rated high by Node.js, with possible remote code execution. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and Bun 1.4.4. The post covers exposure via Express 5, body-parser 2.x, fetch() and node:zlib, stopgaps, and a timeline with public proofs of concept on 22 October 2026.
AppSec· Published and added 22 Oct 2026
unit42.paloaltonetworks.comadvisoryUnit 42 advisory on the compromise of eight intermediate CA private keys belonging to Indian CA eMudhra Limited. The keys were generated with insufficient randomness, so attackers could derive them from the public certificates and sign rogue TLS certificates for MitM attacks. eMudhra has revoked the certificates and browser and OS vendors have untrusted them. Interim guidance covers PKI and trust store audits, reissuance, strict CRL/OCSP checking, log hunting, CT monitoring and CAA records.
Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 22 Oct 2026
x.comadvisoryCyberForge CVE of the Day #084 analyses CVE-2026-76466, a CVSS 9.8 flaw in clustered Cisco Expressway-C and Expressway-E. Persistent database cookies and weak client-certificate validation allow root OS command execution over the network. The fix is X15.5.20 (X14 and earlier must migrate), with no workaround. It adds a per-peer SOC investigation trail, reachability checks and exposure status from CISA SSVC, KEV and EPSS.
Blue Team & Detection, Cloud & Infra· Added 24 Oct 2026, published 22 Oct 2026
snyk.ioadvisorySnyk's write-up of two critical unauthenticated PHP runtime RCEs, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state, cross-request use-after-free), both CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the disclosure timeline, affected SAPIs (mod_php most exposed), backports for 8.1 and older, and partial mitigations.
AppSec· Published and added 22 Oct 2026
soliditylang.orgadvisorySolidity advisory on a Yul optimizer bug in the KnowledgeBase, present in versions 0.8.19 to 0.8.37 and fixed in 0.8.38. Stale cached address offsets let LoadResolver and EqualStoreEliminator treat coinciding memory or storage slots as distinct, so loads return outdated values or needed stores are dropped. It includes a pure-Solidity reproducer for --via-ir, a Sourcify scan with no differing bytecode, and checks for deployed contracts. Rated low severity.
AppSec· Published and added 22 Oct 2026
oracle.comadvisoryOracle Security Alert for CVE-2026-91403 ships Java SE updates that distrust a set of intermediate CA certificates tied to eMudhra. It contains one new patch for Oracle Java SE, described as remotely exploitable without authentication. Customers are told to update Java or apply mitigations listed at ops.java/emudhra and in the Patch Availability Document. No reporter is credited and the page gives no CVSS score or technical detail.
Cloud & Infra, AppSec· Added 23 Oct 2026, published 21 Oct 2026
blog.railway.comadvisoryRailway's security disclosure of 21 October 2026 says an unauthorized third party may have accessed encrypted customer environment variables and decrypted some of them. Railway links it to a series of attacks on platform companies aimed at compromising AI inference providers, and has asked upstream providers to revoke keys. It tells all users to roll every environment variable, API key and registry credential, and it paused all deployments. The notice gives no technical details of the intrusion.
Threat Intel, DevSecOps· Added 22 Oct 2026, published 21 Oct 2026
aws.amazon.comadvisoryAWS bulletin 2026-143-AWS covers CVE-2026-109618 and CVE-2026-109619, critical PHP web runtime flaws that let an unauthenticated remote caller run code, read process data or cause denial of service. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 5.4 to 8.1 get no fix. It gives status for WorkMail, Elastic Beanstalk, Amazon Linux and Lightsail, plus AWS WAF rules, including a custom "PHP2Shell" rule matching PHP_SESSION_UPLOAD_PROGRESS and PHPSESSID.
AppSec, Cloud & Infra· Added 22 Oct 2026, published 21 Oct 2026
blog.talosintelligence.comadvisoryCisco Talos describes eight eMudhra intermediate CA certificates (six TLS, two code signing) whose P-384 private keys were trivially recoverable because a flaw in an April 30, 2025 key generation ceremony produced weak keys with only 3 to 8 bytes of entropy. The post lists certificate SHA-256 hashes and serials, browser and Microsoft blocks, and the Go fix (CVE-2026-111943, Go 1.27.3 and 1.26.10) that filters chains by SPKI hash. It covers impact on VPNs, CI/CD and embedded devices, and Snort SIDs 67363 to 67374.
Threat Intel, Cloud & Infra· Published and added 21 Oct 2026
x.comadvisoryCVE-2026-107406 is a memory overflow in Citrix NetScaler that allows remote code execution when SAML is configured, rated 9.5 out of 10. The post from emits.ca calls it the fourth NetScaler bulletin in a week. It warns that the previous week's SAML patch does not cover it, and that fixes need NetScaler 14.1-73.46 or later, or 13.1-64.29 or later. The full advisory is on emits.ca.
Cloud & Infra, Identity & Access· Added 22 Oct 2026, published 21 Oct 2026
endorlabs.comadvisoryPHP2Shell is the name for two critical PHP core memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. Fixes ship in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Wiz researchers demonstrated RCE against WordPress, Drupal and Joomla, and Apache with mod_php is the highest risk. The post covers inventory, container rebuilds, Cloudflare WAF rules and temporary exposure reduction.
AppSec, DevSecOps· Published and added 21 Oct 2026
blog.talosintelligence.comadvisoryCisco Talos advisory on "php2shell", two unauthenticated RCE flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), affecting every build since PHP 5.4. One flaw is an out-of-memory handling bug leaving request data partly initialized; the other reuses stale state after free. PHP 8.1 and older get no patch (about 50% of PHP systems). Includes ini-level mitigations and Snort SIDs 67359 and 67360. No exploitation seen as of 21 October 2026.
AppSec, Blue Team & Detection· Published and added 21 Oct 2026
watchtowr.comadvisoryPHP2Shell is the name for CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), two unauthenticated PHP remote code execution flaws rated CVSS 4.0 9.2. Details leaked before the 21 October 2026 patch release, and watchTowr's honeypots saw exploitation. The page lists fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), states that .ini mitigations do not work, gives a timeline, and describes compromise checks.
AppSec, Threat Intel· Added 28 Oct 2026, published 21 Oct 2026
orca.securityadvisoryPHP2Shell is the informal name for CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), unauthenticated remote code execution flaws in the PHP core runtime. Patches for branches 8.2 to 8.5 were scheduled for 21 October at 14:00 UTC, while PHP 8.1 and older get no fix; about 884,000 internet-facing hosts run those versions. watchTowr reproduced CVE-2026-109618, no public PoC existed at writing, and Sansec expects mass exploitation within 15 minutes of release.
AppSec· Published and added 21 Oct 2026
github.comadvisoryPHP 8.2.35 is a security release of the PHP 8.2 branch that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The notes say no complete mitigations exist and updating is the only safe choice. PHP 8.2 reaches end of life on 31 December 2026, after which it gets no security fixes.
AppSec· Added 22 Oct 2026, published 21 Oct 2026
x.comadvisoryJFrog Security Research warns that the LiteLLM 1.107.0 release on PyPI contains malicious code, as part of a supply-chain attack. It advises avoiding that version and investigating any environment where it was installed or executed. The post gives no technical detail, payload description or IOCs, and says a blog post will follow.
Supply Chain· Added 23 Oct 2026, published 21 Oct 2026
huntress.comadvisoryHuntress rapid-response post on php2shell, two leaked critical PHP core vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2 each) reported as remote code execution. The PHP team moved its security release to 21 October 2026, 14:00 UTC, after the leak. It lists hunting cues such as php-fpm, php-cgi or apache2 spawning shells, interpreters or download tools, plus inventory and patch steps. No root cause, affected versions, PoC or IOCs were public at writing.
Blue Team & Detection, Threat Intel, AppSec· Published and added 21 Oct 2026
aikido.devadvisoryPHP2SHELL is Aikido Security's advance notice of two critical remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, with all versions treated as affected. The PHP security team will release fixes at 14:00 UTC on 21 October 2026, a day early after details leaked on 20 October. The post withholds exploitation details and workarounds.
AppSec· Published and added 21 Oct 2026
cisa.govadvisoryCISA advisory AA26-293A (20 October 2026) details SafePay ransomware, active since August 2024 with at least 600 victims across critical infrastructure. It covers initial access via Mullvad VPN IPs, phished profiles and edge-device CVEs, LOTL lateral movement with PsExec, WinRM and RDP, exfiltration with RClone and WinSCP, and ChaCha20/RSA encryption. It lists IOCs, MITRE ATT&CK mappings, incident response steps and mitigations.
Threat Intel, Blue Team & Detection· Added 21 Oct 2026
horizon3.aiadvisoryCVE-2026-101767 is an unauthenticated SQL injection in the Oracle E-Business Suite Thin Client Framework servlet (/OA_HTML/AppsTCFServer, oracle.apps.fnd.tcf.SocketServer), CVSS 3.1 9.8. It runs SQL as the APPS user and chains to OS commands as the EBS account. Affects 12.2.3 to 12.2.15, fixed in the Oracle October 2026 CPU (20 October 2026). The page lists mitigations, IOCs and a timeline.
AppSec, Offensive Security, Blue Team & Detection· Added 29 Oct 2026, published 20 Oct 2026
unit42.paloaltonetworks.comadvisoryUnit 42 threat brief on active exploitation of CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass added to CISA KEV on May 13, 2026. It lists IP addresses, host IDs and PoC-derived client values to hunt in GlobalProtect logs. The October 2026 updates cover Qilin and Inc ransomware operators, MFA bypass, pivots to vCenter and ESXi with offline VMDK credential dumping, and management interface exposure on ports 4443 and 3879.
Threat Intel, Blue Team & Detection, Identity & Access· Added 21 Oct 2026, published 20 Oct 2026
news-web.php.netadvisoryThe PHP security team announces an upcoming PHP security release that fixes two critical vulnerabilities, both rated CVSS v4.0 9.2. The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. The team says it may release earlier if details become public or exploitation in the wild is seen. The notice gives no CVE IDs, affected versions or technical details.
AppSec· Added 21 Oct 2026, published 20 Oct 2026
watchtowr.comadvisoryPHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws in PHP, both CVSS v4.0 9.2. One stems from out-of-memory corruption during request setup, the other from stale global state reused by the next request. watchTowr reports exploitation since 21 October 2026, lists fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) and says PHP 5 is also affected. PHP says no configuration change fully mitigates.
AppSec, Threat Intel· Added 30 Oct 2026, published 20 Oct 2026
php.netadvisoryThe php.net 2026 news archive opens with the PHP security team's advance notice of a release scheduled for 21 October 2026 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS v4.0 9.2, and may ship earlier if details leak or exploitation appears. Details and fixed versions come with the release. The archive also lists 2026 security releases (8.2.34, 8.3.35, 8.4.26, 8.5.11), PHP 8.6 RC3 and conference announcements.
AppSec· Added 21 Oct 2026, published 20 Oct 2026
x.comadvisoryCVE-2026-77932 affects DB-GPT through 0.8.2 (dbgpt-app). The /api/v1/chat/react-agent route accepts unauthenticated requests because get_user_from_headers returns an admin-role user, and the ReAct agent can reach unsandboxed Python and shell tools. Lasso reported root in the webserver container in a lab. The post gives CVSS 9.8 and 9.3, no verified fix (0.8.2 is still the latest release), no KEV match, no EPSS data, and a SOC hunting trail.
AI Security, AppSec, Blue Team & Detection· Added 23 Oct 2026, published 20 Oct 2026
x.comadvisoryCVE-2026-106931 is an OS command injection (CWE-78) in the statistics processing of EG Secure Solutions SiteGuard Server Edition, a host-based WAF. It can give root or SYSTEM command execution. The vendor and JVN confirm exploitation on 14 October 2026. The post lists fixed builds (Ver8.00 Update 5, Ver7.00 Update 6 on FreeBSD), the IIS exclusion, the workaround of disabling statistics, and a SOC trail starting with diagnostic preservation before patching.
Blue Team & Detection, AppSec· Added 21 Oct 2026, published 19 Oct 2026
x.comadvisoryInfinity Core is a set of six Linux kernel bugs published by researcher Hyunwoo Kim after the linux-distros embargo expired on 16 October 2026, with public exploit code. The bugs sit in timer, signal, memory, futex, scheduler and SLUB code. Five have local privilege escalation exploits, one is crash-only. CIQ says four affect Rocky Linux-based kernels. No sysctl or module workaround exists, so the fix is a patched kernel and a reboot.
Offensive Security, Cloud & Infra· Added 19 Oct 2026, published 17 Oct 2026
x.comadvisoryCyberForge CVE of the Day #080 covers CVE-2026-99999 ("PwnEscape"), a Linux kernel IPv4 checksum-completion flaw. Crafted checksum metadata can trigger a deferred write into an already-validated IPv4 header, which allows host memory disclosure from a guest or microVM over virtio-net and TAP. It gives upstream fixed branches (5.10.272 to 7.2.11), Amazon Linux, Red Hat and Ubuntu status, CVSS 9.3, EPSS 0.211% and a SOC investigation trail. No IOCs were verified.
Cloud & Infra, Blue Team & Detection· Added 19 Oct 2026, published 17 Oct 2026
x.comadvisoryConnectWise Cloud Backup (formerly SkyKick Backup, AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) had its multitenant OAuth app compromised, per Microsoft Threat Intelligence. On 15 October 2026 the actor authenticated broadly as the service principal from 144.172.64[.]128, likely using customer-granted permissions such as Directory.ReadWrite.All, then ran Graph API reconnaissance and tried to add credentials to the service principal as a backdoor. The post lists IOCs, Defender alerts and hunting advice.
Threat Intel, Identity & Access, Supply Chain, Blue Team & Detection· Added 20 Oct 2026, published 17 Oct 2026
watchtowr.comadvisoryCVE-2026-102764 is an arbitrary file upload in BeyondTrust Remote Support (formerly Bomgar) caused by internal appliance components not validating message origin. Mandiant found it exploited as a zero-day in late August 2026. BeyondTrust disclosed it on 15 October 2026 and CISA added it to KEV on 16 October 2026. The FAQ covers the web shell, root escalation, credential theft, persistence, patching and compromise checks.
AppSec, Threat Intel· Added 30 Oct 2026, published 16 Oct 2026
watchtowr.comadvisoryCVE-2026-102764 is a CVSS 9.8 unauthenticated arbitrary file upload flaw in BeyondTrust Remote Support (formerly Bomgar) and Privileged Remote Access. Internal messaging components do not verify message origin, so remote attackers can plant files the appliance would reject. BeyondTrust disclosed it on 15 October 2026 with patch BT26-05, and CISA added it to KEV on 16 October 2026. The page lists log files to review and hardening steps.
AppSec, Blue Team & Detection· Added 30 Oct 2026, published 16 Oct 2026
x.comadvisoryS2W post on CVE-2026-97229, a CVSS 10.0 remote code execution flaw in the GitLab CE/EE CI/CD regex compiler, disclosed October 13, 2026. Insufficient regex validation plus an integer overflow during encoding conversion lets an attacker who can add CI/CD config use a malicious regex and a UTF-8 repository path to run commands as the git user. Affects self-managed 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Rapid7 published analysis and a public PoC exists, with no in-the-wild exploitation confirmed as of October 15. No workaround exists, so patch or restrict access to a management network or VPN.
AppSec, DevSecOps· Added 17 Oct 2026, published 16 Oct 2026
x.comadvisorySummary of Vercel's Oct 14, 2026 out-of-band Next.js security release fixing two critical unauthenticated RCEs: one in App Router apps with Cache Components where a "use cache" function returns multiple typed arrays (GHSA-673q-mjm6-r5xr, upstream React GHSA-xqc2-xf4c-x3h3, no workaround), and one in the Image Optimization API handling SVG on glibc Linux via a memory bug in a library used through sharp (CVE-2026-96889 / GHSA-2464-fhr4-w9xw, workaround sharp 0.35.5+). Also covers a high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r). Fixes ship in two supported Next.js LTS lines. No in-the-wild exploitation reported.
AppSec· Added 17 Oct 2026, published 16 Oct 2026
x.comadvisoryDaily CVE digest on CVE-2026-76519, a CVSS 9.8 relative path traversal (CWE-23) in Cisco Secure Email Gateway's AMP File Reputation attachment processing. A crafted attachment gives unauthenticated arbitrary file writes and root command execution, and Cisco PSIRT reports active exploitation. The CVE is in CISA KEV. It lists the applicability conditions (File Reputation assigned to a policy and Content Scanner Tools earlier than 25.3.0.5525) and the fixes (scanner 25.3.0.5525, AsyncOS 15.5.5-014 and 16.5.0-780). It also covers evidence preservation, reading Cisco's System Security scan outcomes, mail/AMP log correlation, and deployment-specific recovery including cluster-key exposure.
Blue Team & Detection, Threat Intel· Added 18 Oct 2026, published 15 Oct 2026
orca.securityadvisoryOrca Security analysis of CVE-2026-97229, a CVSS 10.0 flaw in GitLab CE/EE. An integer overflow (CWE-190) in the CI/CD regular expression compiler gives memory corruption and code execution as the git user. It is triggered by a crafted regex in .gitlab-ci.yml combined with a UTF-8 repository path, with no authentication needed on instances that allow public project creation or self-registration. Lists affected branches (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2), the absence of a workaround, interim mitigations, and a Rapid7 PoC against GitLab CE 19.4.1 with ASLR on. Notes a prior max-severity GitLab bug (CVE-2026-85706) was probed in the wild within hours and later added to CISA KEV.
AppSec, DevSecOps· Published and added 14 Oct 2026
x.comadvisoryAlert summarizing XBOW's disclosure of a three-stage Chrome for Windows exploit chain: V8 Maglev memory corruption (CVE-2026-85045), Animated WebP decoder memory corruption (Chromium issue 548509153), then a Crashpad sandbox escape (CVE-2026-78952). Loading a crafted page was enough; no click or download needed. Human researchers working with GPT-5.6 Sol agents built it in six days, Google paid $250,000, all three bugs are fixed, and no in-the-wild exploitation is confirmed. It advises updating Chrome and restarting, and gives forensic triage pointers.
Offensive Security, AI Security, Threat Intel· Added 15 Oct 2026, published 14 Oct 2026
x.comadvisorySummary of SAP's October 13, 2026 Security Patch Day (16 new notes, 4 GitHub advisories). It leads with CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF in SAP Cloud SDK for Python before 0.45.2, where an attacker-controlled tenant_subdomain redirects token requests and exfiltrates client credentials. It also lists three other critical flaws: broken access control in NetWeaver Visual Composer, code injection in S/4HANA substitution/validation rules, and a missing authorization check in the Manufacturing Integration and Intelligence (XMII) Configuration Service. It notes that none are in CISA KEV and SAP reports no in-the-wild exploitation.
AppSec, Identity & Access· Added 15 Oct 2026, published 13 Oct 2026
rapid7.comadvisoryRapid7's analysis of Microsoft's October 2026 Patch Tuesday, which covers 1,413 vulnerabilities, 1,102 of them in Windows. It highlights the exploited Windows Shell Mark of the Web bypass (CVE-2026-96951) and the publicly disclosed .NET Framework WDAC bypass (CVE-2026-108398). It also covers five no-interaction Outlook preview-pane RCEs, the Edge advisories that list no CVEs, and end-of-support dates for Server 2012/2012 R2, Office 2021, Exchange 2016/2019 and Windows 11 24H2. The page text is truncated, so the later CVE tables are not seen.
Blue Team & Detection, other· Published and added 13 Oct 2026
blog.talosintelligence.comadvisoryTalos summarises Microsoft's October 2026 Patch Tuesday, which covers 1415 vulnerabilities, 85 of them critical (67 RCE). One bug is exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass. The post groups the CVEs by Microsoft's exploitability rating (more likely, less likely, unlikely) with CVSS and CWE for each, covering Windows, Office, Exchange, Hyper-V, DHCP, QUIC, Outlook and Azure. It also lists the Snort 2 and Snort 3 rule ID ranges that detect exploitation attempts.
Blue Team & Detection· Published and added 13 Oct 2026
thezdi.comadvisoryZDI's October 2026 Security Update Review covers Adobe's 11 bulletins (174 CVEs) and Microsoft's record 1,415 CVEs. The only actively exploited bug is CVE-2026-96951, a Windows Shell Mark of the Web bypass. It also flags 59 wormable bugs, Microsoft's new "risk cohorts", and top-priority fixes in ColdFusion, Commerce, Experience Manager, SharePoint, SQL Server and Exchange.
AppSec, Blue Team & Detection· Added 27 Oct 2026, published 13 Oct 2026
x.comadvisoryAlert thread on CVE-2026-35029 (CVSS v4.0 8.7) in LiteLLM Proxy, versions before 1.83.0. A low-privilege authenticated user can bypass admin authorization on /config/update, change runtime settings, read server files, take over admin credentials and run Python through remotely loaded modules (S3/GCS-hosted). Check Point Research published a full execution chain on October 13 after the April 2026 disclosure. The post lists hunting pointers (non-admin POSTs to /config/update, env-var changes, unexpected pass-through endpoints, cloud module loading) and advises upgrading to 1.83.9 or later and rotating credentials.
AI Security, AppSec· Published and added 13 Oct 2026
rapid7.comadvisoryRapid7 emergency-response analysis of CVE-2026-104935, a CVSS 8.6 authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure that allows unauthenticated remote command execution. It was exploited as a zero-day against a limited number of customers, added to CISA KEV on disclosure day, and Volexity observed it chained with a still-unpatched privilege escalation flaw. Part of the fix shipped in 25.1.3.0 in July 2026, with backports to other supported versions pending. Rapid7 advises emergency patching outside normal cycles and hunting for compromise using Volexity's IOCs, since Ivanti has no reliable ones.
Threat Intel, Blue Team & Detection· Published and added 13 Oct 2026
watchtowr.comadvisoryCVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure. A remote attacker can forge identity signals and run arbitrary commands without credentials. CISA added it to the KEV catalog on 13 October 2026. The FAQ lists affected branches by ISA hardware (25.1.1.1, 25.1.2.2, 22.8.X), fixed versions (25.1.1.2, 25.1.3.0/25.1.3.1, 22.8R2.5), no workaround and no reliable IOCs.
Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 13 Oct 2026
watchtowr.comadvisoryCVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure (CVSS 3.1 score 8.6) that lets a remote attacker run commands without logging in. CISA added it to KEV on 13 October 2026. The 22.8.X bridge release and 25.1.2.2 and earlier are affected, with fixes in 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Ivanti says no reliable indicators of compromise exist yet.
AppSec, Threat Intel· Added 30 Oct 2026, published 13 Oct 2026
rapid7.comadvisoryRapid7 analysis of CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in the Onigmo regex compiler used by GitLab CE/EE's CI/CD regex handling. A crafted regex in a .gitlab-ci.yml passes validation as US-ASCII, then is recompiled for a UTF-8 repository path, producing invalid instructions that give code execution as the git user. Rapid7 reproduced it on GitLab CE 19.4.1 with ASLR (patched in 19.4.2); despite the vendor's "unauthenticated" rating, the attacker needs to commit a malicious config to a public project, which self-registration allows. No in-the-wild exploitation is confirmed, and Rapid7 recommends urgent upgrades.
AppSec, DevSecOps· Published and added 13 Oct 2026
opennet.ruadvisoryRootshell Security Bulletin #22 (Aug 1998) reports an ICQ authentication flaw found by a Linux ICQ clone developer. The Mirabilis server stores 8-character passwords, and sending a password of 9 or more characters (e.g. "123456789") overflows the buffer and logs the client in as any UIN not already online. This gives full account takeover, including receiving offline messages. It is not spoofing, and it works with unofficial clients such as zicq, since the official client enforces the length limit client-side.
AppSec, Offensive Security· Added 17 Oct 2026, published 13 Oct 2026
x.comadvisoryCyberForge "CVE of the Day #076" covers CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in GitLab CE/EE's CI/CD regular expression compiler. It can lead to conditional unauthenticated code execution on the GitLab server. It lists the affected trains (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2) and the 19.3.4 vs 19.3.5 Ona-regression discrepancy. It also gives six SOC checks: scoping, log preservation (Workhorse/Rails/Sidekiq, correlation_id), server-effect hunting, request-to-process correlation, upgrade and running-state verification. It notes that exploit details are unverified, no KEV listing exists and EPSS data is unavailable.
AppSec, Blue Team & Detection· Added 15 Oct 2026, published 13 Oct 2026
x.comadvisoryCyberForge's CVE of the Day #075 covers CVE-2026-108860, a critical (CVSS 9.1 v3.1 / 9.3 v4.0) authentication bypass in SciSharp BotSharp through 5.2.0. WebStarter ships a published default HMAC JWT signing secret (CWE-321), so anyone holding it can forge bearer tokens that impersonate known users, including administrators. The post sets out how to confirm the effective key and serving build, a six-step SOC investigation trail, and remediation by rotating the secret. No verified fixed release, KEV entry or EPSS data existed at cutoff, and the linked research is static-only.
AppSec, Identity & Access, Blue Team & Detection· Added 13 Oct 2026, published 12 Oct 2026
x.comadvisoryAlert on CVE-2026-106610, a critical (CVSS 9.8) incorrect privilege assignment flaw in the miniOrange OTP Verification WordPress plugin, versions 5.5.7 and earlier. Unauthenticated remote attackers can gain elevated permissions, potentially administrator, with no user interaction. Fixed in 5.5.8; no in-the-wild exploitation or public PoC verified. It advises auditing unexpected admin accounts and role changes, and warns that Patchstack's mitigation blocks legitimate requests too.
AppSec, Identity & Access· Published and added 11 Oct 2026
x.comadvisoryCyberForge CVE of the Day #074 analyses CVE-2026-85097, a CVSS 9.8 unauthenticated file upload to PHP execution flaw (CWE-434) in the Bricksforge WordPress plugin through 3.1.8.9. Wordfence names 3.1.8.10 as the fix, and a separate vendor 4.0.1 Pro Forms upload-security notice has no verified mapping to the CVE. It gives a defender workflow: scope versions, preserve edge/origin logs, inspect resulting files and PHP-FPM handling, and verify the patched version is serving. It also separates KEV (no match), EPSS (0.312%) and SSVC (exploitation none) from compromise evidence.
Blue Team & Detection, AppSec· Added 11 Oct 2026, published 10 Oct 2026
cisa.govadvisoryJoint FBI/CISA/NSA and allied-agency advisory on China-linked actors enabled by Integrity Technology Group (overlapping with Flax Typhoon, Ethereal Panda, Red Juliett). It details their TTPs: open-source scanners and the MicroScan exploit-script app, an XSS credential-harvesting payload dropping live700_v1.exe, EBurst password spraying against Exchange/O365, SoftEther VPN persistence, DCSync via DC.exe, and email theft via the Curlc4.txt PHP bot and the office-cli utility. It also provides IOCs, MITRE ATT&CK mappings, CVEs, incident response steps, and mitigations.
Threat Intel, Blue Team & Detection· Added 9 Oct 2026
x.comadvisoryAlert summarizing Socket Threat Research's disclosure that a malicious version of the Tensorlake npm SDK (an AI-agent infrastructure package) was published with a preinstall hook delivering Shai-Hulud/ChainDrop credential-stealing malware. The payload targets GitHub, npm, AWS, Kubernetes and Vault credentials, persists via a gh-token-monitor mechanism, and spreads through compromised publishing accounts. It lists IOCs (lib/setup.mjs, lib/Math_Symbol.js) and warns to remove the persistence before revoking stolen GitHub tokens, since revocation triggers a destructive routine. Socket detected the release about 11 minutes after publication.
Supply Chain, Threat Intel· Added 11 Oct 2026, published 9 Oct 2026
x.comadvisoryCyberForge's CVE of the Day #073 covers CVE-2026-102255, a critical (CVSS 10.0) pre-authentication SSRF / confused-deputy flaw (CWE-918, CWE-441) in the SonicWall SMA1000 Work Place interface, per advisory SNWLID-2026-0017. It lists affected platform hotfixes (12.4.3-03526 and older, 12.5.0-02952 and older), fixed floors (12.4.3-03670, 12.5.0-03082), no workaround, and the exploitation picture (no known exploitation, not in KEV, EPSS 0.477%, SSVC automatable). It gives a six-step SOC playbook covering appliance scoping, AMC log preservation, hunting appliance-originated internal requests, correlating receiving-service changes, patching, and verifying every node, and it separates exposure, a lead, confirmed compromise and telemetry gaps.
Blue Team & Detection, AppSec· Added 12 Oct 2026, published 9 Oct 2026
securityweek.comadvisoryCitrix disclosed CVE-2026-107406 (CVSS 9.5), a critical memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service when appliances are configured as a SAML SP or SAML IdP, also affecting Secure Private Access Hybrid deployments using NetScaler. Patches are available in versions 14.1-73.46, 13.1-64.29, and the corresponding FIPS/NDcPP builds; Citrix says it is not aware of exploitation yet but urges immediate upgrades. The bulletin follows two other recently exploited NetScaler RCE/DoS zero-days (CVE-2026-88771, CVE-2026-88772) used against government, financial, education, legal, and professional-services organizations, and a separate DoS zero-day (CVE-2026-88779).
AppSec, Identity & Access· Published and added 9 Oct 2026
github.comadvisorySecurity-focused release notes for go-ethereum (Geth) v1.17.8, patching several denial-of-service vulnerabilities in the eth/snap p2p protocol handlers, hardening JUMPDEST analysis caching against post-Amsterdam-fork attacks, requiring IP verification before accepting discovery statements, fixing a rogue-STUN-server crash, and closing a DoS vector tied to BAL accounts. Most issues only become exploitable after the Amsterdam fork activates, and the release also includes RPC correctness fixes (eth_simulateV1, eth_createAccessList) and a Sparse Blobpool (EIP-8070) correctness bug.
Blockchain· Added 8 Oct 2026
endorlabs.comadvisoryEndor Labs documents the compromise of tensorlake@0.5.144, the official npm TypeScript SDK for Tensorlake, which shipped a Shai-Hulud worm payload via a poisoned preinstall hook (node lib/setup.mjs) after the project's main branch was altered and pushed through a legitimate, provenance-signed GitHub Actions release pipeline. The malware harvests npm, GitHub, SSH, cloud (AWS/GCP/Azure), Kubernetes/Docker and Vault credentials, uses an EtherHiding Ethereum wallet as a durable dead-drop to fetch its rotating C2 domain, and republishes itself into other packages the victim controls. The writeup includes affected package versions, file hashes, C2 indicators, and concrete remediation guidance (pin to 0.5.143, rotate credentials, disable install scripts).
Supply Chain, Threat Intel· Published and added 8 Oct 2026
blog.talosintelligence.comadvisoryCisco Talos discloses eight vulnerabilities patched by vendors: a Photoshop installer privilege escalation (CVE-2026-48388), a macOS CoreWLAN information disclosure bug, two Foxit Reader flaws including a JavaScript CBF_Widget remote code execution (CVE-2026-57256) and an Array use-after-free (CVE-2026-91799), and four Windows kernel-driver bugs — NETIO.sys information disclosure (CVE-2026-50475), two Cloud Files Mini Filter Driver issues (use-after-free CVE-2026-58613 and type confusion CVE-2026-80093), and a tcpip.sys out-of-bounds read (CVE-2026-49177). Each advisory gives the affected version and trigger mechanism, and Talos notes Snort coverage is available for detection.
AppSec, Offensive Security· Published and added 7 Oct 2026
orca.securityadvisoryOrca Security details CVE-2026-21589 (CVSS 9.3), a critical unauthenticated path traversal flaw affecting all versions of eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Insufficient path validation lets remote attackers read arbitrary files within the web application root without authentication, and in Crowd SSO deployments this can expose plaintext credentials usable to create administrative accounts and take over the entire Atlassian ecosystem. The advisory lists fixed versions for each product and recommends WAF rules and log review for organizations unable to patch immediately.
AppSec, Identity & Access· Published and added 7 Oct 2026
x.comadvisoryAnalysis of CVE-2026-105844, a CWE-1321 prototype-pollution vulnerability in @payloadcms/plugin-import-export that the vendor says can lead to unauthenticated remote code execution. It covers affected ranges (stable 3.0.0–3.87.x, canary 4.0.0-canary.0–canary.26), the fix (3.88.0 / 4.0.0-canary.27), the patched field-path guard against __proto__/constructor/prototype segments, and a six-step SOC hunting/triage playbook with two offline Python scripts for inspecting npm package trees and triaging request field-paths for prototype-sensitive values.
AppSec, Blue Team & Detection· Added 8 Oct 2026, published 7 Oct 2026
securityweek.comadvisoryAtlassian patched CVE-2026-21589 (CVSS 9.3), an unauthenticated arbitrary file access flaw affecting all versions of Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center. WatchTowr researcher Yordan Ganchev notes that organizations using Crowd for SSO are especially at risk because authentication details are stored in plaintext at a predictable path, letting attackers mint admin accounts if Crowd endpoints are internet-reachable. Fixed versions are listed for each product; Atlassian recommends immediate patching or disconnecting internet-facing instances, with WAF rules as a stopgap.
AppSec, Identity & Access· Published and added 7 Oct 2026
watchtowr.comadvisoryCVE-2026-21589 is an unauthenticated arbitrary file read (path traversal) in eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Atlassian fixed it on 5 October 2026, and CISA added it to the KEV catalog on 15 October 2026. The page lists patching, WAF regex, Tomcat RewriteValve and urlrewrite.xml mitigations, and a log check for ".." sequences after up to two rounds of URL decoding.
AppSec, Blue Team & Detection· Added 30 Oct 2026, published 6 Oct 2026
watchtowr.comadvisoryCVE-2026-21589 is an unauthenticated arbitrary file read in eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye Data Center. Attackers must know the exact file path, and watchTowr Intel observed exploitation by 6 October 2026. The FAQ covers the timeline (Atlassian advisory 5 October 2026), upgrade and WAF mitigations, and log searches for two dots next to a slash, backslash or double colon.
AppSec, Blue Team & Detection· Added 30 Oct 2026, published 6 Oct 2026
x.comadvisoryAtlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) unauthenticated path traversal flaw allowing remote attackers to read specific files within the web application root across its self-managed Data Center/Server products — Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Fixed versions are listed for each product (e.g. Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19), and Atlassian Cloud is already patched; WAF/URL-rewrite mitigations are available for those who can't upgrade immediately. The post's analyst note clarifies exploitation requires knowing the exact target file path (no directory listing), and as of Oct 5, 2026 it is not yet in CISA KEV with no public exploit reported.
AppSec· Added 7 Oct 2026, published 6 Oct 2026
orca.securityadvisoryAnalysis of CVE-2026-88779 (CVSS v4.0 8.7), an unauthenticated memory-overflow flaw in the nsaaad SAML authentication handler on Citrix NetScaler ADC/Gateway that lets attackers crash the SAML service and lock out VPN/SSO access indefinitely through repeated triggering. Affects NetScaler 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28 (plus FIPS/NDcPP builds); watchTowr Labs reproduced it via honeypot activity, Citrix confirmed targeted in-the-wild exploitation from IP 213.209.159.55, and CISA added it to KEV on 2026-10-04 with an Oct 7 federal remediation deadline. Some researchers suspect the overflow could extend to RCE beyond the documented DoS, though Citrix hasn't confirmed this.
Identity & Access, Threat Intel· Published and added 5 Oct 2026
cpr.dkadvisoryDenmark's CPR administration (Det Centrale Personregister) disclosed that unauthorized actors abused a Danish company's legitimate, authorized access to the CPR system to extract names, addresses and CPR (national ID) numbers for roughly 8.8 million registered citizens. Records of individuals with name/address protection were not exposed. CPR has revoked the company's access, notified the Danish Data Protection Agency (Datatilsynet), and the incident is being investigated by police alongside relevant authorities.
Threat Intel· Published and added 5 Oct 2026
x.comadvisoryCitrix issued emergency patches for CVE-2026-88779, a memory-overflow zero-day in NetScaler ADC/Gateway appliances configured as a SAML service provider or identity provider, rated CVSS v4.0 8.7. Citrix confirmed active, targeted exploitation against unmitigated deployments, with repeated exploitation causing denial of service and disrupting dependent authentication services.
AppSec, Identity & Access· Added 6 Oct 2026, published 5 Oct 2026
thehackernews.comadvisoryGitLab patched CVE-2026-90970, a critical (CVSS 9.9) flaw in the AI Gateway used by Duo Agent Platform, where a logged-in user with Duo Agent Platform access could craft a flow configuration to escape the prompt template sandbox and achieve arbitrary command execution on the gateway. Only self-managed organizations hosting their own AI Gateway (versions 18.1.6 through 19.1) need to act; the fix lands in 19.2.4, 19.3.2, and 19.4.1. The bug is a template engine weakness (CWE-1336), the same class as the earlier CVE-2026-1868 gateway RCE GitLab fixed in February, and was reported via HackerOne by researcher invisiblemeerkat.
AI Security, AppSec· Added 4 Oct 2026
cisa.govadvisoryCISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation. The alert restates the obligations of BOD 26-04 for Federal Civilian Executive Branch agencies: prioritise KEV CVEs on publicly exposed assets that give total control, and check for compromise before patching. It also describes the KEV nomination criteria: a CVE ID, evidence of exploitation and clear mitigation guidance. The page gives no technical detail, patch status or IOCs.
Threat Intel, GRC· Added 4 Oct 2026
support.apple.comadvisoryApple's official security content page for iOS 26.7.1 and iPadOS 26.7.1, released September 28, 2026, patching a single CoreGraphics vulnerability (CVE-2026-86950), an out-of-bounds write triggered by processing a maliciously crafted file, leading to arbitrary code execution. Apple states it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, with the issue reported by Meta Product Security.
Mobile Security, Threat Intel· Added 3 Oct 2026
thehackernews.comadvisoryCISA added CVE-2026-104286 (CVSS 9.8), a path traversal and NULL-byte handling flaw in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation. The bug lets unauthenticated attackers write arbitrary files via crafted HTTP/HTTPS requests, affecting FortiMail 7.2 through 8.0.1; Fortinet published workarounds (disabling IBE, restricting management-interface access) ahead of patches and shared attacker IPs and modified/added files as IOCs. The article also lists several other actively exploited vendor flaws disclosed the same week (Check Point, Arista VeloCloud, F5 BIG-IP APM, Cisco Catalyst SD-WAN Manager, Citrix NetScaler).
Threat Intel, AppSec· Added 3 Oct 2026
lwn.netadvisoryDebian Security Advisory DSA-6528-1 announces fixes for a very large batch of Linux kernel vulnerabilities (hundreds of CVEs spanning 2024-2026) affecting Debian's stable distribution (trixie). The issues may lead to privilege escalation, denial of service, or information leaks; all are fixed in kernel version 6.12.111-1, and users are advised to upgrade.
AppSec· Added 2 Oct 2026, published 1 Oct 2026
research.lido.fiadvisoryLido Finance's governance forum discloses that MetaMask Staking (formerly Consensys Staking), one of its Ethereum validator node operators, detected an infrastructure compromise and is precautionarily exiting its operated validators from the Lido protocol. The post details the exit/withdrawal/re-entry timeline (~45 days), the non-custodial nature of Lido staking (MetaMask does not hold withdrawal keys), and the protocol's ad hoc reserve fund (6,750+ stETH) as a mitigation mechanism while a full investigation continues.
Blockchain· Added 3 Oct 2026, published 30 Sep 2026
unit42.paloaltonetworks.comadvisoryUnit 42 threat brief on CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) in NetScaler ADC and Gateway, both CVSS v4.0 9.5 and exploited as zero-days from August 2026. It details version fingerprinting, .deb and PHP web shells, a three-stage log-poisoning chain through ns_monuploadd_err.pl, httpd.conf persistence, IOCs, and 50,277 exposed instances as of 27 September 2026.
Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 30 Sep 2026
rapid7.comadvisoryRapid7 analysis of CVE-2026-76504, a critical (CVSSv3.1 9.8) unauthenticated API authentication bypass in Cisco Catalyst SD-WAN Manager caused by improper URL-encoding handling (CWE-177), allowing attackers to gain admin-level API access via crafted requests to the j_security_check endpoint. The flaw is being actively exploited in the wild, was added to CISA's KEV list on October 1, 2026 with a remediation deadline of October 3, and follows two earlier 2026 Catalyst SD-WAN peering authentication bypasses (CVE-2026-20127 and Rapid7-discovered CVE-2026-20182). The post gives fixed-release guidance, no-workaround caveats, and log-based IOCs (encoded-character requests like %6a_security_check, viptela-reserved- usernames) for detecting compromise.
AppSec, Threat Intel· Added 7 Oct 2026, published 30 Sep 2026
soliditylang.orgadvisoryOfficial release notes for Solidity v0.8.37 detailing three bug-bounty-reported compiler bugs: memory `delete` on a bytes-array element zeroing a full 32-byte word instead of one byte (corrupting adjacent memory, evmasm pipeline, up to v0.8.36); a stack-to-memory spill-slot collision under mutual recursion in the IR pipeline (`--via-ir`, v0.7.2–v0.8.36) that silently overwrites live variables; and named custom-error arguments in `require(...)` being ABI-encoded in call-site order rather than declaration order, so revert data misrepresents error values (v0.8.36 introduced but only affects revert data). Also covers two non-security miscompilations (uninitialized packed function pointers, checked/unchecked constant reuse), a new SSA-CFG stack shuffler, Amsterdam EVM's SLOTNUM opcode support, and removal/deprecation of LSP mode, Generic Solidity, and several EVM version pragmas.
Blockchain· Added 29 Sep 2026
orca.securityadvisoryAnalysis of two CVSS 9.5 Citrix NetScaler ADC/Gateway zero-days, CVE-2026-88771 (unauthenticated RCE through improper input validation in the management interface, affecting default deployments) and CVE-2026-88772 (memory overflow in DTLS, enabled by default on VPN virtual servers). It lists six more high-severity flaws patched in advisory CTX697096, the affected and fixed versions, and the CISA KEV listing with a federal deadline of 2026-09-30. It advises checking for compromise before patching, since patching can destroy forensic evidence, and gives response steps: isolate, revoke credentials, rebuild firmware, rotate keys and certificates.
Cloud & Infra, Threat Intel· Published and added 29 Sep 2026
cisa.govadvisoryCISA alert amplifying Citrix's disclosure of ten NetScaler ADC and Gateway vulnerabilities (CVE-2026-88771 to CVE-2026-88779 and CVE-2026-107406). CVE-2026-88771 and CVE-2026-88772 are critical zero-days enabling independent remote code execution and are exploited globally; CVE-2026-88779 is a SAML SP/IdP denial-of-service that can force a reboot to trigger code injected via CVE-2026-88771. It advises checking for compromise before patching, preserving forensic evidence, forwarding logs to a SIEM, restoring a pre-compromise backup and rotating all secrets, and links a CISA SIGMA detection rule.
Threat Intel, Blue Team & Detection· Added 28 Sep 2026
github.comadvisoryGHSA-v234-4jrq-mgg6 discloses that Claude Desktop for macOS (versions >=1.1.3918, less than 1.15962.0) omitted a macOS-executable file type from its Cowork folder block-list, letting a malicious file written into a Cowork sandbox's shared folder by a compromised or prompt-injected agent run commands on the host when opened via Claude Desktop. A separate, compounding issue is also disclosed: Cowork VM images before 1.11847.5 shipped a guest Linux kernel vulnerable to CVE-2026-43284, which combined with the block-list gap could let VM-privileged code trigger the file open without user interaction. Both issues are fixed in Claude Desktop 1.15962.0; reported internally by Anthropic and independently by Vladimir Tokarev of Cyera Research.
AI Security· Added 28 Sep 2026
rapid7.comadvisoryRapid7 details active zero-day exploitation of two critical Citrix NetScaler ADC/Gateway RCE vulnerabilities (CVE-2026-88771, CVE-2026-88772, both CVSSv4 9.5), both added to CISA KEV on disclosure day, plus a later SAML denial-of-service zero-day (CVE-2026-88779). The post includes Rapid7 MDR's observed exploitation of CVE-2026-88771 in the wild — a command-injection payload that exfiltrates /flash/nsconfig (containing ns.conf admin credentials, SSL private keys, SSH host keys) via the publicly-served /vpn/ path, and a webshell (SHA256 hash provided) found on a compromised appliance — along with vendor patch versions and detection guidance.
Threat Intel, AppSec· Added 7 Oct 2026, published 28 Sep 2026
watchtowr.comadvisorywatchTowr details CVE-2026-88771 (unauthenticated command execution via improper input validation, affecting every NetScaler ADC/Gateway deployment by default) and CVE-2026-88772 (DTLS memory overflow leading to RCE/DoS, exploitable since DTLS is on by default for VPN virtual servers). Both are confirmed exploited in the wild as zero-days, were pre-notified by NCSC-NL, and CVE-2026-88771 was added to the CISA KEV catalog on September 27, 2026; Citrix's bulletin CTX697096 also fixes six related issues (CVE-2026-88773 through CVE-2026-88778). The writeup gives prioritization guidance, IOC-checking steps, and warns that patching may destroy forensic evidence if done before evidence capture.
Threat Intel, Offensive Security· Added 5 Oct 2026, published 27 Sep 2026
cisa.govadvisoryCISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-09-22 based on evidence of active exploitation: two Check Point multi-product flaws (improper certificate validation CVE-2026-85102, path traversal CVE-2026-93616), an Arista VeloCloud Orchestrator improper input validation bug (CVE-2026-93952), and an F5 BIG-IP APM heap-based buffer overflow (CVE-2026-94127). The alert ties the additions to BOD 26-04, which has FCEB agencies prioritize remediation of KEV CVEs on publicly exposed assets that give total control, and to checking for prior compromise before patching.
Threat Intel, GRC· Added 26 Sep 2026
thehackernews.comadvisoryCVE-2026-87902 (CVSS 9.2) is an unauthenticated WordPress vulnerability where get_page_template() page-template resolution can be tricked into including an attacker-chosen local .php file outside the active theme directory, leading to RCE when a theme has a page-* top-level directory and a readable local PHP file (e.g. pearcmd.php) exists. Attackers began exploiting it within hours of the September 22, 2026 patch, including pearcmd.php to write PHP web shells to /tmp and /var/tmp and pulling a GitHub-hosted uploader payload, per honeypot telemetry from Previdian and Patchstack with tracked source IPs. CISA added the flaw to its KEV catalog on September 25, 2026, mandating FCEB remediation by September 28; fixed in WordPress 7.1.2, 7.0.6, 6.9.9, and 6.8.10.
AppSec, Threat Intel· Added 26 Sep 2026
github.comadvisoryGitHub Security Advisory (CVE-2026-13341) for Kong's mcp-konnect MCP server describes a stored prompt injection vulnerability where a remote attacker crafts malicious request metadata (e.g. User-Agent) that gets stored in Konnect analytics and later returned unsanitized to an AI assistant via MCP tools, potentially causing the agent to exfiltrate sensitive data (plugin configs, secrets, internal hostnames) to an attacker-controlled URL if the client can make outbound fetches. A related path manipulation flaw in control plane/group identifiers allowed requesting unintended Konnect API endpoints with the user's token. The v1.0.0 patch neutralizes untrusted analytics fields, validates identifiers as UUIDs, encodes path segments, and disables raw plugin config output by default.
AI Security· Added 26 Sep 2026
vuldb.comadvisoryVulDB entry for CVE-2026-90617, a remote OS command injection (CWE-78) in GH05TCREW PentestAgent. The flaw is in run_task in interface/main.py of the MCP HTTP Server, affects everything up to commit cf882dab, and has a public exploit. The product uses rolling releases, so no version ranges exist, and the fix is an unmerged pull request. The analysis suggests compensating controls: restrict network access to the MCP server, run with least privilege, and validate input upstream.
AppSec, AI Security· Added 26 Sep 2026
vuldb.comadvisoryCVE-2026-85787 affects awslabs postgres-mcp-server before 1.1.7. The SQL validation component uses an incomplete list of disallowed inputs. Crafted SQL placed in content submitted while an authenticated user interacts with the MCP server can bypass the read-only restriction and modify data in PostgreSQL. The fix is to upgrade to 1.1.7 or later. VulDB's added analysis is generic: it points to SQL injection (CWE-89) and recommends least-privilege database accounts and parameterized queries.
AppSec, AI Security· Added 26 Sep 2026
vuldb.comadvisoryCVE-2026-85661 affects excel-mcp-server 0.1.8. In stdio mode with EXCEL_FILES_PATH unset, the server does not confine file paths, so a client can pass relative or absolute paths to the read and write tools. That gives arbitrary file read and write with the privileges of the server process. The page classifies it as CWE-22 (ATT&CK T1083) and recommends canonical path checks against a base directory, making EXCEL_FILES_PATH mandatory, and running with least privilege.
AppSec, AI Security· Added 26 Sep 2026
thehackernews.comadvisoryServiceNow patched CVE-2025-12420, nicknamed BodySnatcher, a CVSS 9.3 flaw in its Now Assist AI Agents (sn_aia) and Virtual Agent API (sn_va_as_service) that let an unauthenticated attacker impersonate any user via just an email address. Discovered by Aaron Costello of AppOmni, the bug chains a hardcoded platform-wide secret with account-linking logic to bypass MFA and SSO, letting an attacker remotely drive privileged agentic AI workflows, impersonate admins, and create backdoor accounts. Fixed in sn_aia 5.1.18+/5.2.19+ and sn_va_as_service 3.15.2+/4.0.4+, patched October 30, 2025 with no known in-the-wild exploitation.
AI Security, Identity & Access· Added 26 Sep 2026
osv.devadvisoryCVE-2026-91931 is a critical remote code execution vulnerability in Flowise versions before 3.1.4, triggered through the platform's Custom MCP feature which invokes npx to run Model Context Protocol servers. A fix is available in 3.1.4; the flaw scores 9.0 (Critical) on CVSS, indicating an attacker can achieve arbitrary code execution likely via unsanitized input to the npx invocation path.
AI Security, AppSec· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-75130 describes a prompt injection flaw in Context7 (through v2.1.2), an MCP server that serves library documentation to AI coding agents. The vulnerability lies in the Custom AI Instructions feature, which fails to sanitize content before injecting it into agent context; attackers can poison these instructions so that a routine documentation lookup triggers the agent to exfiltrate credentials from environment files and delete files on the victim's machine. Researchers at Noma Security and VulnCheck published independent technical breakdowns of the attack chain.
AI Security· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-65695 is a path traversal vulnerability (CWE-22, CVSS 4.0 7.6 HIGH) in Office-Word-MCP-Server through version 1.1.11, an MCP server that exposes Word document manipulation tools to LLM agents. Attackers who can influence the filename argument can supply absolute paths or ../ sequences to document open/save operations, bypassing the check_file_writeable and ensure_docx_extension helpers (which do no base-directory confinement or realpath validation) to read or overwrite arbitrary .docx files outside the intended working directory.
AI Security, AppSec· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-65056 describes a server-side request forgery in the mcp-webresearch MCP server (npm package @mzxrai/mcp-webresearch, v0.1.7), scoring CVSS 4.0 8.3 HIGH. The visit_page tool only validates URL protocol and does not filter private, loopback, link-local, or cloud metadata IP ranges, so an attacker who controls the LLM-supplied URL argument (e.g. via prompt injection) can steer the server's Playwright browser to internal endpoints like cloud instance metadata services and exfiltrate sensitive internal content, including credentials, back into the model context.
AI Security, AppSec· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-57860 describes an arbitrary code execution flaw in ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI that automatically loads and executes MCP servers defined in a repository's .mcp.json on startup without user confirmation. A malicious repo can define mcpServers entries with arbitrary command/args (e.g. bash -c) that spawn under the invoking user's privileges the moment forge is run inside the cloned repo, giving attackers a reliable initial-access and persistence primitive against developers evaluating untrusted code. CVSS 4.0 8.4 HIGH, CWE-829 (inclusion of functionality from untrusted control sphere); a fix commit and VulnCheck advisory are linked.
AI Security· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-55544 describes an authorization bypass (IDOR/BOLA) in NextCRM CRM version 0.12.1, where MCP campaign tool handlers accept user-generated Bearer API tokens but query and mutate campaigns purely by object ID, ignoring the authenticated user's ownership scope. A low-privileged user with a valid MCP token can enumerate, read, modify, delete, or trigger/pause campaigns belonging to other users. Fixed in NextCRM 0.12.2.
AppSec· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-52869 describes a session-hijacking flaw in the MCP Python SDK (PyPI package mcp) prior to version 1.27.2: the SSE and stateful Streamable HTTP transports (mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager) route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header, without checking that the requesting principal matches the session's original authenticated bearer-token client. This lets a different authenticated client that learns or guesses a valid session ID inject JSON-RPC messages into another user's MCP session. CVSS 3.1 base score 7.1 (High); fixed in mcp 1.27.2.
AppSec· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-49291 affects mcp-memory-service prior to version 10.65.3: its HTTP MCP JSON-RPC endpoint at /mcp only enforced OAuth 'read' scope before dispatching tools/call requests, so a client holding only read access could invoke mutating tools like store_memory and delete_memory even though the equivalent REST endpoints correctly required 'write' scope. The flaw is a classic missing-authorization bug (CWE-862) surfacing specifically in an MCP tool-dispatch layer, scored CVSS 3.1 8.1 (High) with confidentiality unaffected but integrity and availability impacted. Fixed in 10.65.3.
AppSec, Identity & Access· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-42271 describes an unauthenticated-privilege RCE in LiteLLM (versions 1.74.2 to before 1.83.7): the MCP server preview endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list accept a full stdio MCP server config (command, args, env) and spawn it as a subprocess on the proxy host, gated only by a valid API key with no role check. Any authenticated user, including low-privilege internal-user keys, could run arbitrary commands on the LiteLLM proxy host. Patched in v1.83.7; also tracked as GHSA-v4p8-mg3p-g94g and affects Red Hat OpenShift AI.
AppSec, AI Security· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-20685 is a medium-severity (CVSS 6.5) path handling vulnerability in Apple's Private Cloud Compute (PCC), classified under CWE-20 and CWE-22, that could let an attacker in a privileged network position leak sensitive information. Apple addressed the issue with improved path validation, fixed in PCC Release 5E290.3.
AppSec· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-19984 describes a server-side request forgery flaw in jkawamoto mcp-florence2 (up to 0.3.13), an MCP server wrapping Microsoft Florence-2 image model. The vulnerable get_images function in src/mcp_florence2/__init__.py passes an attacker-controlled src argument into an HTTP fetch without validation, letting a remote caller force the server to request arbitrary internal or external URLs. The maintainer recommended fix is deploying an SSRF-safe egress proxy rather than patching the source, and a public exploit is available.
AppSec· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-19978 describes an OS command injection (CWE-77/78) in jiantao88's android-mcp-server, where the child_process.exec call in build/index.js fails to sanitize the deviceId, packageName, permission, and extras[].key/value arguments used to control Android devices. The flaw allows local command execution and has a published exploit; it was fixed in commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. CVSS 4.0 base score is 1.9 (local attack vector only), and the project uses rolling releases so no fixed version numbers are assigned.
AppSec, Mobile Security· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-18655 describes an improper endpoint restriction flaw (CWE-923) in the RabbitMQ broker connection tools of awslabs.amazon-mq-mcp-server versions before 2.0.24. A remote unauthenticated attacker can use prompt injection introduced into the MCP client context to redirect the broker hostname to an attacker-controlled endpoint, causing Amazon MQ for RabbitMQ credentials or OAuth access tokens to be sent there; CVSS 4.0 base score 7.1 (High). Fixed in version 2.0.24, referenced via an AWS security bulletin and a GitHub security advisory (GHSA-xwj6-8x5h-hjp6).
AI Security, Cloud & Infra· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-16584 affects AWS API MCP Server (awslabs.aws-api-mcp-server) versions 0.2.13 through 1.3.46: if the security policy enforcement data fails to initialize at server startup, the tool silently skips policy checks for the rest of the process's life, letting an agent execute AWS API operations the admin configured the policy to deny or gate. Underlying IAM permissions still apply and are unaffected, but the intended allow/deny gating layer is bypassed (CWE-455, improper handling of initialization failure). Fixed in 1.3.47.
AI Security, Cloud & Infra· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-16498 is a critical (CVSS 3.1: 10.0) exposure-of-sensitive-information flaw (CWE-488) in HashiCorp's terraform-mcp-server prior to version 1.1.0. In stateless streamable-HTTP transport mode, one user's Terraform API token could be reused to execute tool calls on behalf of a different, subsequent user, breaking tenant isolation in shared MCP server deployments. Fixed in terraform-mcp-server 1.1.0; further detail is tracked in HashiCorp's HCSEC-2026-23 advisory.
AI Security, AppSec, Identity & Access· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-14748 is a low-severity (CVSS 4.0: 2.1) server-side request forgery flaw in AIAnytime's Awesome-MCP-Server, specifically in the mcp-wiki/wiki-summary component's server.py, where the url argument is not validated before the server fetches it. A remote, low-privilege attacker can abuse this to make the MCP server issue arbitrary outbound requests; the exploit has already been published via GitHub issues and the maintainer has not responded to the disclosure.
AppSec, AI Security· Added 26 Sep 2026
nvd.nist.govadvisoryCVE-2026-14541 describes an authentication bypass (CWE-287) in the Google OAuth provider of Google's mcp-toolbox for databases v1.4.0, an MCP server that lets LLM agents query databases. When the Google authService is configured with mcpEnabled: true but no explicit audience or clientId, the ValidateMCPAuth pipeline skips audience checks for opaque tokens, so any valid Google OAuth access token — even one issued for an unrelated app — is accepted, letting unauthorized clients reach protected tools and data backends.
Identity & Access, AI Security· Added 26 Sep 2026
github.comadvisoryGHSA advisory for SiYuan v3.7.1 (CVE-2026-66012) describing how the kernel's POST /mcp route registers 31 MCP tools — including a file tool with full read/write/delete/rename/copy over the workspace — gated only by CheckAuth with no admin or read-only check. When the Publish server runs in anonymous mode (a documented configuration for public docs sites), the Publish reverse proxy attaches an anonymous RoleReader JWT to every proxied request, letting an unauthenticated attacker reach /mcp, exfiltrate accessAuthCode/api.token/cookieKey from conf.json, escalate to Administrator, and plant a malicious Electron plugin (nodeIntegration:true, contextIsolation:false) for RCE on the desktop client. Includes a full working PoC and remediation (CheckAdminRole gate, proxy path allowlist, restricting the file tool).
AppSec· Added 26 Sep 2026
github.comadvisoryn8n's AI Agents module did not enforce the "Allowed HTTP Request Domains" restriction on credentials. A member-level user with use-only access to a shared credential could point an MCP tool at an attacker-controlled URL and run the agent, so the credential secret was sent to an external server. It only affects instances with the agents module enabled via N8N_ENABLED_MODULES and a domain-restricted credential shared with a member. It is fixed in 2.28.1 and 2.27.4, and the advisory rates it High (CVSS v4 7.1).
AppSec, AI Security, Identity & Access· Added 26 Sep 2026
github.comadvisoryn8n GitHub advisory GHSA-9r8p-h6cc-6qhm: when configured with a Google Service Account key, n8n put the full PEM private key into the JWT header's kid field. Because JWT headers are only Base64-encoded, anything that logged or inspected the JWT (proxies, load balancers, app logs) could recover the key and impersonate the service account in Google Cloud. Fixed in 1.123.64, 2.29.8 and 2.30.1; rated Moderate (CVSS v4 5.1), with workarounds to rotate keys and review logs for exposed JWT headers.
AppSec, Cloud & Infra· Added 26 Sep 2026
github.comadvisoryA GitHub Security Advisory (GHSA-5p9g-j988-pcwv) documents a session poisoning flaw in the Ruby MCP SDK's Streamable/SSE HTTP transport: the server never validates that a POST to /messages/{session_id} actually belongs to the caller, so an attacker who obtains a victim's session ID (e.g. via logs or network sniffing) can silently execute tool calls whose responses are delivered into the victim's own SSE stream. The advisory includes a working PoC (attacker/legitimate client scripts against the SDK's example streamable_http_server.rb), notes that csharp-sdk and go-sdk correctly bind sessions to user identity while ruby-sdk does not, and distinguishes the bug from the related "Stream Replacement" advisory (GHSA-qvqr-5cv7-wh35), which disconnects rather than poisons the victim's stream.
AI Security, AppSec· Added 26 Sep 2026
github.comadvisoryGHSA advisory for jovancoding/network-ai disclosing that its MCP HTTP transport (bin/mcp-server.ts, lib/mcp-transport-sse.ts) accepts JSON-RPC tools/call requests with zero authentication, session, or origin checks, and binds to 0.0.0.0 by default. The PoC shows an unauthenticated attacker can enumerate 22 registered tools and invoke privileged ones - config_get/config_set to read and mutate live orchestrator configuration, agent_list/agent_spawn/agent_stop, token_create/token_revoke, budget_set_ceiling, and blackboard_write/delete - with curl requests against a local Docker deployment. Remediation recommended enforcing bearer-token auth in _handlePost() before dispatch, defaulting to 127.0.0.1 binding, and gating state-mutating tools behind authorization checks.
AI Security, AppSec· Added 26 Sep 2026
github.comadvisoryGHSA-9hgc-g3w5-67cm details a DNS TOCTOU race in IBM mcp-context-forge's /admin/gateways/test endpoint: validate_gateway_test_url() resolves and vets a hostname against private/cloud-metadata IP ranges, but the actual request is made with httpx (via ResilientHttpClient), which independently re-resolves DNS at connection time with no IP pinning. An attacker with gateways.read permission can exploit DNS rebinding (short-TTL record flipping from a public IP to 169.254.169.254) to bypass SSRF protections and reach cloud instance metadata, exfiltrating IAM credentials where IMDSv1 is enabled. The advisory notes the codebase already acknowledges the gap in two comments and a tracked TODO (ICACF-15), and recommends pinning the validated IP into the connection.
AppSec· Added 26 Sep 2026
github.comadvisoryGHSA advisory detailing three bypasses in Flowise's Custom MCP Server security controls (validateCommandFlags and validateArgsForLocalFileAccess in packages/components/nodes/tools/MCP/core.ts) that combine to achieve remote code execution: an unblocked `docker build` subcommand that pulls and runs a remote Dockerfile, a missing `--yes` long-flag alias on the npx blocklist (only `-y` was blocked) enabling arbitrary npm package execution, and a Unix absolute-path regex that fails to catch double-leading-slash paths (`//root/...`), allowing `node` to execute an uploaded local file. Any authenticated Flowise user (or an API key with chatflow view/update rights) can chain these to fully compromise the host via a prediction API call.
AI Security, AppSec· Added 26 Sep 2026
github.comadvisoryGHSA advisory for better-auth (< 1.6.11) documenting that the deprecated oidcProvider() and mcp() plugins publish "none" as a supported ID-token signing algorithm in their OIDC discovery document and default allowPlainCodeChallengeMethod to true, silently rewriting missing code_challenge_method to "plain" — both violating OAuth 2.1/RFC 9700. The fix removes "none" from the metadata, defaults plain PKCE to disabled, and rejects requests missing code_challenge_method instead of downgrading them; @better-auth/oauth-provider was never affected.
Identity & Access· Added 26 Sep 2026
github.comadvisoryGitHub advisory GHSA-jh7p-qr78-84p7 for Claude Code: a malicious repository could ship a project settings file setting ANTHROPIC_BASE_URL to an attacker-controlled endpoint. Claude Code made API requests during project load before the trust prompt was shown, leaking data including the user's Anthropic API key. Fixed in auto-updated versions; manual updaters should upgrade. It is CVSS v4 scored, with network attack vector and passive user interaction, and mapped to a credential-transmission weakness (insecure transmission/storage of credentials).
AI Security, AppSec· Added 26 Sep 2026
github.comadvisoryGitHub advisory for @yoda.digital/gitlab-mcp-server (mcp-gitlab-server): with USE_SSE=true the HTTP/SSE transport has no authentication, sends wildcard CORS headers, and binds to 0.0.0.0. Any network caller or any web page the operator visits can open /sse and POST /messages to drive all 86 GitLab tools (delete_repository, push_files, etc.) using the operator's personal access token. It includes a curl PoC, a CVSS 4.0 vector (~6.3 Medium, effectively High when SSE is enabled) and four fixes: required auth token, loopback bind, a CORS allowlist, and the OAuth roadmap.
AI Security, AppSec· Added 26 Sep 2026
cisa.govadvisoryJoint guidance from CISA, the Australian Signals Directorate's ACSC and other international and US partners on adopting agentic AI systems. It covers the main security challenges and risks of agentic systems, with steps for designing, deploying and operating them safely. It also shows how to map agentic risk management onto existing cybersecurity frameworks and strengthen oversight. The page text calls them "agentic super intelligence (SI)" systems, but the URL says agentic AI services.
AI Security, GRC· Added 26 Sep 2026
cisa.govadvisoryCISA added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog on the basis of active exploitation. They are SQL injection in Sangoma Switchvox, HTTP request/response smuggling in Kludex Starlette, OS command injection in Kestra OSS, improper authentication in BerriAI LiteLLM and JFrog Artifactory, and SSRF plus OS command injection in SonicWall SMA1000 appliances. The alert restates BOD 26-04, which makes federal agencies prioritise rapid remediation of KEV CVEs on publicly exposed assets that grant total control after exploitation. It also requires agencies to check for prior compromise before patching.
AppSec, GRC· Added 26 Sep 2026
ccb.belgium.beadvisoryBelgian CCB advisory on CVE-2026-48710 ("BadHost", CVSS 6.5), an authentication bypass in Starlette versions before 1.0.1. The Host header was not validated when request.url was rebuilt, so request.url.path could differ from the routed path. Middleware and endpoints that enforce access control on request.url could therefore be bypassed. The flaw affects FastAPI, LiteLLM, vLLM, MCP servers and other Python LLM infrastructure, and may expose stored third-party credentials. The advisory recommends upgrading to 1.0.1 or later and increasing monitoring, and links to the badhost.org scanner and to the GitHub, OSTIF, X41 D-Sec and Ars Technica write-ups.
AppSec, AI Security· Added 26 Sep 2026
aws.amazon.comadvisoryAWS bulletin 2026-105-AWS discloses CVE-2026-87912 and CVE-2026-87913: the AWS Security Agent plugin (aws-agents-for-devsecops, <1.1.0) and its MCP server (<0.2.0) write scan output to a predictably-named S3 bucket (security-agent-scans-<account-id>-<region>) without verifying bucket ownership. An attacker who pre-registers that bucket name in their own account can obtain the victim's private source archive, including embedded credentials and infrastructure state. AWS recommends upgrading to 0.2.0 and manually verifying/pre-creating the scan bucket to prevent squatting.
Cloud & Infra, AI Security· Added 26 Sep 2026
aws.amazon.comadvisoryAWS bulletin for CVE-2026-87911, an OS command injection flaw in awslabs.postgres-mcp-server (Python, PyPI) versions before 1.1.7. The server's read-only enforcement in its SQL validation component can be bypassed with a crafted `COPY ... TO PROGRAM` statement, letting an unauthenticated actor run OS commands on a self-managed PostgreSQL host when the configured connection role holds superuser or pg_execute_server_program privileges. Fixed in 1.1.7; AWS also recommends connecting the MCP server with a least-privilege, non-superuser role as defense in depth.
AppSec, AI Security· Added 26 Sep 2026
rapid7.comadvisoryRapid7's ETR writeup covers CVE-2026-94127, a critical heap-based buffer overflow (CVSS 9.8) in F5 BIG-IP Access Policy Manager that allows unauthenticated remote code execution via crafted traffic. Exploitation requires a virtual server with both an APM access policy and an OAuth profile configured, affects the data plane (including Appliance mode), and has been added to CISA KEV; F5 provides hotfixes for the 21.1.0, 17.5.0, and 17.1.0 release trains plus an iRule workaround for those unable to patch immediately.
Cloud & Infra, Identity & Access· Added 7 Oct 2026, published 23 Sep 2026
orca.securityadvisoryCVE-2026-93485 (CVSS 7.1) is a stored XSS-to-RCE chain in WordPress Core's wpautop() function (wp-includes/formatting.php), where a mismatch between comment sanitization at save time and HTML reformatting at display time lets an unauthenticated attacker inject live event handlers via a crafted comment. When a logged-in administrator views the page, the script executes and installs a malicious plugin containing a web shell, achieving full RCE. It affects WordPress Core 4.7 through 7.1.0 (essentially all installs, including block themes since Twenty Twenty-Two), and is fixed in 7.1.1 with backports down to 4.7.36; no public PoC or in-the-wild exploitation was reported at disclosure time.
AppSec· Published and added 22 Sep 2026
wordpress.orgadvisoryWordPress 7.1.2 patches CVE-2026-87902 (GHSA-7hp8-65ch-5whp), a critical unauthenticated path-traversal flaw where page template resolution can be manipulated to include an attacker-chosen readable local PHP file outside the active theme directory. Under certain server and active-theme preconditions this local file inclusion escalates to remote code execution. The security fix was backported to all WordPress branches back to 4.7; discovery credited to researcher Robert Ressl.
AppSec· Added 28 Sep 2026, published 22 Sep 2026
thehackernews.comadvisoryCisco disclosed CVE-2026-76460 (CVSS 10.0), an unauthenticated API authentication bypass in Identity Services Engine (ISE) and ISE-PIC that is under active exploitation and has been added to CISA's KEV catalog with a federal patch deadline of September 19, 2026; successful exploitation can yield root command execution, and Cisco provides log-based IOC detection guidance since there is no workaround. The same disclosure batch includes 77 new CVEs, 41 in ISE and 28 in Secure Firewall (ASA/FTD/FMC), covering authenticated RCE, SQL injection, XXE, command injection, and additional REST API auth bypasses, plus a separately exploited Secure Email Gateway flaw (CVE-2026-76461, CVSS 9.8).
AppSec, Identity & Access· Added 22 Sep 2026
copy.failadvisoryCopy Fail (CVE-2026-31431) is a 9-year-old Linux kernel logic bug in algif_aead, reachable via the AF_ALG crypto API and chained through splice() into a 4-byte page-cache write to achieve local root, affecting kernels built between 2017 and the fix. The site publishes a 732-byte stdlib-only Python PoC that roots multiple distributions unmodified, identifies the fixing mainline commit a664bf3d603d, and gives interim mitigation (disable algif_aead / seccomp-block AF_ALG for untrusted workloads). The bug was found by Xint Code's AI-assisted fuzzing against the Linux crypto/ subsystem in roughly an hour of scan time.
Offensive Security, AI Security· Added 17 Sep 2026
collective.flashbots.netadvisoryFlashbots disclosed a critical storage-aliasing vulnerability in V1 of the Priority Update Registry (PUR), an on-chain price feed contract used by trading integrators like propAMMs. Because lane storage slots were computed as keccak256(target, unbounded caller-controlled index) while the updater-authorization mapping lived at slot 0 with the same keccak256 shape, any caller could craft a lane index that collided with isUpdater[target][attacker], letting them self-authorize as an updater and publish arbitrary prices or deauthorize legitimate updaters. The fix namespaces the lane slot derivation (keccak256(NAMESPACE, target, laneIndex)) to make the preimages structurally non-collidable, and the advisory gives integrators concrete migration guidance since authorizations and lane state must be re-established on the new deployment.
Blockchain· Added 2 Oct 2026, published 16 Sep 2026
rapid7.comadvisoryRapid7's emerging threat response write-up on CVE-2026-76461, a critical (CVSS 9.8) SQL injection vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows an unauthenticated remote attacker to achieve root command execution by sending a specially crafted email. Cisco confirmed active zero-day exploitation and the vulnerability was added to CISA's KEV catalog the same day it was disclosed; the post provides mitigation guidance (emergency patching to 16.5.0-780) and a log-grep IOC (searching mail_logs for COPY.*TO PROGRAM) to detect exploitation attempts.
AppSec, Threat Intel· Added 7 Oct 2026, published 15 Sep 2026
orca.securityadvisoryDetails CVE-2026-85706 (CVSS 10.0), an unauthenticated arbitrary file read in GitLab CE/EE's repository commits API exploitable via a crafted file.path parameter in a single POST request, requiring only that one public project exist on the instance. It also covers CVE-2026-87719 (CVSS 9.9), an authenticated insecure deserialization bug in GitLab EE's GraphQL subscription serializer reachable via Duo Chat access that leaks stored Elasticsearch/OpenSearch credentials. Both affect GitLab versions through 19.3.1; CVE-2026-85706 is under active internet-wide scanning per WatchTowr Labs and is in CISA's KEV catalog with a federal patch deadline, with fixes in GitLab 19.1.8/19.2.6/19.3.2.
AppSec, Threat Intel· Published and added 14 Sep 2026
rapid7.comadvisoryGitLab patched CVE-2026-85706, a critical (CVSS 10.0) path traversal flaw (CWE-22) in the repository commits API that lets an unauthenticated attacker read arbitrary files from self-managed GitLab CE/EE instances; CISA added it to the KEV catalog on September 11, 2026 due to active exploitation, with a remediation deadline of September 14. The same patch release fixes CVE-2026-87719, a critical insecure deserialization bug (CWE-502) letting an authenticated Duo Chat user exfiltrate Advanced Search configs and credentials via a crafted GraphQL subscription argument, plus 17 other vulnerabilities. Rapid7 recommends emergency patching and post-patch compromise checks given confirmed in-the-wild exploitation.
AppSec, Threat Intel· Added 7 Oct 2026, published 14 Sep 2026
horizon3.aiadvisoryCVE-2026-85706 is a CVSS 10.0 critical path traversal vulnerability in GitLab CE/EE's repository commits API, caused by improper path confinement combined with missing authentication enforcement. It allows unauthenticated, remote attackers to read arbitrary files from the GitLab server — potentially exposing credentials, secrets, tokens, SSH keys, and database credentials. Affects versions 18.7 through 19.1.7, 19.2.0-19.2.5, and 19.3.0-19.3.1; fixed in 19.1.8, 19.2.6, and 19.3.2.
AppSec· Added 17 Sep 2026, published 11 Sep 2026
watchtowr.comadvisorywatchTowr's rapid-reaction analysis of CVE-2026-85706, a critical (CVSS 10.0) unauthenticated path traversal in GitLab CE/EE's repository commits API, patched in versions 19.3.2, 19.2.6, and 19.1.8. The flaw lets an unauthenticated attacker read arbitrary files (configs, secrets) from self-managed GitLab servers via crafted requests to /api/v4/projects/{id}/repository/commits/ with a file.path parameter; watchTowr reproduced the bug and reports honeypot probes indicating attackers have already reverse-engineered it ahead of mass exploitation.
AppSec· Added 21 Sep 2026, published 11 Sep 2026
watchtowr.comadvisorywatchTowr's rapid-reaction analysis of CVE-2026-85706, a critical (CVSS 10.0) unauthenticated path traversal vulnerability in the GitLab CE/EE repository commits API, patched in versions 19.3.2, 19.2.6, and 19.1.8. The flaw allows an unauthenticated attacker to read arbitrary server-side files via the commits API due to improper path confinement and missing auth enforcement; watchTowr's honeypot network was already observing exploitation probes at time of publication. The post includes hunting guidance (searching logs for POST requests to /api/v4/projects/{id}/repository/commits/ containing file.path parameters) and patching priorities for self-managed instances.
AppSec· Added 16 Sep 2026, published 11 Sep 2026
wiz.ioadvisoryWiz Research documents active in-the-wild exploitation of three JFrog Artifactory vulnerabilities: CVE-2026-42018 (exposes an internal anonymous-user JWT via POST /access/api/v1/aws/token/), CVE-2026-42016 (token scope validation flaw allowing that JWT to be escalated to admin via POST /access/api/v1/tokens), and CVE-2026-82329 (unauthenticated admin access via POST /access/api/v1/registry/join, added to CISA KEV). Attackers chained the first two to create persistent admin accounts, deploy malicious Groovy plugins for RCE, and drop Rust-based C2 backdoors, while CVE-2026-82329 was exploited independently for configuration exfiltration, cluster join-key theft, and credential/SSH-key persistence. The post includes exact request sequences, detection signatures, affected/fixed version ranges, and remediation guidance.
AppSec, Threat Intel, Blue Team & Detection· Published and added 10 Sep 2026
soliditylang.orgadvisoryThe Solidity team disclosed a code-generator bug (reported by Shaheen Fazim via the Ethereum Foundation bug bounty program) where `delete b[i]` on a bytes/string element located in memory incorrectly writes a full 32-byte zero word instead of a single byte, corrupting up to 31 subsequent bytes — either later elements of the same array or, for elements near the array's end, adjacent memory allocations like other variables. The bug affects only the default evmasm pipeline (not the IR pipeline via --via-ir) in all versions up to and including 0.8.36, is fixed in 0.8.37, and the equivalent assignment `b[i] = 0` is unaffected and serves as a workaround. A Sourcify scan of ~870,000 verified compilations found the triggering pattern in only two functions, neither actually exploitable in practice.
Blockchain· Added 29 Sep 2026, published 10 Sep 2026
soliditylang.orgadvisoryThe Solidity team disclosed a compiler bug (fixed in Solidity 0.8.37) where the IR pipeline's stack-to-memory spill mechanism can assign the same fixed memory offset ("spill slot") to two simultaneously-live local variables when a contract's call graph contains mutual recursion, silently corrupting values without any revert or warning. The bug requires --via-ir compilation plus a narrow set of conditions (mutual recursion, >16 live locals in reachable non-recursive functions, a variable read back after the recursive call) and affects Solidity 0.7.2 through 0.8.36; a rescan of ~319,000 Sourcify-verified contracts found no affected deployments. The writeup includes full technical detail on the buggy depth-first slot allocator, an annotated PoC contract reproducing the silent overwrite, and the strongly-connected-component fix.
Blockchain· Added 29 Sep 2026, published 10 Sep 2026
soliditylang.orgadvisorySolidity 0.8.37 release notes disclosing three EF bug-bounty-reported compiler bugs with security implications: deleting an element of a memory bytes array (or converted string) zeroed the full 32-byte word instead of one byte, corrupting adjacent data in the evmasm pipeline (all versions ≤0.8.36); a stack-to-memory spill-slot collision in mutually recursive functions under --via-ir silently overwrote live variables (0.7.2–0.8.36); and require() with a custom error using named arguments encoded parameters in call-site rather than declaration order, producing structurally valid but semantically wrong revert data. The release also adds two non-security miscompilation fixes, an experimental planning-based stack shuffler for the SSA CFG backend, support for the Amsterdam EVM's SLOTNUM opcode (EIP-7843), and removes/deprecates several experimental features.
Blockchain· Added 29 Sep 2026, published 10 Sep 2026
soliditylang.orgadvisoryThe Solidity team discloses a bug (reported by Cantina Security via the Ethereum Foundation bug bounty) where the IR-based (--via-ir) code generator pushed named custom-error arguments in call-site order instead of declaration order before ABI-encoding, corrupting revert data for require(condition, ErrorName({...})) calls with reordered named parameters. Introduced in Solidity 0.8.26 and fixed in 0.8.37, the bug produces silently swapped or type-confused values in decoded revert data with no compiler warning, and can cause misaligned encoding in multi-slot-argument cases that either reverts with undecodable data or produces a plausible-but-wrong payload - a real concern for standards like ERC-3668 (CCIP Read) that treat revert data as part of the contract interface. Severity was rated "very low" since the affected transaction is already reverting and there is no attacker-controlled exploitation path, but audits of via-ir contracts using named custom-error arguments should check for it.
Blockchain· Added 29 Sep 2026, published 10 Sep 2026
blog.talosintelligence.comadvisoryCisco Talos's analysis of Microsoft's September 2026 Patch Tuesday release, covering 973 vulnerabilities (113 critical, 82 of those RCE). Two flaws are confirmed exploited in the wild — CVE-2026-81963 (Windows Update Stack elevation of privilege) and CVE-2026-85880 (Windows ALPC elevation of privilege) — alongside a long list Microsoft rates "more likely" to be exploited, including a Windows Kerberos auth-bypass-by-replay RCE (CVE-2026-69676) and a Windows DNS Server use-after-free RCE (CVE-2026-69730). Talos releases accompanying Snort 2/3 rule coverage (SIDs 67011-67084, 301619-301655) to detect exploitation attempts.
Blue Team & Detection· Added 7 Oct 2026, published 8 Sep 2026
rapid7.comadvisoryRapid7's September 2026 Patch Tuesday analysis: Microsoft published 974 own-product CVEs (723 in Windows), 999 in total with non-Microsoft fixes, the most it has ever published in one day. Two zero-days are exploited in the wild: CVE-2026-85880 (Windows ALPC elevation of privilege to SYSTEM via out-of-bounds write; not patched on Server 2025 or Windows 11) and CVE-2026-81963 (Windows Update Stack elevation of privilege via improper link resolution). It also flags Microsoft's missing Edge advisory for the exploited Chromium V8 zero-day CVE-2026-85046, lists upcoming end-of-support dates for Windows 11 24H2, Server 2012/2012 R2, Office 2021 and Exchange 2016/2019, and includes per-product CVE tables with exploitation-likelihood ratings. Only the first part of the page was available, so the later tables are not covered.
Blue Team & Detection, Offensive Security· Added 7 Oct 2026, published 8 Sep 2026
deploymentsafety.openai.comadvisoryOpenAI's system card for ChatGPT Images 2.5, covering the GPT-Image-2.5-Sunburst and GPT-Image-2.5-Flare models, details a multi-layer image safety stack (upstream LLM policy refusals, a multimodal safety reasoning model for input/output blocking) built to counter heightened deepfake realism risks. It reports adversarial-prompt evaluation results against ChatGPT Images 2.0, Preparedness Framework assessments for biological and cyber capability (image-modality adaptations of existing LLM evals, neither model crossing the "High" threshold but biological-risk mitigations still applied precautionarily), and expanded provenance tooling via C2PA metadata and Google DeepMind's SynthID watermarking.
AI Security· Added 7 Oct 2026, published 8 Sep 2026
aikido.devadvisoryAikido Security's writeup on "StyleSmuggler," a remote code execution vulnerability in Magento and Adobe Commerce, covering the fix/patch for the flaw. Page content was not retrieved, so specifics of the exploitation technique and affected versions could not be confirmed directly.
AppSec· Published and added 7 Sep 2026
stepsecurity.ioadvisoryStepSecurity discovered that all 53 tags of the popular actions-cool/issues-helper GitHub Action (and all 15 tags of actions-cool/maintain-one-comment) were re-pointed to dangling imposter commits containing malicious code. The payload downloads the Bun runtime, reads Runner.Worker process memory to harvest decrypted CI/CD secrets, and exfiltrates them via HTTPS to t.m-kosche.com — meaning any workflow referencing the actions by tag (rather than a pinned commit SHA) pulls the malicious code on its next run.
Supply Chain, DevSecOps· Added 5 Sep 2026
securitylab.github.comadvisoryGitHub Security Lab discloses GHSL-2026-203 / CVE-2026-84973, a same-second time-of-check-to-time-of-use race condition in the jupyterlab/maintainer-tools update-snapshots-checkout GitHub Action. The action compares one-second-precision pushed_at and comment created_at timestamps to detect post-authorization pushes, but a strict greater-than check lets an attacker push a malicious commit in the same second as an authorized "please update snapshots" comment, causing the action to check out and later execute attacker-controlled code (including a local composite action and jlpm-driven package scripts) with the workflow's GITHUB_TOKEN (contents: write, pull-requests: write) in the jupyter/notebook repository. The issue was fixed in v1.0.0 and is a variant of the "pwn request" class of GitHub Actions vulnerabilities.
DevSecOps, Supply Chain· Added 20 Sep 2026, published 4 Sep 2026
scworld.comadvisoryGrafana patched CVE-2026-19516 (CVSS 9.1), a critical SSRF in the Grafana MCP server's grafana_api_request tool where a caller-supplied X-Grafana-URL header could control the method, path and body of outbound requests, letting an attacker reach internal-only services from the server's network position. Pillar Security researchers chained this with a second flaw — the MCP server accepting unauthenticated "session-shaped IDs" it never issued — and demonstrated using it to hit the AWS IMDSv2 endpoint and retrieve cloud credentials via a two-step PUT/TTL token request. Grafana MCP v1.1.0 adds optional bearer-token auth to close the session-forgery gap; Pillar frames MCP servers broadly as "identity brokers" that need explicit outbound destination policies and mandatory auth for remote deployments.
AppSec, AI Security, Identity & Access· Added 26 Sep 2026, published 3 Sep 2026
.webp)
pillar.securityadvisoryPillar Security details CVE-2026-73554, a critical authentication bypass in DoltHub's remote Dolt MCP server (versions 0.3.1–0.3.6) that let unauthenticated attackers reach tool dispatch and execute database operations under the server's own credentials. The bug combined a JWT middleware missing a return statement (so a 401-rejected request kept processing) with the bundled mark3labs/mcp-go library's InsecureStatefulSessionIdManager, which accepted any attacker-forged mcp-session-<uuid> value without verifying server issuance. DoltHub confirmed and patched within a day, issuing GHSA-mgpq-fxxc-h49q; fixed in Dolt MCP 0.3.7.
AI Security, AppSec· Published and added 1 Sep 2026
huntress.comadvisoryHuntress details active exploitation of an authorization-bypass flaw in PaperCut NG/MF (CVE-2026-81578) chained with an unsafe dynamic class-loading vulnerability in the database connection utilities (CVE-2026-82078) to achieve unauthenticated remote code execution in the PaperCut Application Server. The writeup covers Huntress's own observed intrusions (base64-encoded recon commands, dropped Java .class payloads decompiled with Fernflower, log-wiping behavior, and an Apache Derby pwn database indicator), a reproduced PoC achieving SYSTEM-level code execution via pc-app.exe, and detailed patching, evidence-preservation, and hunting guidance across PaperCut's staged emergency patches.
Threat Intel, AppSec, Blue Team & Detection· Added 3 Sep 2026, published 28 Aug 2026
thehackerwire.comadvisoryCVE-2026-81735 is a CVSS 10 unauthenticated RCE in the mcp-http-server package used by UI-TARS-desktop. The Streamable HTTP/SSE transport defaulted to binding on '::' with no authentication middleware applied by the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points, so any network client could invoke the exposed run_command tool (which pipes input straight into child_process.exec) for arbitrary command execution, or use the filesystem tool for unauthenticated arbitrary file read/write. The fix, landed in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, changes the default listen address to 127.0.0.1 without bumping the package version, so affected instances can't be identified by version number alone.
AppSec, AI Security· Added 26 Sep 2026, published 27 Aug 2026
advisory.splunk.comadvisorySplunk's August 2026 hardening advisory (SVD-2026-0808) discloses 17 CVEs across Cisco Talos Intelligence for Enterprise Security Cloud, Splunk AI Toolkit, Splunk Connect for Kafka, the Splunk MCP Server app, and Splunk On-Call (VictorOps). Notable issues include a critical (CVSS 9.1) RCE via unsafe credential deserialization in the Splunk MCP Server app (CVE-2026-76404), an RCE via pickle-based deserialization when loading ML model files in Splunk AI Toolkit (CVE-2026-76395), multiple SSRF and authorization-bypass flaws letting low-privileged users escalate to system-level search execution, hardcoded/predictable container credentials, and unauthenticated DoS/ReDoS and cert-validation bypasses in Splunk Connect for Kafka. Each finding includes CWE classification, CVSS vector, and mitigation guidance (typically disabling the affected app or restricting REST API access).
AppSec, AI Security· Added 21 Aug 2026
orca.securityadvisoryCVE-2026-32475 (CVSS 9.0) is an unauthenticated arbitrary file upload leading to RCE in Elementor Pro's Forms module (versions up to 4.2.1), caused by the extension-blocklist check and the file-move step running in two separate loops with different empty-file handling, letting a two-part file submission bypass the blocklist and drop a PHP webshell into the public wp-content/uploads/elementor/forms/ directory. The post also flags related WordPress core CVE-2026-65640 (CVSS 8.8, fixed in 7.0.4), an Author-level RCE via malicious PostScript upload requiring Imagick and Ghostscript. Fix: upgrade Elementor Pro to 4.2.2+ and WordPress core to 7.0.4, and audit the uploads/elementor/forms directory for planted PHP files.
AppSec· Added 3 Sep 2026, published 20 Aug 2026
endorlabs.comadvisoryEndor Labs researchers found a critical type confusion vulnerability (GHSA-864f-rcv7-6rh4) in isolated-vm, the Node.js library used to run untrusted JavaScript inside a separate V8 Isolate. A TOCTOU bug in ExternalCopy's transferList handling — where a malicious getter returns a valid ArrayBuffer on a validating pass but an attacker-controlled value on the unchecked second pass — lets guest code escalate from a controlled-address crash to full host control-flow hijack, given only a single ivm.Reference. The bug is fixed in isolated-vm 7.0.1/6.2.0; affected downstream users include n8n, Activepieces, Mastra, Budibase, Sim.ai, Directus, and Rocket.Chat, which rely on isolated-vm to sandbox user- and model-generated code.
AppSec, Offensive Security, AI Security· Added 3 Sep 2026, published 20 Aug 2026
thehackerwire.comadvisoryCVE-2026-76832 (CVSS 8.8) is a path traversal flaw in Agno's PythonTools, specifically in libs/agno/agno/tools/python.py, where the file_name argument to read_file, save_to_file, and run_python_file is not sanitized against the configured base_dir. An attacker can pass sequences like ../../../../etc/passwd to read or write arbitrary files, and abuse run_python_file to execute an arbitrary Python script for RCE. The advisory notes the flaw is reachable either via direct tool invocation or via prompt injection into agent-processed content, with no PoC or patch published at time of writing.
AppSec, AI Security· Added 26 Sep 2026, published 20 Aug 2026
aikido.devadvisoryAikido security research describes CVE-2026-18171, a flaw allowing supposedly read-only mounts in Docker-based sandboxes to be written to, potentially enabling sandbox escape or persistence. Full page content was unavailable at fetch time, so specifics of the exploitation chain and affected versions could not be verified from the source text.
Cloud & Infra, Offensive Security· Published and added 13 Aug 2026
orca.securityadvisoryOrca Security details four Zoom vulnerabilities in the cross-platform annotation engine (libannotate.so): CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize from unchecked 32-bit character counts, and CVE-2026-53415, a use-after-free in auto-shape metadata handling giving a write-what-where primitive, both enabling zero-click RCE against every meeting participant via crafted annotation messages during screen sharing. Also disclosed are CVE-2026-53414 (heap over-read/DoS) and CVE-2026-53416 (path traversal in the Windows VDI client). The write-up notes a working exploit chain built in under 24 hours with fewer than 20 AI-model prompts, platform-specific exploitation details (macOS ARM64 ASLR bypass, Android heap spraying/vtable corruption), and that E2EE meetings bypass Zoom's server-side message filtering.
AppSec, Offensive Security· Published and added 12 Aug 2026
/)
grafana.comadvisoryGrafana advisory for CVE-2026-19516, a critical (CVSS 9.1) SSRF in mcp-grafana. A caller able to invoke the grafana_api_request tool can set the X-Grafana-URL header to redirect outbound requests, choosing method, path and body, to internal, loopback and link-local services including cloud metadata endpoints, and read the responses. The earlier fix for CVE-2026-15583 only stopped the service-account token leaking to other destinations and did not restrict the destinations; the fix is in version 1.1.0 and later.
AppSec, AI Security· Added 12 Aug 2026
aws.amazon.comadvisoryAWS bulletin for CVE-2026-18394, an incorrect authorization flaw in the http_request tool of the open-source strands-agents-tools package used with the Strands Agents SDK. The tool exposed an LLM-controllable proxies parameter that let attacker-controlled web content (via indirect prompt injection) redirect requests through an actor's proxy while the hostname allowlist check still passed, disclosing HTTP_REQUEST_TOKEN_CONFIG-bound credentials in cleartext Authorization headers on the first hop. Fixed in version 0.8.2; AWS recommends upgrading and rotating any credentials configured on affected versions.
AI Security, AppSec· Added 6 Aug 2026
endorlabs.comadvisoryEndor Labs' active-tracking advisory on an npm supply-chain worm that compromised keyv, flat-cache, and file-entry-cache (500M+ combined weekly downloads) via the jaredwray/Cacheable GitHub Actions OIDC trusted-publishing pipeline, injecting a preinstall hook (setup.mjs) that fetches a legitimate Bun binary to run an obfuscated ~727KB stage-2 payload (Math_Symbol.js/math_init.js) stealing AWS, npm, GitHub, and Vault tokens. The stolen tokens were used to self-propagate the same payload to 384+ packages and 1,136+ versions across unrelated maintainer accounts, including scopes belonging to companies like ServiceTitan, Qlik, and Picsart. The post includes IOCs (file hashes), affected package/version lists, and mitigation guidance (lockfile/CI log checks, --ignore-scripts).
Supply Chain, Threat Intel· Added 3 Sep 2026, published 4 Aug 2026
aikido.devadvisoryAikido Security reports that Keyv and several related npm packages were compromised as part of the ongoing Shai-Hulud supply-chain attack, in which malicious versions were published to npm to spread a self-replicating worm across the ecosystem. The write-up details the affected packages and versions and the worm's propagation mechanism via compromised maintainer credentials and postinstall scripts.
Supply Chain· Added 3 Sep 2026, published 4 Aug 2026
incibe.esadvisoryCVE-2026-15988 describes a CSRF vulnerability (CVSS 8.8, CWE-352) in the "AI Engine – The Chatbot, AI Framework & MCP" WordPress plugin, affecting all versions up to and including 3.6.5. Missing/incorrect nonce validation on the reauth_for_authorize function lets an unauthenticated attacker trick a logged-in administrator into visiting a crafted link, which — combined with WordPress's ?_method=POST override to turn a GET into an authenticated REST POST — creates a new administrator account with attacker-supplied credentials.
AppSec· Added 2 Aug 2026
.png)
unchained.comadvisoryUnchained client-facing security advisory responding to Coinkite disclosure that Coldcard hardware wallets (Mk3, Mk4, Mk5, and Q models) generated private keys using a lower-than-expected amount of random bits, weakening key-generation entropy. The advisory details risk to Bitcoin multisig vaults built with Coldcard-generated keys and describes an attack scenario where an attacker holding 2-of-3 compromised keys plus knowledge of a reused address can mount a Replace-By-Fee (RBF) replacement-cycling attack to redirect pending transactions, along with key-replacement remediation steps including Unchained Slipstream as RBF mitigation.
Blockchain· Added 4 Oct 2026, published 31 Jul 2026
discuss.hashicorp.comadvisoryHashiCorp advisory HCSEC-2026-23 discloses three vulnerabilities in terraform-mcp-server versions 0.2.1 through 1.0.0 (fixed in 1.1.0), all affecting the server's streamable-HTTP transport used for multi-user deployments. CVE-2026-14869 is an SSRF where an unauthenticated client can supply a Terraform address via query parameter (bypassing a header-only check) to exfiltrate the server's bearer token; CVE-2026-16496 is an authorization bypass where stateful mode's session-ID-keyed credential cache lets an attacker who obtains another user's session ID hijack that user's cached Terraform Cloud/Enterprise client and permissions; CVE-2026-16498 is cross-tenant credential reuse in stateless mode where the underlying MCP library's lack of unique session identifiers causes one tenant's token to be reused for other tenants' requests.
AI Security, AppSec· Added 30 Jul 2026, published 28 Jul 2026
socket.devadvisoryNuxt 4.5.1/3.21.10 and @nuxt/devtools 3.3.1 patch eight GitHub Security Advisories, the most severe being GHSA-9473-5f9j-94wq, a server-side RCE via server island props reaching Vue's dynamic component resolution when vue.runtimeCompiler is enabled, plus a related unauthorized component instantiation bug (GHSA-48hr-524c-v5w3), a route-rule authz bypass, DoS issues, cross-user payload cache disclosure, and a critical dev-only RCE in Nuxt DevTools. Socket released free Certified Patches for the two highest-severity issues (installable via `socket patch add`) as an interim fix for teams that can't immediately upgrade, and is preparing patches for the rest.
AppSec, Supply Chain· Published and added 28 Jul 2026
discuss.circleci.comadvisoryCircleCI disclosed GHSA-8xjg-jpfh-5257 affecting its standalone circleci-mcp-server npm package used as an MCP server in Claude Desktop, Cursor, VS Code, and Windsurf, and is deprecating that package in favor of a built-in MCP server shipped with a new CircleCI CLI. Affected users are told to upgrade to version 0.19.0 immediately, while CircleCI cloud users are pointed toward migrating to the CLI, which adds OAuth-based auth and native pipeline watching. CircleCI will keep shipping security patches to the old package but is no longer adding features to it.
AI Security, Supply Chain· Added 22 Aug 2026, published 20 Jul 2026
orca.securityadvisoryOrca Security discloses CVE-2026-11386, a critical vulnerability in the Ubuntu Pro Client that reportedly allows root code execution on affected cloud instances. The fetched page content was empty, so this assessment is based on the title/URL alone; specifics on the vulnerable component, attack vector, and exploitation path are not confirmed here.
Cloud & Infra· Published and added 20 Jul 2026
orca.securityadvisoryCovers CVE-2026-42533, a heap buffer overflow (CWE-122) in the NGINX map directive's regex handling. It is triggered when a string expression references unnamed captures before the map output variable. Unauthenticated crafted HTTP requests can crash workers and may give RCE where ASLR is off or bypassed. It also covers two other F5-patched NGINX flaws: CVE-2026-60005 (uninitialized memory disclosure in ngx_http_slice_module) and CVE-2026-56434 (use-after-free in ngx_http_ssi_module with proxy_pass and proxy_buffering off). It lists affected NGINX Open Source (0.9.6–1.31.2), NGINX Plus, Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager versions. It gives fixed releases (1.31.3 / 1.30.4) and the named-capture workaround, and notes no public PoC or in-the-wild exploitation.
Cloud & Infra· Published and added 20 Jul 2026
thehackernews.comadvisoryCISA added four actively exploited vulnerabilities to its KEV catalog: a path traversal RCE in Adobe ColdFusion (CVE-2026-48282, CVSS 10.0), an unauthenticated file-upload RCE in Joomlack Page Builder CK (CVE-2026-56290, CVSS 10.0), an IDOR in Langflow allowing cross-tenant flow execution and LLM/AWS key theft (CVE-2026-55255, CVSS 6.1), and an unauthenticated arbitrary file upload in JoomShaper SP Page Builder (CVE-2026-48908, CVSS 10.0). Sysdig documented an operator chaining the Langflow IDOR with CVE-2026-33017 RCE for opportunistic, financially motivated cryptojacking/botnet activity and credential theft from an AI orchestration platform, while mySites.guru observed web shell deployment via the Joomla flaws. FCEB agencies must patch by July 10, 2026.
Threat Intel, AppSec, AI Security· Published and added 18 Jul 2026
cybersecuritynews.comadvisoryCVE-2026-14898 affects the OpenAI Codex desktop app for macOS, which automatically renders remote images embedded in Markdown model output without user interaction. An attacker can use indirect prompt injection to make Codex generate a response containing an attacker-controlled image URL whose parameters embed sensitive data (API keys, source code, tool output), which is silently exfiltrated when the app auto-fetches the image. Categorized under CWE-200, no patch or CVSS score was available at disclosure.
AI Security, AppSec· Published and added 18 Jul 2026
nvd.nist.govadvisoryCVE-2026-59950 (CVSS 7.6) affects the MCP Python SDK's deprecated mcp.server.websocket.websocket_server transport, which accepted WebSocket handshakes without validating Host or Origin headers, giving no SDK-level way to restrict which origins could connect to applications exposing that transport. This is a classic CSWSH-style origin-validation flaw (CWE-346, CWE-1385) fixed in mcp 1.28.1.
AppSec· Published and added 17 Jul 2026
github.comadvisoryGHSA-3pvh-63gf-j9mw discloses an authenticated remote code execution vulnerability in LangBot, an open-source AI chatbot/agent framework, caused by its MCP Server Configuration feature. Because LangBot's mcp.py uses Anthropic's StdioServerParameters to launch MCP servers, any authenticated user can add a "STDIO" MCP entry with an arbitrary shell command and have it executed on the server, enabling data exfiltration, reverse shells, or full host compromise (CWE-78 OS command injection).
AI Security, AppSec· Published and added 17 Jul 2026
nvd.nist.govadvisoryCVE-2026-55608 affects n8n-MCP, an MCP server exposing n8n node documentation and operations to AI assistants. Prior to version 2.57.4, when run in multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true), an authenticated tenant could bypass tenant scoping and access or delete default-scope workflow_versions backups left over from earlier single-tenant deployments or migrations, exposing other tenants' workflow data. The issue is tracked as CWE-200 (information exposure) and CWE-863 (incorrect authorization) and is fixed in v2.57.4.
AppSec· Published and added 16 Jul 2026
orca.securityadvisoryOrca Security writeup covering CVE-2026-48282, a maximum-severity remote code execution vulnerability in Adobe ColdFusion. The page content could not be retrieved, so technical details (root cause, exploitation vector, affected versions) are unconfirmed beyond the title.
AppSec· Published and added 15 Jul 2026
github.comadvisoryThis GHSA advisory documents CVE-2026-27826, a DNS-rebinding TOCTOU bypass of the SSRF fix in the MCP Atlassian server (mcp-atlassian PyPI package). The prior patch (GHSA-7r34-79r5-rcc9) added validate_url_for_ssrf, which resolves the attacker-controlled X-Atlassian-{Jira,Confluence}-Url header host once at middleware time but discards the resolved IP; the actual outbound request later re-resolves the raw hostname at connect time with no IP pinning, so a rebinding DNS name can pass validation with a public IP and then connect to 169.254.169.254 or an internal address, restoring unauthenticated SSRF to cloud metadata/internal services even on the 'patched' build. The advisory includes an executed PoC against the real urls.py, exact code locations (utils/urls.py, servers/main.py, servers/dependencies.py), and remediation via a custom resolver/cached-getaddrinfo adapter to pin the validated IP.
AppSec, AI Security· Published and added 13 Jul 2026
nvd.nist.govadvisoryCVE-2026-61459 describes an argument injection flaw (CWE-88) in mcp-server-kubernetes before 3.9.0, where the structured tools kubectl_get, kubectl_describe, and kubectl_delete fail to block leading-dash resourceType/name parameters, letting an attacker bypass the assertNoDangerousFlags check and inject a --server flag. This redirects kubectl calls to an attacker-controlled API server, leaking the operator's bearer token and enabling full Kubernetes cluster compromise. Fixed in v3.9.0; details corroborated by a VulnCheck advisory and the upstream GitHub commit/PR.
AI Security, Cloud & Infra· Published and added 12 Jul 2026
nvd.nist.govadvisoryCVE-2026-61447 describes a critical (CVSS 4.0 score 10.0) remote code execution vulnerability in PraisonAI versions before 1.6.78, rooted in CodeAgent._execute_python(), which runs LLM-generated Python code with no AST validation, import restrictions, or sandbox enforcement. An attacker who can influence the LLM's output via prompt injection can exfiltrate environment secrets and achieve arbitrary code execution on the host, making it a textbook agentic-code-execution flaw (CWE-94).
AI Security, AppSec· Published and added 12 Jul 2026
socket.devadvisorySocket details a compromise of @injectivelabs/sdk-ts version 1.20.21 (a popular Injective Labs TypeScript SDK with ~50,000 weekly downloads), in which the fromMnemonic and fromHex key-derivation functions were hooked with a trackKeyDerivation call that base64-encodes and exfiltrates wallet private keys and mnemonic phrases to a lookalike Injective public infrastructure endpoint. The attacker gained access via a legitimate maintainer's GitHub account, published the malicious version, and simultaneously pushed version 1.20.21 to 17 other @injectivelabs-scoped packages pinned to the compromised SDK, amplifying blast radius to transitive dependents. The compromise was detected and reverted within roughly an hour by the account owner, but the malicious release artifacts remained downloadable on npm and GitHub at time of writing.
Supply Chain· Added 21 Sep 2026, published 9 Jul 2026
soliditylang.orgadvisorySolidity 0.8.36 release notes disclose two medium-severity compiler bugs: a Yul optimizer call-cycle detection flaw that let stack-to-memory spilling be wrongly applied to mutually recursive functions, causing separate invocations to share and overwrite the same memory slots; and a storage-layout warning bug that could reverse the AST's linearizedBaseContracts annotation when a contract's variables sit very close to the end of storage, corrupting constructor/state-variable initialization order. The release also adds experimental stack-to-memory spilling to the new SSA-form CFG code generator (behind --experimental --via-ssa-cfg) and removes the now-obsolete experimental EOF backend after EOF's rejection from the Fusaka upgrade.
Blockchain· Added 29 Sep 2026, published 9 Jul 2026
soliditylang.orgadvisoryThe Solidity team discloses a medium-severity compiler bug present from Solidity 0.8.29 through 0.8.35 (fixed in 0.8.36): the code that emits Warning 3495 (custom storage layout too close to storage end) uses ranges-v3's actions::reverse instead of views::reverse, permanently mutating the linearizedBaseContracts AST annotation instead of only reading a reversed copy. Because that annotation drives inheritance-order decisions throughout analysis and codegen, affected contracts can get reversed constructor execution order, wrong super/virtual-function and virtual-modifier resolution, and incorrect fallback/receive dispatch — either silently miscompiling or triggering internal compiler errors. Exploitation requires a contract using both inheritance and a `layout at` clause landing within the last 2^64 storage slots, a pattern the team found no real-world evidence of via GitHub and Sourcify scans.
Blockchain· Added 29 Sep 2026, published 9 Jul 2026
soliditylang.orgadvisorytest
Blockchain· Added 29 Sep 2026, published 9 Jul 2026
Showing 210 of 260
Show more