SPOJENO AI Binance links $6.3 billion crypto theft to compromised DevOps laptop
Binance, the world's largest crypto exchange, has linked the theft of about $6.3 billion in cryptocurrency to a DevOps engineer's compromised laptop. [...]
VIRY.CZ RADAR je monitor bezpečnostních hrozeb: advisories, zranitelnosti a threat intel z 65 veřejných zdrojů z 25 zemí, česky a na jednom místě. V archivu máme 10 471 položek.
Více informací
Jsem „protkán“ AI. Snažím se pochopit zdrojové texty a bez vymýšlení je zestručnit a převést do českého jazyka, případně s využitím AI seskupit. Patřičně jsem pak hrdý na týdenní reporty, kde s pomocí AI zpracovávám stovky článků a hledám v nich souvislosti. Používám ale i čistou matematiku, takže pokud například více zdrojů mluví o shodné CVE chybě, seskupím to do jednoho příspěvku. Doporučuji se přihlásit k jejich odběru. Pokud se Vám líbím, nebráním se finanční podpoře :-)
Původní „Igiho stránka o virech“ se odstěhovala sem.
Všechny zprávy za posledních 7 dní
Hugging Face malware campaign returns to hijack GPUs for crypto mining
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]
SPOJENO AI Polymarket halts trading after crypto-draining script breach, $2.5M traced
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. [...]
Fake crypto app on Apple App Store linked to $23K wallet theft
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. [...]
What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
We explain what shell vulnerabilities are and how to manage them: PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell Category: Guides & Best Practices
BE
A quiet week in infosec <.<
Welcome to this week’s edition of the Threat Source newsletter. “The darkest period of my life, so far, arrived the summer I was pregnant with my eldest son. The future was growing in me with all of its terrifying unpredictability, and I found myself anxious, unable to work and woefully at sea.” — Lauren Groff I doubt Lauren had this maniacal infosec news cycle in mind when she wrote about the terrifyingly unpredictable future, but honestly, she’s got our current careers down cold. Let he who…
US
Chrome extensions with 13.4 million installs caught hijacking searches
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. [...]
US
IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
Today, we’re proud to share thatMicrosoft has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises (Doc #US54123526, September 2026). The IDC Marketscape calls out three strengths that we believe matter most in endpoint security today: Autonomous attack disruption and predictive shielding contain ransomware and identity attacks in minutes, at a meaningful scale. Agentic AI through Security Copilot is now generally available, with measured gains…
Microsoft US
Tracking AI adoption in North Korean threat actor tradecraft
In this article Stages of AI adoption by North Korean threat actors AI use across North Korean threat operations AI-assisted targeting and reconnaissance AI-assisted social engineering and identity deception AI-assisted software and tooling development AI-assisted operational scaling and analysis Mitigation and protection guidance Microsoft Defender detections As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed, efficiency, and…
Rilevate vulnerabilità in prodotti Supermicro
Aggiornamenti di sicurezza sanano alcune vulnerabilità, di cui una con gravità “critica” e 4 con gravità “alta”, in vari prodotti Supermicro. Tali vulnerabilità potrebbero consentire a un attaccante di eseguire codice arbitrario, accedere a informazioni sensibili, elevare i propri privilegi ed eludere i meccanismi di sicurezza e autenticazione sui sistemi interessati.
EPSS 0.00 CVE-2026-18449 CVE-2026-18450 CVE-2026-65211 CVE-2026-65219 CVE-2026-65220 Supermicro IT
SPOJENO AI Aktivně zneužívané zranitelnosti v Citrix NetScaler
Upozorňujeme na aktivně zneužívané zranitelnosti CVE-2026-88771 a CVE-2026-88772 v produktu Citrix Netscaler, které umožňují vzdálené spuštění kódu. Doporučujeme bezodkladně aktualizovat na verzi 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS nebo 13.1-37.279 a novější podle používané produktové řady. Dále doporučujeme prověřit indikátory kompromitace, jelikož aktualizace nemusí kompromitaci odstranit. Zranitelnosti Zranitelnost CVE-2026-88771 spočívá v nesprávném ověřování vstupů a umožňuje…
KEV ✓ EPSS 0.82 CVSS 9.5 CVE-2026-88771 CVE-2026-88772 Citrix NetScaler veřejná správa finance školství CZ US HU GB FR IT SE
Vulnerabilities in Zimbra Collaboration software
During its own research, CERT Polska has found 2 XSS vulnerabilities (CVE-2026-66911 and CVE-2026-66912) in Zimbra Collaboration software.
EPSS 0.01 CVE-2026-66911 CVE-2026-66912 Zimbra PL
Risolte vulnerabilità in Jenkins
Jenkins Project ha rilasciato aggiornamenti di sicurezza per Jenkins, server open source per l’automazione delle attività di compilazione, verifica e distribuzione del software, che sanano molteplici vulnerabilità, di cui 13 con gravità "alta".
EPSS 0.00 CVE-2026-117612 CVE-2026-117613 CVE-2026-117614 CVE-2026-117615 CVE-2026-117616 CVE-2026-117617 CVE-2026-117618 CVE-2026-117619 CVE-2026-117620 CVE-2026-117621 CVE-2026-117622 CVE-2026-117623 CVE-2026-117624 Jenkins IT
Aggiornamenti di sicurezza per prodotti MongoDB
MongoDB ha rilasciato aggiornamenti di sicurezza per sanare alcune vulnerabilità, di cui 2 con gravità “alta”, nei prodotti Database Tools e Laravel. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eludere i meccanismi di sicurezza e manipolare i dati sui sistemi interessati.
EPSS 0.00 CVE-2026-116641 CVE-2026-118510 MongoDB IT
Cohere’s Qwen Story: Looks More Like Model Jaggedness
Key findings Re-sampling URLs from the trace shared by Cohere yields 52 different destination hosts, many of which are local or do not exist, and one is an invalid top-level domain. Swapping the order of two program names in a check for available tools made the model much less likely to continue with a network call. Model jaggedness (inconsistent behavior that changes with small differences in context) seems like a more likely explanation than a fixed backdoor destination. Our interactive…
Malicious Firefox extensions impersonate popular crypto wallets
Socket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets. Once installed, the malicious extensions stole recovery phrases and private keys, which would provide the attacker with full control of a wallet. A crypto wallet is an app, browser extension, or physical device that lets you manage cryptocurrency such as Bitcoin. Despite its name, it doesn’t actually hold your coins. Those are recorded on a blockchain, a shared…
Mattermost security advisory (AV26-1104)
Serial number: AV26-1104 Date: October 29, 2026 As of October 28, 2026, Mattermost is affected by a vulnerability in the following product: Mattermost Prior to or equal to 11.10.0 Prior to or equal to 11.9.2 Prior to or equal to 11.8.6 Prior to or equal to 11.7.11 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Mattermost Security Updates
Mattermost CA
Risolte vulnerabilità in Elastic Cloud Enterprise
Elastic ha rilasciato aggiornamenti di sicurezza per Elastic Cloud Enterprise (ECE), piattaforma per la gestione centralizzata di ambienti Elastic, che sanano alcune vulnerabilità, di cui 3 con gravità "alta". Tali vulnerabilità, riconducibili a una risoluzione non adeguata dei collegamenti prima dell'accesso ai file, potrebbero consentire a un attaccante locale di accedere a informazioni riservate, modificare o causare la perdita di dati ed eludere i meccanismi di autenticazione.
EPSS 0.00 CVE-2026-115708 CVE-2026-115709 CVE-2026-115713 Elastic IT
3 Ways AI Agents Already Operate in Your Browser
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users. [...]
US
Reports of SIEM's Death Have Been Greatly Exaggerated
SIEM isn't dead. Its bloated pricing model is. Discover why legacy pricing models need to go, how AI fits in, and how to build a smarter, cost-effective security logging strategy.
US
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, appearing in slightly over one-third of all Cisco Talos Incident Response (Talos IR) engagements — a decrease from over 50 percent last quarter. In addition to traditional phishing links and attachments, we observed numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool.…
KEV ✓ EPSS 1.00 CVE-2023-20198 Cisco Microsoft Anthropic telekomunikace US
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]
CVE-2026-109618 * CVE-2026-109619 * CVE-2026-46300 * Linux veřejná správa US
Risolte vulnerabilità in n8n
Risolte 15 vulnerabilità, di cui 13 con gravità “alta”, che interessano la piattaforma open-source per l'automazione dei workflow n8n.
EPSS 0.00 CVE-2026-118641 CVE-2026-118642 CVE-2026-118643 CVE-2026-118644 CVE-2026-118645 CVE-2026-118646 CVE-2026-118647 CVE-2026-118648 CVE-2026-118649 CVE-2026-118675 CVE-2026-118676 CVE-2026-118678 CVE-2026-118679 n8n IT
n8n security advisory (AV26-1103)
Serial number: AV26-1103 Date: October 29, 2026 As of October 28, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 2.44.1 Prior to 2.43.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Crafted Workflow ID Gives Access to Data Tables in Other Projects Overview - n8n-io/n8n
n8n CA
Risolte vulnerabilità in Grafana
Rilasciati aggiornamenti di sicurezza per risolvere 5 vulnerabilità, di cui tre con gravità “alta”, presenti in Grafana, nota applicazione web per la visualizzazione e l’analisi interattiva di dati. Tali vulnerabilità, qualora sfruttate e in presenza di specifiche condizioni, potrebbero consentire a un utente malintenzionato l'elusione dei meccanismi di sicurezza, l'accesso a informazioni sensibili e la modifica non autorizzata di configurazioni sui sistemi target.
EPSS 0.00 CVE-2026-100105 CVE-2026-103506 CVE-2026-88967 Grafana IT
Cyberattack disrupts Belgian tax services before filing deadline
The Federal Public Service Finance (FPS Finance), which oversees taxation and other financial administration, said Wednesday that it was investigating the extent of the attack and had temporarily suspended access to MyMinfin, the country's main online platform for managing tax and financial affairs.
SPOJENO AI UNM Health ransomware attack disrupts patient care, surgeries
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]
The day after tomorrow: After PHP2Shell, it gets worse, then defenders win
PHP2Shell and Brocolli2Shell may be harbingers of many vulnerabilities to come. But we can be ready Category: News
BE
· zachyceno
Hitachi Energy TRO600 series products
View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information. Please refer to the Recommended Immediate Actions section for information about the mitigation/remediation. The following versions of Hitachi Energy TRO600 series products are affected: TRO600 vers:TRO600/<=9.2.1.6,…
EPSS 0.00 CVE-2026-106087 CVE-2026-10756 Hitachi Energy energetika US
· zachyceno
SPOJENO PŘES CVE Siemens Mendix SAML Module
View CSAF Summary Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Mendix SAML Module are affected: Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.4 (CVE-2026-89209) Mendix SAML …
EPSS 0.00 CVE-2026-89209 Siemens Mendix výroba a průmysl US IT
· zachyceno
Hitachi Energy CoreTec Product
View CSAF Summary Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy CoreTec Product are affected: CoreTec5 vers:CoreTec5/<=3.4.0, 5…
EPSS 0.94 CVE-2026-13162 CVE-2026-43284 Hitachi Energy energetika US
Risolta vulnerabilità in prodotti Sophos
Risolta una vulnerabilità con gravità “critica” in Sophos UTM. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un attaccante remoto non autenticato di eseguire codice arbitrario con privilegi elevati sui sistemi interessati.
EPSS 0.01 CVE-2026-118633 Sophos IT
Aggiornamenti di sicurezza per prodotti Juniper Networks
Juniper Networks ha rilasciato aggiornamenti di sicurezza che sanano 18 vulnerabilità, di cui 2 con gravità "critica" e 8 con gravità "alta", nei prodotti Session Smart Router e Session Smart Conductor, soluzioni dedicate rispettivamente al routing e alla relativa gestione.
EPSS 0.01 CVE-2026-103401 CVE-2026-103402 CVE-2026-103403 CVE-2026-103406 CVE-2026-103407 CVE-2026-103408 CVE-2026-103409 CVE-2026-103410 CVE-2026-103411 CVE-2026-106079 Juniper Networks IT
SPOJENO PŘES CVE Have an older iPhone or iPad? Apple has a security update for you
Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads. Apple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad. The iOS 18.7.11 update is a backport: it brings a fix from a newer software version to…
KEV ✓ EPSS 0.26 CVE-2026-86950 Apple US FR CA IT
Vulnerabilities in Szafir software
CERT Polska has received a report about 3 vulnerabilities (CVE-2026-93570, CVE-2026-93571 and CVE-2026-106036) found in Szafir software.
EPSS 0.00 CVE-2026-106036 CVE-2026-93570 CVE-2026-93571 Szafir PL
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is a HTTP…
OpenAI US
Múltiples vulnerabilidades en la aplicación de SABBATIC
Multiple vulnerabilities in SABBATIC application Thu, 10/29/2026 - 17:50 Aviso Affected Resources SABBATIC. Description INCIBE has coordinated the publication of 5 medium severity vulnerability, affecting SABBATIC application, software for digitizing expense receipts and invoices. The vulnerabilities were discovered by David Padilla Alvarado y Víctor Manuel Pérez Cámara. These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type…
EPSS 0.00 CVSS 4.8 CVE-2026-5697 CVE-2026-5698 CVE-2026-5699 CVE-2026-5700 CVE-2026-5702 SABBATIC ES
Cross-Site Scripting reflejado en la configuración de PHP-CGI/PHP-FPM de ICT Innovations
Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration Thu, 10/29/2026 - 09:38 Aviso Affected Resources Insecure runtime configuration in PHP-CGI/PHP-FPM. Description INCIBE has coordinated the publication of a medium severity vulnerability affecting the PHP-CGI/PHP-FPM configuration of ICT Innovations, a web-based multi-user package. The vulnerability was discovered by Gonzalo Aguilar García (6h4ack). This vulnerability has been assigned the following code, CVSS v4.0…
EPSS 0.00 CVSS 5.1 CVE-2026-7190 ICT Innovations ES
Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
Introduction A couple of months ago, our research revealed a highly sophisticated infection chain and a complex .NET assembly-loading framework built on XAML markup, which strongly indicates a supply-chain attack targeting a custom Windows build used exclusively by government entities in Asia. The malicious framework has been labeled NetamLoader; at present, no attribution to any known APT group has been established. The sample came to light in the first half of 2026, when Kaspersky Security…
Amatera: How the prolific infostealer works and spreads
The malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 is an example of how cybercrime has professionalized
SK
MadApe: The Code That Opens the Door
Group-IB uncovers MadApe, a previously undocumented Microsoft Device Code phishing kit that uses business-themed PDF lures, configurable redirects and fake document-sharing pages to trick victims into completing Microsoft Device Code authentication across a broad infrastructure cluster.
Microsoft SG
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it's convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to revert to a previous snapshot, all changes applied to the VM are... lost! Therefore, it's important to store important data outside the VM. If you do malware analysis with Ghidra[1], your work lives in "projects".…
· zachyceno
SPOJENO AI Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. [...]
ConnectWise veřejná správa telekomunikace výroba a průmysl finance obrana energetika US
· zachyceno
ZDI-26-834: Linux Kernel IPv6 AH Routing Header Integer Underflow Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-80844.
EPSS 0.00 CVSS 8.8 CVE-2026-80844 Linux US
· zachyceno
ZDI-26-835: Linux Kernel Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-93826.
EPSS 0.00 CVSS 7.8 CVE-2026-93826 Linux US
· zachyceno
ZDI-26-836: Linux Kernel CIFS File System Use-After-Free Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-72315.
EPSS 0.00 CVSS 7.2 CVE-2026-72315 Linux US
· zachyceno
ZDI-26-837: Linux Kernel XFRM Subsystem Use-After-Free Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-98231.
EPSS 0.00 CVSS 7.8 CVE-2026-98231 Linux US
· zachyceno
SPOJENO PŘES CVE ZDI-26-838: FreeBSD Kernel TTY Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-58093.
EPSS 0.00 CVSS 8.8 CVE-2026-58093 FreeBSD US
· zachyceno
ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118623.
CVSS 7.8 CVE-2026-118623 MLflow US
· zachyceno
ZDI-26-840: MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118624.
CVSS 5.4 CVE-2026-118624 MLflow US
· zachyceno
ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118625.
CVSS 6.3 CVE-2026-118625 MLflow US
· zachyceno
ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118626.
CVSS 5.4 CVE-2026-118626 MLflow US
· zachyceno
ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118627.
CVSS 7.8 CVE-2026-118627 MLflow US
· zachyceno
ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-118628.
CVSS 8.2 CVE-2026-118628 MLflow US
· zachyceno
ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-37052.
EPSS 0.01 CVSS 7.8 CVE-2024-37052 MLflow US
· zachyceno
SPOJENO PŘES CVE ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-64849.
KEV ✓ EPSS 0.10 CVSS 6.8 CVE-2026-64849 MLflow veřejná správa US CA
· zachyceno
ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.7. The following CVEs are assigned: CVE-2026-71211.
EPSS 0.00 CVSS 7.7 CVE-2026-71211 MLflow US
· zachyceno
New Prompt Injection Techniques Cover Agent-Planning Attacks
US
· zachyceno
WordPress 7.1.4
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. As a courtesy, the security fixes were backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in…
WordPress FI
· zachyceno
SPOJENO AI Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. [...]
EPSS 0.00 CVE-2026-118539 Drupal Commerce Core CA US FI