Overview of incoming advisories.
2186 results found
NVIDIA NemoClaw for Linux contains a critical vulnerability in its inference server setup that allows remote attackers to access the inference service without authentication. The flaw can be exploited remotely without any credentials, making it particularly dangerous in exposed deployments. A successful exploit may lead to information disclosure, potentially exposing sensitive model data or inference results. The vulnerability also enables denial of service attacks, which could disrupt AI inference workloads. NVIDIA has published a security advisory on their GitHub product-security repository. The vulnerability has been assigned CVE-2026-65105 and is tracked on both NVD and CVE.org. Given the unauthenticated remote access nature, this vulnerability poses a high risk to organizations using NVIDIA NemoClaw in their AI/ML infrastructure.
View original advisory →Nokogiri versions before 1.13.2 (CRuby with packaged libraries) ship vendored libxml2 2.9.12 and libxslt 1.1.34, both affected by upstream CVEs. CVE-2021-30560 in libxslt exposes applications to denial-of-service when transforming XML with untrusted XSL stylesheets. CVE-2022-23308 in libxml2 exposes applications to denial-of-service, memory disclosure, or code execution when parsing untrusted documents with specific parse options (DTDVALID=true, NOENT=false). These vulnerabilities are inherited through Nokogiri's vendored/bundled dependencies, representing a supply chain risk. The fix is to upgrade to Nokogiri 1.13.2, which updates libxml2 to 2.9.13 and libxslt to 1.1.35. Applications using older versions of Nokogiri with CRuby and packaged libraries should upgrade immediately. Multiple GitHub commits and security advisories have been issued to address these issues.
View original advisory →Adobe Campaign Classic (ACC) is affected by a critical OS Command Injection vulnerability (CVE-2026-76195) classified under CWE as Improper Neutralization of Special Elements used in an OS Command. The vulnerability allows an attacker to execute arbitrary code in the context of the current user. No user interaction is required for exploitation, making it particularly dangerous. The scope of the vulnerability is changed, indicating impact can extend beyond the vulnerable component. Adobe has published a security advisory (APSB26-134) addressing this issue. The vulnerability is tracked on NVD with a High criticality rating. Organizations using Adobe Campaign Classic should apply patches immediately.
View original advisory →CVE-2026-78676 affects GitPython versions before 3.1.59, where the library fails to safely re-serialize multi-line git-config values during write operations. This flaw allows dormant quoted values containing embedded newlines to be corrupted into active git directives such as core.hooksPath. An attacker can craft a malicious git config file that appears benign until any unrelated GitPython config write operation triggers the injection. Once activated, the injected directives can redirect git hooks to attacker-controlled scripts, enabling arbitrary code execution. The vulnerability is particularly dangerous in CI/CD pipelines and developer environments where GitPython is commonly used. No user interaction beyond a normal config write is required to activate the payload. The fix is available in GitPython 3.1.59 and users are strongly advised to upgrade immediately.
View original advisory →CVE-2026-55553 affects the urllib HTTP client library for Node.js, which incorrectly reuses caller-supplied options including authentication headers when following redirects across different origins. The vulnerability exists in src/HttpClient.ts where the #requestInternal function recursively passes the same options object to redirected requests regardless of scheme, host, or port changes. Sensitive headers such as Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can be leaked to attacker-controlled redirect destinations. No user interaction is required for exploitation, making this a significant credential exposure risk. The issue affects urllib versions prior to 2.44.1 and 4.9.1. Fixes have been released in versions 2.44.1 and 4.9.1 via two separate commits. The vulnerability could allow attackers to harvest credentials and potentially reuse them against the original API or related services.
View original advisory →CVE-2026-63075 is a vulnerability in OpenSSL's QUIC stack where a remote peer can trigger unbounded memory growth leading to Denial of Service. The flaw arises because OpenSSL retains metadata for ACK-only packets even though the QUIC protocol does not require peers to acknowledge such packets. A malicious peer can exploit this by repeatedly sending PING frames to force ACK-only responses while withholding acknowledgements, causing persistent memory accumulation. This attack only requires completing a valid QUIC handshake, making it accessible to remote unauthenticated attackers. The impact is especially severe under sustained traffic or with many concurrent QUIC connections. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The fix involves updating watermark accounting for ACK-only packets without storing their metadata. The OpenSSL FIPS module is not affected as QUIC code is outside the FIPS boundary. Multiple commits have been issued across OpenSSL branches to remediate this issue.
View original advisory →Nokogiri versions before 1.18.3 are affected by two vulnerabilities rooted in libxml2. The first is a stack buffer overflow triggered when reporting DTD validation errors involving long QName prefixes. The second is a use-after-free vulnerability that occurs during validation against untrusted XML Schemas (XSD files). Both vulnerabilities can be exploited by providing malicious DTD content or untrusted XSD files to affected applications. Successful exploitation may result in denial of service or potential arbitrary code execution. The vulnerabilities are tracked under CVE-2025-71407 and have been patched in Nokogiri 1.18.3. Users and maintainers relying on Nokogiri for XML parsing and validation should upgrade immediately.
View original advisory →CVE-2026-68513 describes a heap buffer overflow vulnerability in PyOpenEXR, the Python wrapper for the OpenEXR image format library used in the motion picture industry. The flaw affects versions 3.3.0–3.3.12 and 3.4.0–3.4.13 and is triggered by a channel-name key collision between literal and prefixed RGB channels. When separate_channels=false, the channelNameToRGBA() function fails to properly handle crafted EXR files containing both literal channels (e.g., 'left') and prefixed channels (e.g., 'left.R', 'left.G', 'left.B'). This collision causes the wrapper to reuse an undersized NumPy array, resulting in an out-of-bounds write during pixel decoding. An attacker could exploit this by supplying a specially crafted flat scanline EXR file. The vulnerability has been patched in versions 3.3.13 and 3.4.14.
View original advisory →NLTK versions prior to 3.10.3 are vulnerable to a denial-of-service attack via XML entity expansion, commonly known as a 'Billion Laughs' attack. The library uses Python's xml.etree.ElementTree to parse XML across multiple modules, which processes entity declarations defined in document DTDs. Attackers can craft malicious XML payloads containing deeply nested entity declarations that expand exponentially in memory, turning small payloads of hundreds of bytes into megabytes of data. This memory exhaustion can cause denial of service on affected systems. The fix is available in NLTK version 3.10.3. The vulnerability has been documented in the NLTK GitHub security advisories and VulnCheck advisories. Users are strongly advised to upgrade to the patched version immediately.
View original advisory →CVE-2026-24263 affects NVIDIA DGX Spark system firmware, where a privileged attacker can trigger a NULL pointer dereference. Successful exploitation may lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability requires privileged access to exploit, limiting the attack surface somewhat. However, the breadth of potential impact makes this a high-severity issue. NVIDIA has published an advisory via their product-security GitHub repository. The vulnerability is tracked by both the NVD and CVE databases. Users of NVIDIA DGX Spark systems should apply firmware updates as soon as they become available.
View original advisory →CVE-2026-75496 affects Webkul QloApps, a hotel booking and management platform. The vulnerability stems from improper validation of uploaded file extensions and MIME types before files are moved to a publicly accessible directory. A remote, authenticated attacker with administrative privileges can exploit this flaw to upload executable files and achieve remote code execution on the server. The issue has been patched in commit 153ec1c. The vulnerability is classified as high severity due to its potential for full server compromise, though exploitation requires authenticated administrative access.
View original advisory →CVE-2026-34968 affects Adminer versions before 5.4.3, exposing a critical arbitrary file deletion vulnerability in SQLite mode. The flaw exists in the database-list drop action, which fails to validate file extensions before performing deletions. An authenticated attacker can exploit this by submitting arbitrary relative file paths via the db[] parameter. This allows deletion of any file writable by the PHP process running Adminer. The vulnerability requires authentication but can have severe impact on server integrity and availability. It was patched in Adminer version 5.4.3. Multiple advisories have been published including on GitHub Security Advisories and VulnCheck. Organizations using Adminer in SQLite mode should upgrade immediately to mitigate risk.
View original advisory →Nokogiri versions before 1.14.3 (CRuby implementation using packaged libxml2) bundle libxml2 v2.10.3, which contains a NULL pointer dereference vulnerability in XML Schema processing functions. The affected functions include xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK. An attacker can supply a crafted or malformed XML schema to trigger the NULL pointer dereference, potentially causing a segfault and resulting in a denial of service condition. The vulnerability is tracked as CVE-2023-28484 in libxml2. Nokogiri 1.14.3 resolves the issue by upgrading the bundled libxml2 to version 2.10.4. Only users of the CRuby implementation with the packaged libxml2 are affected.
View original advisory →Grav CMS versions before 3.9.2 are vulnerable to Host header injection in the sendInvitationEmail() function. Attackers can manipulate the HTTP Host header to poison invitation links sent to users, redirecting them to attacker-controlled domains. The vulnerability exists because the require_trusted_host protection only covers password reset flows and not invitation email flows. Token-bearing invitation links can be crafted to exfiltrate tokens or perform phishing attacks. This represents a bypass of existing security controls within the Grav CMS framework. The fix is available in Grav version 3.9.2 and above.
View original advisory →CVE-2026-54874 affects OpenSSL's DTLS implementation, where receiving records for a future epoch during a handshake causes excessive memory buffering. The vulnerability stems from OpenSSL retaining the entire 16KB read buffer per record rather than just the record bytes, with up to 100 records buffered per connection, resulting in ~1.7MB retained per connection. This yields a memory amplification factor of approximately 1200x, enabling remote memory exhaustion DoS attacks against DTLS servers. Affected versions include OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. The issue was reported by Amazon Web Services on 18 May 2026 and fixed by Matt Caswell. Patches are available across all affected branches. Severity is assessed as Low due to bounded per-connection memory and applicability of existing connection limits.
View original advisory →An unpatched vulnerability has been discovered in Calix GS7 XGS (GS5239XG) residential routers widely deployed by U.S. broadband providers. The flaw allows remote, unauthenticated attackers to create arbitrary port-forwarding rules, effectively bypassing Network Address Translation (NAT) protections. This exposure can make internal network devices publicly accessible from the internet without any user interaction or authentication required. The vulnerability poses significant risk to home and small business users relying on these routers for network segmentation and security. As of the article's publication, no patch has been released by Calix to address the issue. Multiple broadband providers distributing these devices could have a large number of affected customers. The ability to expose internal devices could facilitate further attacks including lateral movement, data exfiltration, or device compromise.
View original advisory →Hackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities allow attackers to forge SAML responses and gain administrative access to affected WordPress sites. The flaws are classified as critical severity, indicating significant risk to site integrity and data. Exploitation attempts are ongoing, making patching urgent for all affected site owners. WordPress administrators using the miniOrange SAML plugin are strongly advised to update immediately to mitigate the risk of full site compromise.
View original advisory →This weekly cybersecurity recap covers multiple emerging threats and attack vectors observed during the week. Key topics include AI-powered attacks targeting Programmable Logic Controllers (PLCs), attacks against GitLab infrastructure, and Stripe API key leaks. The article highlights a trend where trusted tools are being weaponized, old vulnerabilities are receiving renewed exploitation attention, and AI is lowering the barrier for exploit development. Researchers are uncovering attacks that are simpler to execute than previously assumed. The recap serves as a broad overview of the threat landscape for the week, touching on supply chain risks, credential exposures, and critical infrastructure concerns.
View original advisory →Cybersecurity researchers have identified two new malware families, WordlistLoader and SynkLoader, being used to deliver next-stage payloads and likely sell access to ransomware groups. WordlistLoader is used to distribute Amatera Stealer (also known as ACR Stealer or AcridRain Stealer) through ClearFake campaigns that leverage the ClickFix (FakeCaptcha) technique. SynkLoader is focused on phishing Windows credentials. Both loaders represent an evolving threat landscape where initial access brokers use stealthy delivery mechanisms to compromise victims before handing off access to ransomware operators. The campaigns highlight continued abuse of social engineering techniques like fake CAPTCHA pages to trick users into executing malicious code. Gen Digital researchers flagged these threats as part of ongoing monitoring of loader-based malware ecosystems.
View original advisory →A critical security vulnerability (CVE-2026-18963) has been discovered in Keycloak, the open-source identity and access management server maintained by Red Hat. The flaw carries a CVSS score of 9.1 and allows unauthenticated remote attackers to take over any user account by forcing a password reset. Red Hat and the Keycloak project have released patches to address the issue. The vulnerability poses a significant risk to organizations relying on Keycloak for authentication and authorization. Users are strongly advised to apply the available patches immediately to prevent potential account compromise.
View original advisory →