Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-20 00:02Z
4w ago
2026-08-21 18:16Z
CRIT

CVE-2026-62674 — Omnigent: Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62674

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/sessions.py, add a stdio MCP server, and cause later sessions that use the shared agent CVSSv3.1 9.0 (CRITICAL)

CWECWE 94VNDOmnigentTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
4w ago
2026-08-21 17:16Z
CRIT

CVE-2026-74581 — Linux: A suppressing rule can therefore leak a released route back to rt6_lookup(), and the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74581

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpat CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-21 17:16Z
HIGH

CVE-2026-74580 — Linux: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74580

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already been validated: if (vhost_vq_meta_fetch(vq, addr, len, type)) return true; The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on device I CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-21 17:16Z
HIGH

CVE-2026-39909 — llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39909

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangling pointers, enabling full remote code execution without requiring authenticati CVSSv3.1 8.1 (HIGH)

CWECWE 416TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4w ago
2026-08-21 16:18Z
HIGH

CVE-2026-75932 — Jet: Admin allows an attacker to create a malicious app and connect it to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75932

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider. CVSSv3.1 8.6 (HIGH)

CWECWE 862VNDJetTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
4w ago
2026-08-21 16:18Z
CRIT

CVE-2026-69502 — Server: Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69502

Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 10.0 (CRITICAL)

CWECWE 918TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 16:17Z
HIGH

CVE-2026-22681 — OpenViking: before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, link-local, or cloud metadata addresses, then read back responses through normal content APIs to CVSSv3.1 8.5 (HIGH)

CWECWE 918VNDOpenvikingTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-77087 — Paperclip: before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77087

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter. CVSSv3.1 9.6 (CRITICAL)

CWECWE 862VNDPaperclipTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-63343 — Incus: Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63343

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains expl CVSSv3.1 9.9 (CRITICAL)

CWECWE 73VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-63125 — Incus: Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 61CWECWE 59VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-62941 — Incus: Prior to version 7.3.0, when copying an instance across projects, the project restriction check

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62941

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 pat CVSSv3.1 9.9 (CRITICAL)

CWECWE 863VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-62940 — Incus: Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62940

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 862VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-62867 — Incus: Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62867

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 88VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-48769 — Incus: Prior to version 7.2.0, an arbitrary file write exists in the Incus client when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48769

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 20VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-48755 — Incus: Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 20VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-48753 — Incus: Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 73VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-48752 — Incus: Prior to version 7.2.0, a specially crafted image or instance backup can be used

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48752

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 73VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-48751 — Incus: Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48751

Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 862VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-48750 — Incus: This behavior can be abused for arbitrary command execution.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48750

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Versio CVSSv3.1 9.9 (CRITICAL)

CWECWE 73VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:16Z
CRIT

CVE-2026-48749 — Incus: Prior to version 7.2.0, a specially crafted image can be used to read or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48749

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue. CVSSv3.1 9.9 (CRITICAL)

CWECWE 73VNDIncusTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
4w ago
2026-08-21 15:00Z
HIGH

AWS EKS forensics: data sources and investigation tooling

Synacktiv·synacktiv.com

Synacktiv publishes a comprehensive forensics guide for AWS EKS investigations, mapping data sources across the managed control plane, worker nodes, and AWS services. The article details logging architecture (audit logs, Container Insights, GuardDuty, CloudTrail), query patterns for threat hunting in CloudWatch Logs Insights, and practical acquisition techniques for incident response on standard, Auto Mode, and Fargate deployments.

SRFApplicationTACTA0007SRFCloudSWKubernetesSWEksVNDAwsTYPResearchSTGDiscovery
78
Edit Score
4w ago
2026-08-21 14:16Z
CRIT

CVE-2026-77806 — SPIP: before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDSpipTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-21 13:00Z
CRIT

No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

Bishop Fox Labs·bishopfox.comCVE-2026-8452CVE-2026-8451CVE-2026-19490

CVE-2026-8452 is a heap overflow in Citrix NetScaler's SAML canonicalization code that allows unauthenticated remote code execution via oversized PrefixList attributes in SAML messages. Bishop Fox provides a safe detection tool and methodology to verify patch status without triggering crashes, alongside forensic indicators for post-exploitation hunting. The vulnerability affects Gateway and AAA virtual servers with SAML configured and is patched in builds 13.1-63.18+ and 14.1-72.61+.

TACTA0001SRFNetwork ApplianceSWNetscalerVNDCitrixTYPResearchTYPVulnerabilitySTGInitial AccessTECT1190
82
Edit Score
4w ago
2026-08-21 12:16Z
CRIT

CVE-2026-77776 — LLM: Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77776

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header CVSSv3.1 9.1 (CRITICAL)

CWECWE 639VNDLlmTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
4w ago
2026-08-21 12:16Z
HIGH

CVE-2026-77775 — LLM: Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77775

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_base in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use as the upstream base; _select_passthrough_base_url in headroom/providers/proxy_routes.py reads the same header for the passthrough routes. No check rejects loopback, link-local, o CVSSv3.1 8.6 (HIGH)

CWECWE 918VNDLlmTYPVulnerability
8.6
CVSS v3.1
93
Edit Score