Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-25 22:19Z
2026-08-10
2026-08-10 23:16Z
HIGH

CVE-2026-8718 — In CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8718

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a CVSSv3.1 8.4 (HIGH)

CWECWE 787TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 22:00Z
HIGH

Bypassing Android Hardware Attestation from the Analyst's Chair

Quarkslab·blog.quarkslab.com

Quarkslab presents a detailed technical analysis of Android hardware attestation mechanisms and demonstrates a practical bypass technique using instrumentation and relay attacks. The research explains the full attestation certificate chain, KeyDescription structure, and root-of-trust validation, then shows how to redirect attestation requests to a clean device and splice the genuine chain back into a rooted target device using Frida hooks, complete with reproducible proof-of-concept code.

TACTA0005SRFMobileOSAndroidTYPResearchSTGDefense EvasionTECT1140TECT1550EXPAuth Bypass
82
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-73030 — unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process. CVSSv3.1 8.1 (HIGH)

CWECWE 22TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 21:17Z
CRIT

CVE-2026-72911 — ERPNext: Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py rend

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72911

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data acros CVSSv3.1 9.9 (CRITICAL)

CWECWE 1336VNDErpnextTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-72903 — Tabby: (formerly Terminus) is a highly configurable terminal emulator.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72903

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFolderRecursive() propagates item.name into the local relative path. In tabby-electr CVSSv3.1 8.1 (HIGH)

CWECWE 22VNDTabbyTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-18982 — This vulnerability allows a user with standard edit or admin roles in any Kubernetes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted CVSSv3.1 8.8 (HIGH)

CWECWE 250TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-18951 — This allows any user with `edit ClusterRole` permissions in a namespace to create, modify

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18951

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could e CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-18950 — This can lead to privilege escalation, where an attacker gains unauthorized elevated access within

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18950

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-18949 — This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18949

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation. CVSSv3.1 8.8 (HIGH)

CWECWE 250TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 21:17Z
CRIT

CVE-2026-18948 — Feast: The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18948

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulner CVSSv3.1 9.9 (CRITICAL)

VNDFeastTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-18947 — Feast: An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18947

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant reso CVSSv3.1 8.5 (HIGH)

VNDFeastTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-18617 — A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18617

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing CVSSv3.1 8.8 (HIGH)

CWECWE 915TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-18608 — A flaw was found in the Data Science Pipelines Operator (DSPO).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18608

A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wide roles, could be exploited. If the DSPO pod were compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster. CVSSv3.1 8.7 (HIGH)

CWECWE 250TYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-15581 — This vulnerability allows any pod on the cluster network to bypass authentication and directly

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15581

A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations. CVSSv3.1 8.0 (HIGH)

CWECWE 306TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-15467 — An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15467

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster. CVSSv3.1 8.1 (HIGH)

CWECWE 266TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 21:17Z
CRIT

CVE-2026-14450 — This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14450

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, CVSSv3.1 9.9 (CRITICAL)

CWECWE 290TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 21:17Z
HIGH

CVE-2026-13717 — Improper configuration of the Gateway in a model-serving context allows a standard user with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-13717

A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering. CVSSv3.1 8.8 (HIGH)

CWECWE 284TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72902 — Dokploy: Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13. CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72901 — Dokploy: Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72901

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec, with Docker socket access making execution host/root-equivalent. This iss CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72886 — Dokploy: From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72886

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issu CVSSv3.1 9.9 (CRITICAL)

CWECWE 269CWECWE 863VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 20:17Z
HIGH

CVE-2026-72883 — Dokploy: Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-containe

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72883

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDDokployTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72882 — Dokploy: In the default deployment model, this yields direct remote host RCE from the web

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72882

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface. CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72880 — Dokploy: Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72880

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended direc CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72878 — Dokploy: Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72878

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13. CVSSv3.1 9.6 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72877 — Dokploy: Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72877

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker() in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with application create or update permission can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or a remote SSH build target, exposin CVSSv3.1 9.6 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.6
CVSS v3.1
98
Edit Score