Overview of incoming advisories.
2018 results found
NLTK versions prior to 3.10.3 are vulnerable to a denial-of-service attack via XML entity expansion, commonly known as a 'Billion Laughs' attack. The library uses Python's xml.etree.ElementTree to parse XML across multiple modules, which processes entity declarations defined in document DTDs. Attackers can craft malicious XML payloads containing deeply nested entity declarations that expand exponentially in memory, turning small payloads of hundreds of bytes into megabytes of data. This memory exhaustion can cause denial of service on affected systems. The fix is available in NLTK version 3.10.3. The vulnerability has been documented in the NLTK GitHub security advisories and VulnCheck advisories. Users are strongly advised to upgrade to the patched version immediately.
View original advisory →CVE-2026-24263 affects NVIDIA DGX Spark system firmware, where a privileged attacker can trigger a NULL pointer dereference. Successful exploitation may lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability requires privileged access to exploit, limiting the attack surface somewhat. However, the breadth of potential impact makes this a high-severity issue. NVIDIA has published an advisory via their product-security GitHub repository. The vulnerability is tracked by both the NVD and CVE databases. Users of NVIDIA DGX Spark systems should apply firmware updates as soon as they become available.
View original advisory →CVE-2026-75496 affects Webkul QloApps, a hotel booking and management platform. The vulnerability stems from improper validation of uploaded file extensions and MIME types before files are moved to a publicly accessible directory. A remote, authenticated attacker with administrative privileges can exploit this flaw to upload executable files and achieve remote code execution on the server. The issue has been patched in commit 153ec1c. The vulnerability is classified as high severity due to its potential for full server compromise, though exploitation requires authenticated administrative access.
View original advisory →CVE-2026-34968 affects Adminer versions before 5.4.3, exposing a critical arbitrary file deletion vulnerability in SQLite mode. The flaw exists in the database-list drop action, which fails to validate file extensions before performing deletions. An authenticated attacker can exploit this by submitting arbitrary relative file paths via the db[] parameter. This allows deletion of any file writable by the PHP process running Adminer. The vulnerability requires authentication but can have severe impact on server integrity and availability. It was patched in Adminer version 5.4.3. Multiple advisories have been published including on GitHub Security Advisories and VulnCheck. Organizations using Adminer in SQLite mode should upgrade immediately to mitigate risk.
View original advisory →Nokogiri versions before 1.14.3 (CRuby implementation using packaged libxml2) bundle libxml2 v2.10.3, which contains a NULL pointer dereference vulnerability in XML Schema processing functions. The affected functions include xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK. An attacker can supply a crafted or malformed XML schema to trigger the NULL pointer dereference, potentially causing a segfault and resulting in a denial of service condition. The vulnerability is tracked as CVE-2023-28484 in libxml2. Nokogiri 1.14.3 resolves the issue by upgrading the bundled libxml2 to version 2.10.4. Only users of the CRuby implementation with the packaged libxml2 are affected.
View original advisory →Grav CMS versions before 3.9.2 are vulnerable to Host header injection in the sendInvitationEmail() function. Attackers can manipulate the HTTP Host header to poison invitation links sent to users, redirecting them to attacker-controlled domains. The vulnerability exists because the require_trusted_host protection only covers password reset flows and not invitation email flows. Token-bearing invitation links can be crafted to exfiltrate tokens or perform phishing attacks. This represents a bypass of existing security controls within the Grav CMS framework. The fix is available in Grav version 3.9.2 and above.
View original advisory →CVE-2026-54874 affects OpenSSL's DTLS implementation, where receiving records for a future epoch during a handshake causes excessive memory buffering. The vulnerability stems from OpenSSL retaining the entire 16KB read buffer per record rather than just the record bytes, with up to 100 records buffered per connection, resulting in ~1.7MB retained per connection. This yields a memory amplification factor of approximately 1200x, enabling remote memory exhaustion DoS attacks against DTLS servers. Affected versions include OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. The issue was reported by Amazon Web Services on 18 May 2026 and fixed by Matt Caswell. Patches are available across all affected branches. Severity is assessed as Low due to bounded per-connection memory and applicability of existing connection limits.
View original advisory →An unpatched vulnerability has been discovered in Calix GS7 XGS (GS5239XG) residential routers widely deployed by U.S. broadband providers. The flaw allows remote, unauthenticated attackers to create arbitrary port-forwarding rules, effectively bypassing Network Address Translation (NAT) protections. This exposure can make internal network devices publicly accessible from the internet without any user interaction or authentication required. The vulnerability poses significant risk to home and small business users relying on these routers for network segmentation and security. As of the article's publication, no patch has been released by Calix to address the issue. Multiple broadband providers distributing these devices could have a large number of affected customers. The ability to expose internal devices could facilitate further attacks including lateral movement, data exfiltration, or device compromise.
View original advisory →Hackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities allow attackers to forge SAML responses and gain administrative access to affected WordPress sites. The flaws are classified as critical severity, indicating significant risk to site integrity and data. Exploitation attempts are ongoing, making patching urgent for all affected site owners. WordPress administrators using the miniOrange SAML plugin are strongly advised to update immediately to mitigate the risk of full site compromise.
View original advisory →This weekly cybersecurity recap covers multiple emerging threats and attack vectors observed during the week. Key topics include AI-powered attacks targeting Programmable Logic Controllers (PLCs), attacks against GitLab infrastructure, and Stripe API key leaks. The article highlights a trend where trusted tools are being weaponized, old vulnerabilities are receiving renewed exploitation attention, and AI is lowering the barrier for exploit development. Researchers are uncovering attacks that are simpler to execute than previously assumed. The recap serves as a broad overview of the threat landscape for the week, touching on supply chain risks, credential exposures, and critical infrastructure concerns.
View original advisory →Cybersecurity researchers have identified two new malware families, WordlistLoader and SynkLoader, being used to deliver next-stage payloads and likely sell access to ransomware groups. WordlistLoader is used to distribute Amatera Stealer (also known as ACR Stealer or AcridRain Stealer) through ClearFake campaigns that leverage the ClickFix (FakeCaptcha) technique. SynkLoader is focused on phishing Windows credentials. Both loaders represent an evolving threat landscape where initial access brokers use stealthy delivery mechanisms to compromise victims before handing off access to ransomware operators. The campaigns highlight continued abuse of social engineering techniques like fake CAPTCHA pages to trick users into executing malicious code. Gen Digital researchers flagged these threats as part of ongoing monitoring of loader-based malware ecosystems.
View original advisory →A critical security vulnerability (CVE-2026-18963) has been discovered in Keycloak, the open-source identity and access management server maintained by Red Hat. The flaw carries a CVSS score of 9.1 and allows unauthenticated remote attackers to take over any user account by forcing a password reset. Red Hat and the Keycloak project have released patches to address the issue. The vulnerability poses a significant risk to organizations relying on Keycloak for authentication and authorization. Users are strongly advised to apply the available patches immediately to prevent potential account compromise.
View original advisory →CISA has issued an emergency directive ordering U.S. federal agencies to patch an actively exploited vulnerability in Zimbra Collaboration Suite (ZCS) within three days. The flaw is being actively exploited in the wild, prompting the urgent response from CISA. Zimbra Collaboration Suite is widely used by government and enterprise organizations for email and collaboration. The directive reflects CISA's Known Exploited Vulnerabilities (KEV) catalog process, which mandates timely remediation for confirmed exploited flaws. The short three-day patching window indicates the severity and active exploitation of the vulnerability. Organizations using ZCS are urged to apply available patches immediately to reduce risk of compromise.
View original advisory →A Chinese-speaking cybercrime group tracked as UAT-10147 has been observed targeting Windows and Linux web servers globally using AI to scale their operations. The group deploys a malware called SPECTRE along with EDR bypass techniques and a Linux rootkit. Targeted sectors include education, media, technology, and gaming. The majority of victims are located in Brazil, Bolivia, China, Canada, and Vietnam. The threat came to light following the discovery of an open directory or similar exposed infrastructure. The use of AI to scale attacks marks a notable evolution in the group's operational capabilities. The combination of EDR bypass and a Linux rootkit indicates a sophisticated and persistent threat actor capable of evading modern defenses.
View original advisory →CVE-2026-21962 is an improper access control vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The vulnerability allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible by the affected components. It was disclosed as part of Oracle's January 2026 Critical Patch Update. CISA has included this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Federal agencies and organizations using Oracle HTTP Server or WebLogic Server Proxy Plug-in are advised to apply patches immediately. The vulnerability is rated High criticality and poses significant risk to enterprise environments relying on Oracle middleware. Forensic triage requirements have also been outlined by CISA as part of the BOD 26-04 implementation guidance.
View original advisory →StepSecurity threat intelligence tracked 56 open source supply chain attacks between August 2025 and August 2026, averaging roughly one attack every three days since March. The report provides a comprehensive overview of the current state of supply chain threats targeting open source ecosystems. It includes attack data, patterns, and recommended defenses for organizations relying on open source dependencies. The frequency and consistency of these attacks highlights a growing and persistent threat to software supply chains. The article serves as both a threat intelligence report and a practical guide for improving supply chain security posture.
View original advisory →CVE-2026-71505 describes a broken object-level authorization (BOLA) vulnerability in Dolibarr versions prior to 24.0.0. The flaw exists in the REST API's third-party site account write routes, where per-object access checks are only enforced on read routes but not on write routes. Authenticated attackers with third-party creation rights can exploit this to overwrite the WebPortal password of any company without proper authorization. After overwriting the password, attackers can authenticate as the victim company and access sensitive invoice data. Additionally, the API response exposes the victim's previous password verifier, further compounding the risk. The vulnerability enables full account takeover of any company registered in the WebPortal. A fix was introduced in Dolibarr version 24.0.0, with the patch available on GitHub. Security researchers at CodeAnt AI and VulnCheck have published advisories detailing the exploitation mechanism. Organizations running Dolibarr below version 24.0.0 should upgrade immediately.
View original advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the TranslatePress WordPress plugin affecting versions 3.3.2 and earlier. The vulnerability allows unauthenticated attackers to escalate their privileges without requiring any authentication. This poses a significant security risk to WordPress sites using the affected plugin versions. The vulnerability has been assigned CVE-2026-78267 and is tracked by both NVD and Patchstack. Website administrators using TranslatePress are strongly advised to update to a patched version immediately to mitigate the risk of exploitation.
View original advisory →Multiple DrayTek VigorSwitch models are affected by unauthorized operation vulnerabilities in several syslog functions. The root cause is missing authorization checks, allowing remote attackers to perform sensitive operations without authentication. Attackers can craft malicious requests to modify device configuration, restart services, save startup configuration, or clear logs. The vulnerability poses significant risk to network infrastructure as it can be exploited remotely without credentials. DrayTek has published a security advisory addressing these issues in August 2026. The flaw is classified under missing authorization (CWE-862) and impacts network switch management integrity and availability.
View original advisory →A buffer overflow vulnerability has been identified in UTT HiPER 1200GW devices running firmware versions up to 2.5.3-170306. The flaw resides in the strcpy function within the file /goform/formConfigFastDirectionW, where manipulation of the 'ssid' argument can trigger a buffer overflow condition. The vulnerability is remotely exploitable, meaning an attacker does not need local access to the device to leverage it. A public exploit has already been published and is available for use, increasing the risk of active exploitation. The affected product is a network gateway device, making this a significant concern for network infrastructure security. No authentication bypass details are specified, but the remote nature and published exploit raise the overall severity. Users of UTT HiPER 1200GW should apply patches or mitigations immediately. The vulnerability is tracked as CVE-2026-78170 and has been reported via NVD, VulDB, and a GitHub proof-of-concept repository.
View original advisory →