Overview of incoming advisories.
2186 results found
Ubiquiti has released security patches addressing three maximum-severity vulnerabilities in its products. These vulnerabilities can be exploited remotely by threat actors without requiring any privileges, making them especially dangerous. The flaws represent critical risks to organizations and individuals using Ubiquiti networking equipment. Ubiquiti has urged users to apply the patches immediately to mitigate potential exploitation. No additional technical details about specific CVEs or exploitation in the wild were provided in the article excerpt.
View original advisory →CISA published results of simultaneous red team assessments conducted against two critical infrastructure organizations using similar tradecraft. Both organizations were fully compromised at the domain level. The assessments revealed sharply different defensive outcomes between the two organizations. One organization failed to detect any of the red team's activities throughout the engagement. The findings highlight significant gaps in detection and response capabilities within critical infrastructure sectors. The report serves as a warning about the state of cybersecurity readiness in critical infrastructure. CISA used the assessments to demonstrate the importance of robust monitoring, detection, and incident response capabilities.
View original advisory →CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 video player library, tracked as CVE-2026-19913 and CVE-2026-19912. Both flaws originate from unsafe deserialization in the mwEmbedLoader.php endpoint. A remote, unauthenticated attacker could exploit these vulnerabilities to read arbitrary files from the server or execute arbitrary code. The vulnerabilities remain unpatched at the time of disclosure. The impact is significant given the widespread use of Kaltura's video platform in enterprise and educational environments. No active exploitation has been confirmed, but the unauthenticated nature of the attack vector increases risk considerably.
View original advisory →Attackers are actively exploiting a critical-severity vulnerability in Gitea, a self-hosted Git service platform. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the exploitation of this flaw in code injection attacks. The vulnerability allows attackers to inject malicious code into affected Gitea instances. CISA's involvement indicates the threat is considered significant and widespread. Organizations running self-hosted Gitea instances are urged to apply patches immediately. The flaw is classified as critical severity, suggesting a high potential for damage. Code injection vulnerabilities can lead to full system compromise, data theft, or further network infiltration. This incident highlights the risks associated with self-hosted source code management platforms.
View original advisory →Vercel has patched two vulnerabilities in Next.js, a popular React framework for web application development. The first vulnerability, CVE-2026-75604, allows attackers to execute arbitrary code on the application server. It specifically affects Next.js applications hosted on Windows environments using both Pages and App routers without the Cache Component. The second vulnerability, which had not yet received a CVE identifier at time of publication, also enables remote code execution by supplying a malicious media file to a vulnerable application. Both vulnerabilities have been resolved by Vercel. Users of Next.js, especially those on Windows-based deployments, are advised to update immediately.
View original advisory →CISA has issued a warning about active exploitation of a critical remote code execution vulnerability in Gitea, tracked as CVE-2026-60004 with a CVSS score of 9.8. The flaw allows an attacker with ordinary write access to a repository to execute arbitrary shell commands. Reported attacks are dropping a miner-like payload on compromised systems. The vulnerability has been recently patched, but active exploitation campaigns are already underway. Organizations using Gitea are urged to apply the patch immediately given the severity and active exploitation status.
View original advisory →Cybersecurity researchers from SOCRadar Threat Research Unit (STRU) have uncovered a phishing-as-a-service (PhaaS) platform called AnonyMousKIT designed to bypass Apple's Activation Lock on stolen devices. The platform uses rented AI voice agents to call theft victims, impersonating Apple Support, and tricks them into revealing their device passcode and two-factor authentication codes. The service operates on a credit-metered model, lowering the barrier for cybercriminals to conduct sophisticated social engineering attacks. By obtaining the passcode and 2FA codes, attackers can disable Activation Lock and fully take over stolen Apple devices. This represents a significant evolution in vishing (voice phishing) attacks, leveraging AI to scale and automate deceptive phone calls. The campaign highlights growing abuse of AI voice technology in cybercrime and the increasing sophistication of PhaaS platforms targeting Apple ecosystem users.
View original advisory →CVE-2015-5287 is a privilege escalation vulnerability in Red Hat's Automatic Bug Reporting Tool (ABRT). It allows local users with certain permissions to gain elevated privileges by performing a symlink attack on a file with a predictable name. The vulnerability affects an open-source component that may be used across multiple products. The impacted product(s) may be end-of-life or end-of-service, and users are advised to discontinue use or transition to a supported version. A fix is referenced in the ABRT GitHub repository. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage guidance is also available through CISA's BOD 26-04 implementation resources. The NVD entry confirms the severity and details of this vulnerability.
View original advisory →CVE-2019-1068 is a remote code execution vulnerability affecting Microsoft SQL Server. An attacker who successfully exploits this vulnerability could execute arbitrary code in the context of the SQL Server Database Engine service account. The vulnerability is tracked by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Microsoft has published an official advisory through the Microsoft Security Response Center. CISA also references forensic triage requirements under BOD 26-04 implementation guidance. The vulnerability is catalogued in the National Vulnerability Database (NVD). Organizations running affected versions of Microsoft SQL Server are advised to apply the relevant security patches promptly. The current risk rating is High (H), indicating significant potential impact if exploited.
View original advisory →CVE-2021-23758 affects Ajax.NET Professional (AjaxPro), an open-source .NET library, which contains a deserialization of untrusted data vulnerability. This flaw allows attackers to exploit arbitrary .NET class deserialization, potentially leading to remote code execution. The vulnerability is catalogued in CISA's Known Exploited Vulnerabilities catalog under BOD 26-04. The affected product may be end-of-life or end-of-service, and users are advised to discontinue use or migrate to a supported alternative. A patch commit is available on GitHub for reference. The issue stems from improper handling of untrusted data during deserialization, a common and critical vulnerability class in web frameworks. Organizations using AjaxPro in their web applications are at risk of full system compromise if exploited. CISA has flagged this for prioritized remediation under its binding operational directive.
View original advisory →CVE-2015-3246 is a race condition vulnerability in Red Hat's libuser library. It allows authenticated local users to corrupt the /etc/passwd file, potentially leading to a denial of service or privilege escalation. The vulnerability affects an open-source component that may be used across multiple products. It has been flagged under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Forensic triage requirements are also associated with this vulnerability per BOD 26-04 implementation guidance. The vulnerability is rated High severity and has been catalogued in the NVD.
View original advisory →CVE-2022-0995 is an out-of-bounds memory write vulnerability in the Linux Kernel. It allows a local user to gain elevated privileges or cause a denial of service on affected systems. The vulnerability is tracked by CISA and listed under BOD 26-04, which prioritizes security updates based on risk. It affects an open-source component that may be used across a wide range of products and distributions. A patch has been committed to the mainline Linux kernel repository by Linus Torvalds. CISA has provided forensic triage requirements and implementation guidance for organizations needing to remediate. The vulnerability is rated High severity, underscoring the importance of timely patching for Linux-based environments.
View original advisory →CVE-2026-8452 affects Citrix NetScaler ADC and NetScaler Gateway products, involving an improper restriction of operations within the bounds of a memory buffer. This vulnerability could be exploited to cause a denial of service condition. The issue has been flagged by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. Citrix has published an advisory (CTX696604) with remediation guidance. The vulnerability is tracked in the NVD and carries a high criticality rating. Federal agencies and organizations using affected Citrix products are urged to apply patches promptly. Forensics triage requirements are also outlined in the BOD 26-04 implementation guidance.
View original advisory →CVE-2026-18080 affects the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin in all versions up to and including 1.17.8. The vulnerability exists in the save_attachments() function due to missing file extension validation and missing path normalization when processing inbound IMAP email attachments. Unauthenticated attackers can send a crafted email with a forged References header and a path-traversal attachment filename (e.g., ../helper.php) to the site's inbound mailbox. The cron-based IMAP sync job then writes attacker-controlled PHP files outside the protected crm-attachments directory into wp-content/uploads/. On servers where PHP execution is permitted in the uploads directory, this leads to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured. A patch has been issued and is referenced via the WordPress plugin changeset.
View original advisory →CVE-2026-80426 is a stored Cross-Site Scripting (XSS) vulnerability in the FiftyOne machine learning dataset tool. The vulnerability exists in the FieldLabelAndInfo React component, which passes dataset field descriptions directly to React's dangerouslySetInnerHTML without sanitization. Because descriptions are stored in the dataset schema and persist through exports, a malicious actor can embed scripts in a shared dataset. When a victim opens the dataset and hovers over the affected field, the injected script executes in the application's origin. The same origin is shared with the FiftyOne server, whose media route serves files from caller-specified absolute paths without authentication, enabling the injected script to read local files and access dataset and operator endpoints as the viewing user. The vulnerability affects FiftyOne versions prior to 1.21.0, and a fix was released in v1.21.0.
View original advisory →CVE-2026-77548 is a high-severity vulnerability affecting the UniFi Protect Application by Ubiquiti. The flaw stems from Improper Input Validation, allowing a malicious actor with low privileges and network access to perform Command Injection on the host device. This type of vulnerability can lead to full system compromise, remote code execution, and lateral movement within the network. The attack vector requires only low privileges, making it accessible to a broad range of potential threat actors. Ubiquiti has published a security advisory bulletin detailing the issue. Users of UniFi Protect are strongly advised to apply available patches immediately. The vulnerability is catalogued in the NVD and has been assessed with a high criticality rating.
View original advisory →CVE-2026-80347 describes a Server-Side Request Forgery (SSRF) vulnerability in the mcp-fetch package (versions through 1.6.3). The SSRF guard function isSafeUrl fails to strip brackets surrounding IPv6 literals before validation, causing net.isIP to return zero for bracketed addresses and skipping all private-address checks. The fallback DNS resolution also fails for bracketed strings, causing the target to be incorrectly reported as safe. The HTTP client subsequently strips brackets and connects to the actual address. Additionally, isPrivateIPv6 lacks handling for the ::ffff: IPv4-mapped prefix, meaning even partial fixes would remain bypassable. Attackers who can influence model tool arguments can use this flaw to reach loopback, private, and link-local metadata endpoints (e.g., cloud IMDS). Internal responses can then be read back into the AI model context, enabling information disclosure and potential lateral movement within internal networks.
View original advisory →CVE-2026-58095 is a critical vulnerability in FreeBSD's ppp(8) daemon affecting the mp_Enddisc() function. The function uses incorrect length calculations when formatting endpoint discriminator addresses for display purposes. This flaw allows a received endpoint option from a malicious PPP peer to overflow a global result buffer. Exploitation can result in a crash of the ppp(8) process or potentially allow arbitrary code execution with root privileges. The vulnerability is remotely triggerable by any malicious PPP peer without authentication requirements. FreeBSD has issued a security advisory (FreeBSD-SA-26:60.ppp) addressing this issue. The high criticality stems from the potential for unauthenticated remote code execution as root.
View original advisory →CVE-2026-81029 describes an open redirect vulnerability in OpenMetadata where the application accepts a caller-supplied post-authentication redirect target without validation. The SamlLoginServlet stores the callback parameter in the HTTP session without verifying it against any registered destination, and later appends the freshly issued JWT token along with the user's email and name to that URL before redirecting. The OIDC and OAuth2 handlers follow the same flawed pattern. An attacker can craft a malicious link pointing to an attacker-controlled destination, causing the server to deliver a valid authentication token to that destination when a victim completes login. This effectively results in full account takeover since the token authenticates API calls as the victim's account. Version 2.0.0 of OpenMetadata resolves the issue by removing the caller-supplied callback parameter entirely, while no 1.x release includes any validation of this parameter.
View original advisory →CVE-2026-57170 affects the Compliance-Trestle Python SDK used for managing OSCAL compliance documents. Versions prior to 3.12.4 and 4.0.0 through 4.0.3 contain a server-side template injection (SSTI) vulnerability in custom Jinja2 include tags (mdsection_include and md_clean_include). These tags re-parse included Markdown file content as Jinja2 template code in a non-sandboxed environment, enabling arbitrary code execution. The root cause is the use of a plain jinja2.Environment instead of a SandboxedEnvironment in Trestle/core/jinja/tags.py. Attacker-controlled OSCAL data fields such as control statements or component descriptions containing Jinja2 syntax can be injected and executed. Delimiter neutralization is only applied to parameter tables, leaving other prose fields vulnerable. The vulnerability has been fixed in version 4.1.0. Patches are available via two GitHub commits and a security advisory.
View original advisory →