Overview of incoming advisories.
2018 results found
CVE-2026-61758 is a deserialization of untrusted data vulnerability affecting NVIDIA Megatron Bridge. An attacker exploiting this flaw could achieve remote code execution, tamper with data, and cause information disclosure. The vulnerability was published via NVD and has a high criticality rating. NVIDIA has issued a security advisory linked through their product-security GitHub repository. Deserialization vulnerabilities are commonly exploited in enterprise and AI/ML infrastructure components. The impact scope includes confidentiality, integrity, and availability. Users of NVIDIA Megatron Bridge are advised to review the advisory and apply mitigations or patches promptly.
View original advisory →A critical command injection vulnerability has been identified in the Cobham SATCOM VSAT7090 Maritime Satellite Router up to version 20260704. The vulnerability exists in the c_set_reports_decode function within the mail-report.sh file, specifically in the JSON Parsing component. Attackers can manipulate the sender/recipients arguments to inject arbitrary commands. The vulnerability is remotely exploitable, significantly increasing its risk profile. A public exploit is already available, making active exploitation a realistic threat. The vendor was notified prior to public disclosure but did not respond. This affects maritime satellite communication infrastructure, which is considered critical for naval and shipping operations. The lack of vendor response and availability of a public exploit elevate the urgency for mitigation.
View original advisory →A Use of Hard-coded Credentials vulnerability has been identified in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software. The vulnerability allows attackers to retrieve embedded sensitive data through hardcoded credentials present in the software. Affected versions range from V.4 through versions prior to V.16. The issue is tracked as CVE-2026-18931 and was disclosed via the Turkish cybersecurity authority siberguvenlik.gov.tr. Hard-coded credentials represent a significant security risk as they cannot be changed by end users and can be exploited by anyone who discovers them. Organizations using affected versions of Talassoft should upgrade to V.16 or later to mitigate this risk.
View original advisory →A critical vulnerability was identified in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows attackers to bypass the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url parameter from POST requests and passes it to JMXServiceURL and JMXConnectorFactory without adequate filtering. The existing denylist only blocks URLs matching 'service:jmx:rmi:///jndi/ldap:.*', which can be circumvented using alternative JMX URL forms such as ldaps:// schemes or LDAP URLs with non-empty JMX host components. Exploitation causes the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. Potential impacts include server-side request forgery (SSRF), credential forwarding to attacker-controlled endpoints, and remote code execution depending on the target JVM configuration and available classes.
View original advisory →CVE-2026-61766 is a high-severity vulnerability affecting NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, a class of vulnerability commonly exploited to achieve arbitrary code execution. A successful exploit could lead to code execution, data tampering, and information disclosure. The vulnerability is currently undergoing analysis by NVD. NVIDIA has published a product security advisory on GitHub. This type of deserialization vulnerability can be critical in AI and machine learning infrastructure components like Megatron Bridge, as they may run with elevated privileges and handle sensitive data. Organizations using NVIDIA Megatron Bridge should monitor for patches and apply mitigations as soon as they become available.
View original advisory →CVE-2026-61773 affects NVIDIA Megatron Bridge, exposing a deserialization of untrusted data vulnerability. An attacker who successfully exploits this flaw could achieve remote code execution, tamper with data, and access sensitive information. The vulnerability is rated high criticality given its potential impact across code execution, data integrity, and confidentiality. NVIDIA has published an advisory through their product-security GitHub repository. The issue is tracked by both the NVD and CVE Program. No additional technical details or proof-of-concept code have been publicly disclosed at this time. Users of NVIDIA Megatron Bridge are advised to monitor NVIDIA's security advisories for patches and mitigations.
View original advisory →A SQL injection vulnerability (CVE-2026-18210) has been identified in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company's 'Products Store' application. The vulnerability is classified as an improper neutralization of special elements used in SQL commands, allowing attackers to perform SQL injection attacks. All versions of Products Store prior to commit 030631b2 are affected. The vulnerability was reported via the Turkish cybersecurity authority (siberguvenlik.gov.tr) and published on the NVD. Exploitation could allow unauthorized access to or manipulation of the underlying database. Users are advised to update to a version at or after commit 030631b2 to remediate the issue.
View original advisory →CVE-2026-61751 is a high-severity vulnerability affecting NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, which can be exploited by an attacker to achieve remote code execution, data tampering, and information disclosure. The vulnerability was disclosed via the NVD and NVIDIA's product security advisory. No patch or workaround details are included in the article, and the NVD entry is still undergoing analysis. The potential impact is significant given the possible consequences of full code execution on affected systems. NVIDIA's product security GitHub repository references internal tracking number 5868 for this issue.
View original advisory →CVE-2026-61771 affects NVIDIA Megatron Bridge, a component likely related to NVIDIA's AI/ML infrastructure. The vulnerability involves deserialization of untrusted data, a class of flaw that can be particularly dangerous. A successful exploit could lead to remote code execution, data tampering, and information disclosure. The vulnerability was published via the NVD (National Vulnerability Database) and is also tracked on CVE.org. NVIDIA has published a security advisory on their GitHub product-security repository. The high severity rating reflects the potential for full system compromise. Organizations using NVIDIA Megatron Bridge should review NVIDIA's advisory and apply any available patches promptly.
View original advisory →CVE-2026-61767 is a high-severity vulnerability affecting NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, which can be exploited by an attacker to achieve code execution, data tampering, and information disclosure. The vulnerability is catalogued in the National Vulnerability Database and has an associated NVIDIA product security advisory. Successful exploitation could have significant impact on confidentiality, integrity, and availability. NVIDIA has published details via their product-security GitHub repository. No specific workarounds are mentioned in the article. Users of NVIDIA Megatron Bridge are advised to review the advisory for remediation steps.
View original advisory →A stored cross-site scripting (XSS) vulnerability has been identified in the web-based management interface of HPE Networking Fabric Composer. An authenticated low-privilege operator user can inject malicious scripts that are later executed in the browser of an administrative user. A successful exploit allows arbitrary script execution in the victim's browser within the context of the affected interface. This represents a privilege escalation risk, as a lower-privileged user can potentially compromise administrative sessions. The vulnerability requires authentication, limiting but not eliminating the attack surface. HPE has published a security bulletin addressing the issue. Organizations using HPE Networking Fabric Composer should apply available patches or mitigations promptly.
View original advisory →CVE-2026-61766 is a high-severity vulnerability affecting NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, which can be exploited by an attacker to achieve remote code execution, tamper with data, and disclose sensitive information. The vulnerability was published via the NVD and NVIDIA's product security advisory. No authentication or user interaction details are specified in the current disclosure. The potential impact is significant given the consequences include code execution and data tampering. NVIDIA has published an advisory on their GitHub product-security repository. Organizations using NVIDIA Megatron Bridge should review the advisory and apply any available patches promptly.
View original advisory →Kyverno versions v1.9.0 through v1.12.7 contain a flaw in policy exception handling. When a policy running in enforce mode is combined with two PolicyExceptions, the less restrictive exception incorrectly takes precedence over the more restrictive one. An attacker can exploit this by crafting a resource name that matches the second exception's wildcard name pattern (e.g., '*ingress*'), effectively bypassing enforced policies. This vulnerability can be used to circumvent critical security policies, such as those blocking hostPath volume mounts in Kubernetes workloads. The issue represents a security control bypass in a Kubernetes-native policy engine widely used for admission control. The flaw was fixed in Kyverno v1.13.0. Organizations running affected versions should upgrade immediately to mitigate the risk of policy bypass attacks.
View original advisory →The Cronos blockchain network was forced to restart following a price-manipulation attack targeting the Tectonic cryptocurrency lending platform. An attacker exploited the platform to borrow approximately $74 million through the manipulation attack. Cronos subsequently halted and then resumed trading activity after addressing the incident. The attack highlights ongoing vulnerabilities in decentralized finance (DeFi) lending protocols, particularly around price oracle manipulation. Tectonic is a crypto lending service built on the Cronos blockchain. The exploit allowed the attacker to leverage manipulated asset prices to borrow funds far exceeding what would normally be collateralized. This type of flash loan or price oracle attack is a recurring threat vector in the DeFi ecosystem. The incident underscores the financial risks associated with DeFi platforms and the systemic impact such exploits can have on underlying blockchain networks.
View original advisory →A researcher running an internet-exposed inference honeypot discovered it had been co-opted by adversaries who relabeled it with popular AI model names and incorporated it into infrastructure advertised as providing 'free' LLM backends. The honeypot subsequently received a real coding-agent session containing sensitive context including conversation history, filesystem output, working directory paths, and the agent's local tool manifest. The researcher clarifies the honeypot did not request or trigger any tool execution, but the incident demonstrates what a malicious operator in that position could do with such access. This highlights a significant supply-chain and data-exposure risk for developers using unverified or 'free' LLM endpoints with AI coding agents. The attacker effectively performed a man-in-the-middle interception of an AI agent workflow, gaining visibility into the developer's local environment. The scenario underscores risks of trusting unverified AI infrastructure and the potential for credential, code, and environment data exfiltration through compromised LLM endpoints.
View original advisory →Microsoft has issued a warning about a new variant of the ClickFix social engineering technique called TerminalFix. The attack leverages fake Cloudflare CAPTCHA prompts displayed on compromised websites to deceive victims. Users are tricked into copying and running malicious PowerShell commands in Windows Terminal. The campaign deploys reverse tunnels as part of its payload delivery or persistence mechanism. TerminalFix represents an evolution of the ClickFix attack pattern, expanding the attack surface beyond the Run dialog to Windows Terminal. The use of reverse tunnels suggests the attackers seek persistent, covert access to compromised systems. This technique is particularly dangerous as it abuses legitimate user interfaces and trusted brand names like Cloudflare.
View original advisory →Socket's Threat Research Team discovered 13 malicious Composer/Packagist theme packages across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject malicious JavaScript into Vietnamese movie and comic streaming sites. The injected code runs two operations: a mobile ad-fraud/gambling redirect chain, and on iPhones, a WebKit-to-kernel exploit chain (DarkSword-linked, using CVE-2025-31277 and CVE-2025-43529) that installs spyware. The spyware collects keychain data, Wi-Fi passwords, SMS, contacts, photos, browser cookies, location history, and cryptocurrency wallet seeds from seven wallet apps (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX). The campaign is attributed to Vietnamese-operated threat actors using FUNNULL infrastructure (sanctioned by OFAC). On 2026-08-12, the operators redeployed with fresh filenames and added crypto-wallet seed theft. The kernel escape was patched in iOS 26.1 and WebKit entry points in iOS 18.7.3/iOS 26.2; unpatched devices remain vulnerable.
View original advisory →Berlin's city administration has confirmed a data theft incident after the Rhysida ransomware gang listed the city on their data leak site. The cybercriminals are actively attempting to extort the city government. Rhysida is a ransomware-as-a-service group known for targeting government and public sector entities. The attack resulted in confirmed exfiltration of data belonging to the city. Berlin authorities are responding to the extortion attempt. This incident highlights the continued targeting of European municipal governments by ransomware groups. The Rhysida gang uses double extortion tactics, threatening to publish stolen data if ransom is not paid.
View original advisory →The Silver Fox threat actor has been distributing the ValleyRAT backdoor disguised as a signed Chinese adware application called QN Wallpaper, a legitimate desktop-wallpaper tool. By hiding malware within a signed application, attackers exploit the tendency of users to add trusted or familiar software to antivirus exclusion lists. This allows the malware to run under a trusted process, effectively bypassing antivirus detection. Kaspersky, a Russian cybersecurity vendor, identified and reported on this campaign. The technique highlights the growing abuse of signed software and user trust as a vector for malware delivery. The campaign demonstrates sophisticated social engineering combined with code-signing abuse to evade security controls.
View original advisory →Threat actors linked to Aurora ransomware (also known as Aur0ra) have been observed leveraging Cursor, an AI-powered coding assistant, to conduct attacks against at least 10 targets. The findings come from independent analyses by CloudSEK and Gambit Security, based on exposed infrastructure tied to the Russian-speaking cybercrime group. The use of AI coding tools in ransomware operations marks a notable evolution in attack methodology. The group appears to be utilizing Cursor to assist in developing or refining attack tooling. This incident highlights growing concerns about the abuse of legitimate AI development tools by ransomware operators.
View original advisory →