Overview of incoming advisories.
1553 results found
A critical security vulnerability in GitLab, tracked as CVE-2026-19478 with a CVSS score of 9.4, has come under active exploitation within days of its public disclosure. The flaw is a code injection vulnerability that allows unauthenticated attackers to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions. The exploitation activity was reported by watchTowr. The severity of the vulnerability is underscored by the fact that no authentication is required to exploit it, making it accessible to a wide range of threat actors. The rapid weaponization of this vulnerability highlights the ongoing challenge organizations face in patching critical flaws before attackers can leverage them. GitLab users and administrators are urged to apply available patches immediately to mitigate potential damage.
View original advisory →Microsoft disclosed a maximum-severity vulnerability in Microsoft Entra ID (formerly Azure Active Directory), tracked as CVE-2026-69836 with a CVSS score of 10.0. The flaw allows remote code execution on the cloud-based identity and access management service. Microsoft confirmed the vulnerability has been actively exploited in the wild. Despite active exploitation, Microsoft stated that no customer action is required to remediate the issue. The vulnerability affects a widely used enterprise identity platform, making it a critical risk for organizations relying on Microsoft's cloud identity services.
View original advisory →Zimbra Collaboration Suite (ZCS) contains a critical OS command injection vulnerability tracked as CVE-2026-73570. An unauthenticated attacker can exploit this flaw by sending specially crafted SMTP requests, potentially resulting in arbitrary operating system command execution as the Zimbra user. The vulnerability requires no authentication, making it especially dangerous in internet-exposed deployments. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Zimbra has released a patch in version 10.1.20 to address the issue. Organizations are urged to apply the patch immediately and review Zimbra Security Advisories for further guidance. Forensics triage requirements have also been outlined by CISA for affected systems. The vulnerability is listed in the NVD and carries a high criticality rating.
View original advisory →A critical deserialization of untrusted data vulnerability has been identified in Microsoft Entra ID, formerly known as Azure Active Directory. The vulnerability allows an unauthorized attacker to execute arbitrary code over a network without authentication. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. The flaw is tracked as CVE-2026-69836 and is documented in both the Microsoft Security Response Center and the NVD. Organizations using Microsoft Entra ID are urged to apply available security patches immediately. Forensic triage requirements have also been outlined by CISA as part of the BOD 26-04 implementation guidance. The vulnerability poses a significant risk to identity and access management infrastructure relying on Microsoft cloud services.
View original advisory →CVE-2026-62675 affects Omnigent, an open-source AI agent framework for orchestrating coding agents, in versions prior to 0.3.0. The vulnerability exists in the multipart POST /v1/sessions endpoint, where the validate_agent_bundle function in bundles.py fails to reject arbitrary dotted Python paths in the tools callable field. The tool dispatch module resolves and invokes the specified callable, allowing an authenticated user to specify subprocess.check_output or similar dangerous functions. This enables arbitrary local command execution with the permissions of the runner process. Exploitation can expose sensitive data including environment variables, credentials, workspace files, and internal services. The flaw requires only authenticated user access, not administrator privileges, lowering the barrier for exploitation. The issue has been patched in Omnigent version 0.3.0 via input validation on the callable path.
View original advisory →CVE-2026-77810 describes a vulnerability in the AWS Athena Federated Query Neptune connector where an authorized user could gain unauthorized access to Lambda function properties supplying compute for the connector. This represents a privilege escalation/information disclosure risk within the AWS cloud environment. The flaw affects the aws-athena-query-federation component and could expose sensitive configuration or credential data stored in Lambda properties. AWS has issued a security bulletin (2026-087) addressing this issue. The remediation requires upgrading to aws-athena-query-federation version v2026.30.1 or later. A GitHub security advisory (GHSA-v7c2-5wfg-qg44) has also been published alongside the fix release.
View original advisory →CVE-2026-48751 affects Incus, a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots fail to enforce the restricted.containers.lowlevel=block security setting. This bypass allows attackers to abuse low-level hooks such as raw.lxc and raw.qemu to achieve arbitrary command execution on the Incus server. The vulnerability poses a significant risk in multi-tenant or restricted environments where low-level container access is explicitly blocked. Version 7.2.0 resolves the issue with a patch. Users are advised to upgrade immediately to mitigate the risk.
View original advisory →Paperclip versions before 0.3.1 are vulnerable to remote code execution via DNS rebinding attacks when running in the default local_trusted mode. The vulnerability stems from a failure to validate Host headers, allowing attackers to bypass security controls. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, leverages DNS rebinding to make authenticated API requests. These requests can then execute arbitrary commands through Paperclip's process adapter. The attack targets developers running Paperclip in local development environments. The fix was introduced in version 0.3.1. This type of attack is particularly dangerous as it exploits the trusted local environment assumption. Developers should upgrade to version 0.3.1 or later immediately to mitigate the risk.
View original advisory →CVE-2026-77264 describes a critical authentication bypass vulnerability in the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress, affecting versions up to and including 4.8.6. The vulnerability exists in the handle_email_otp_return() function, which incorrectly returns the secret magic login token directly in the HTTP response to a publicly accessible OTP request, instead of delivering it exclusively to the user's email. This design flaw allows unauthenticated attackers to capture the token and use it to log in as any registered user on the site, including administrators, as long as they know the target's email address. The attack requires no prior authentication and can lead to full site compromise. Site owners using the affected plugin versions are urged to update immediately to a patched version.
View original advisory →CVE-2026-54457 affects TensorZero, an open-source LLMOps platform, prior to version 2026.6.0. The vulnerability exists in the /internal/object_storage endpoint, which accepts a caller-supplied JSON storage_path parameter that can override the object storage configuration. Attackers can exploit the filesystem storage type to read arbitrary files from the gateway filesystem, including sensitive credential files. The s3_compatible storage type can be abused to trigger server-side request forgery (SSRF) against internal or cloud metadata endpoints such as AWS IMDS. Exploitation depends on whether the gateway is deployed with or without authentication, making the attack surface variable. The vulnerability combines arbitrary file read and SSRF primitives, posing significant risk in cloud-hosted deployments. A fix was released in version 2026.6.0. Patches and advisories are available via the official GitHub repository.
View original advisory →CVE-2026-77236 is a vulnerability in FreeRTOS-Kernel versions prior to 11.3.1 involving missing minimum size validation in secure context allocation. The flaw may allow local users to corrupt secure-world heap metadata through an out-of-bounds write triggered by supplying an undersized stack size parameter. This affects the secure context allocation mechanism, potentially impacting systems relying on FreeRTOS TrustZone or secure-world isolation. The vulnerability is classified as a local privilege or integrity issue, as it requires local access to exploit. AWS has published a security bulletin acknowledging the issue. The fix is available in FreeRTOS-Kernel version 11.3.1 and later. Users and organizations using affected versions are strongly advised to upgrade immediately to remediate the risk.
View original advisory →CVE-2026-48752 affects Incus, a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be leveraged to read or create/write arbitrary files on the host system. This path traversal-style vulnerability could potentially lead to arbitrary command execution on the host. The vulnerability is exploitable via malicious container images or instance backups. Version 7.2.0 has been released to patch the issue. Users are advised to upgrade to version 7.2.0 or later to mitigate the risk. The severity is high given the potential for host-level compromise from within a container context.
View original advisory →CVE-2026-62940 affects Incus, a system container and virtual machine manager, in versions prior to 7.3.0. The vulnerability exists in the instance migration process between cluster members, where user-supplied configuration overrides are applied without enforcing project restriction policies. Security-critical configuration keys such as `security.privileged` and `raw.lxc` can be manipulated by restricted project users during migration. This allows an attacker to escalate privileges to a privileged container and subsequently escape to the underlying host system. The flaw represents a container escape vulnerability with significant impact on multi-tenant cluster environments. Version 7.3.0 of Incus addresses and patches this issue. Users running Incus in clustered configurations with restricted project users are at elevated risk.
View original advisory →Combodo iTop, a web-based IT service management tool, contains a vulnerability prior to version 3.2.3 where inline images accessible without authentication are protected only by a weak 24-bit pseudo-random secret. This weak randomness could allow an attacker to brute-force or predict the secret and gain unauthorized access to inline images. The vulnerability affects all versions of iTop prior to 3.2.3. The issue has been patched in version 3.2.3. The fix is available via a commit on the official GitHub repository. No authentication is required to exploit this vulnerability, increasing its risk surface. Organizations using iTop for IT service management should upgrade to version 3.2.3 immediately. The vulnerability is tracked as CVE-2026-27490 and has a GitHub Security Advisory associated with it.
View original advisory →BabelDOC, a document translation tool, contains a critical vulnerability in its vendored PDF parser (babeldoc/pdfminer/cmapdb.py) prior to version 0.6.3. The vulnerability allows arbitrary Python code execution via unsafe deserialization of pickle data when CMapDB._load_data() loads CMap files. Attackers can craft malicious PDF files with controlled Encoding or CMapName values, or embed PostScript usecmap operators, to manipulate file paths. The _normalize_cmap_name() function only strips a leading slash, leaving path traversal sequences intact. Combined with os.path.join() behavior, absolute paths or traversal sequences can escape trusted CMap directories and load attacker-controlled .pickle.gz files. This triggers pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. The vulnerability is fixed in version 0.6.3.
View original advisory →UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the parse_artifact.sh script. The flaw exists in the user substitution logic where usernames and home directories read from /etc/passwd are directly interpolated into command strings without proper escaping before being executed via eval. An attacker who can control /etc/passwd entries (e.g., on a compromised host being analyzed) can craft malicious usernames or home directory paths containing shell metacharacters such as command substitution syntax or semicolons. When an analyst runs UAC against such a system, the injected commands execute on the analyst's own host system. This represents a significant risk to forensic investigators and incident responders using UAC. The vulnerability has been patched in UAC version 3.3.0.
View original advisory →The internment crate version 0.8.7 for the Rust programming language has been identified as containing a rogue dependency that executes malicious code at compile time. When a developer compiles a project that depends on this crate, the malicious dependency silently registers with a command-and-control (C2) server, enabling arbitrary code execution on the developer's machine. This is classified as a build-time supply chain attack, where the compromise occurs during the software build process rather than at runtime. The attack vector is linked to a broader supply chain campaign involving the arrayref and proc-macro1 Rust crates. Multiple security advisories and blog posts from the Rust community, RustSec, SafeDep, and StepSecurity have documented this incident. The vulnerability is tracked as CVE-2026-77649 and RUSTSEC-2026-0266. Developers using the internment crate 0.8.7 are urged to update or remove the dependency immediately.
View original advisory →Combodo iTop, a web-based IT service management tool, contains a Reflected Cross-Site Scripting (XSS) vulnerability in its synchro import script. The vulnerability is identified as CVE-2026-30890 and affects all versions prior to 3.2.3. Reflected XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, credential theft, or other client-side attacks. The issue has been patched and fully remediated in iTop version 3.2.3. The fix is available via a specific commit on the official Combodo iTop GitHub repository. A security advisory has also been published on GitHub under GHSA-93q9-fc8m-5gp5. Users of iTop are strongly advised to upgrade to version 3.2.3 or later to mitigate this risk.
View original advisory →Combodo iTop, a web-based IT service management tool, contains a reflected Cross-Site Scripting (XSS) vulnerability prior to version 3.2.3. The vulnerability exists in the dashboard revert functionality, specifically through the 'dashboard_id' parameter in the '/pages/ajax.render.php' endpoint. An attacker could exploit this flaw to inject malicious scripts that execute in the context of a victim's browser. The issue has been assigned CVE-2026-30819 and is documented in the NVD. A fix has been released in iTop version 3.2.3. The patch is available via a GitHub commit and a corresponding security advisory has been published on GitHub. Users are strongly advised to upgrade to version 3.2.3 or later to mitigate the risk.
View original advisory →CVE-2026-77811 describes a stored Cross-Site Scripting (XSS) vulnerability in the dashboards-observability plugin for OpenSearch Dashboards. The flaw stems from improper input validation, allowing a remote authenticated user with write permissions to saved objects to upload malicious assets containing arbitrary web content. This enables the attacker to execute arbitrary JavaScript in the browser sessions of other users viewing the affected content. The attack requires authentication and write access to OpenSearch Dashboards saved objects, making it a privilege-dependent but high-impact issue. Successful exploitation could lead to session hijacking, credential theft, or further lateral movement within the platform. AWS has issued a security bulletin and patches are available in OpenSearch releases 2.19.6 and 3.4.0. Organizations using affected versions of OpenSearch Dashboards should upgrade immediately to mitigate the risk.
View original advisory →