Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-27 08:08Z
2026-07-29
2026-07-29 19:16Z
HIGH

CVE-2026-67427 — Flyto2: Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67427

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6. CVSSv3.1 8.6 (HIGH)

CWECWE 668CWECWE 693CWECWE 522VNDFlyto2TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-07-29
2026-07-29 19:16Z
CRIT

CVE-2026-67426 — Flyto2: Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67426

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7. CVSSv3.1 9.3 (CRITICAL)

CWECWE 306CWECWE 918CWECWE 522VNDFlyto2TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-07-29
2026-07-29 19:16Z
HIGH

CVE-2026-67425 — Flyto2: Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67425

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.6. CVSSv3.1 8.6 (HIGH)

CWECWE 522CWECWE 201VNDFlyto2TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-07-29
2026-07-29 19:16Z
HIGH

CVE-2026-67424 — Flyto2: Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67424

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing a public URL to redirect into internal address space and return the internal re CVSSv3.1 8.5 (HIGH)

CWECWE 918VNDFlyto2TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-07-29
2026-07-29 19:16Z
HIGH

CVE-2026-67201 — V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67201

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling CVSSv3.1 8.6 (HIGH)

CWECWE 436TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-07-29
2026-07-29 19:16Z
HIGH

CVE-2026-16328 — This may allow a malicious client to redirect the server's Consul API traffic to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16328

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4. CVSSv3.1 8.6 (HIGH)

CWECWE 918TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-07-29
2026-07-29 19:16Z
CRIT

CVE-2026-16326 — In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16326

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4. CVSSv3.1 10.0 (CRITICAL)

CWECWE 488TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-07-29
2026-07-29 19:16Z
CRIT

CVE-2026-14529 — IBM: WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14529

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled. CVSSv3.1 9.4 (CRITICAL)

CWECWE 306VNDIbmTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-07-29
2026-07-29 18:50Z
INFO

BloodHound CE v9.5.1

BloodHound releases·github.com

BloodHound CE v9.5.1 released with a single fix for data quality batching behind a new feature flag (BED-9078). This is a minor patch release addressing performance or reliability in the data quality module.

SWBloodhoundVNDSpecteropsTYPTool
28
Edit Score
2026-07-29
2026-07-29 18:16Z
CRIT

CVE-2026-41939 — Care: Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41939

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as CVSSv3.1 9.8 (CRITICAL)

CWECWE 1392VNDCareTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-29
2026-07-29 18:05Z
CRIT

CVE-2026-6516 | ManageEngine ADAudit Plus Pre-Authentication Remote Code Execution Vulnerability

Horizon3.ai·horizon3.aiCVE-2026-6516

CVE-2026-6516 is a critical pre-authentication RCE vulnerability in ManageEngine ADAudit Plus affecting builds prior to 8606. The flaw combines authentication bypass and path traversal in the Agent APIs, allowing unauthenticated remote attackers to write arbitrary files and achieve code execution with a CVSS 10.0 score. A patch was released April 17, 2026; no active exploitation in the wild has been confirmed as of publication.

SRFApplicationTACTA0001SWAdaudit PlusVNDManageengineTYPVulnerabilitySTGExecutionSTGInitial AccessTECT1190
78
Edit Score
2026-07-29
2026-07-29 17:16Z
HIGH

CVE-2026-54727 — proot-distro is a utility for managing proot containers.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54727

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6. CVSSv3.1 8.2 (HIGH)

CWECWE 668TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-29
2026-07-29 17:16Z
CRIT

CVE-2026-54680 — Logging: operator automates the deployment and configuration of Kubernetes logging pipelines.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issu CVSSv3.1 9.9 (CRITICAL)

CWECWE 74CWECWE 77VNDLoggingTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-07-29
2026-07-29 17:16Z
HIGH

CVE-2026-54574 — proot-distro is a utility for managing proot containers.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54574

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. Th CVSSv3.1 8.2 (HIGH)

CWECWE 61TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-29
2026-07-29 17:16Z
CRIT

CVE-2026-51992 — SQL: Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-51992

SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function. CVSSv3.1 9.1 (CRITICAL)

CWECWE 89TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-29
2026-07-29 17:16Z
MED

CVE-2026-20316 — Cisco Secure_firewall_management_center: A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20316in the wild

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged&nbsp;account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful e CVSSv3.1 5.3 (MEDIUM)

CWECWE 259VNDCiscoTYPVulnerabilitySTAitw exploited
5.3
CVSS v3.1
77
Edit Score
2026-07-29
2026-07-29 16:17Z
HIGH

CVE-2026-67192 — Xlight: FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67192

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs. CVSSv3.1 8.1 (HIGH)

CWECWE 121VNDXlightTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-29
2026-07-29 16:17Z
CRIT

CVE-2026-67191 — Xlight: FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67191

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs. CVSSv3.1 9.8 (CRITICAL)

CWECWE 122VNDXlightTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-29
2026-07-29 16:17Z
CRIT

CVE-2026-60113 — AMMOS: Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-60113

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frame CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDAmmosTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-29
2026-07-29 16:17Z
CRIT

CVE-2026-60112 — AMMOS: Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-60112

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDAmmosTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-29
2026-07-29 16:17Z
CRIT

CVE-2026-54735 — Prebid: Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54735

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed i CVSSv3.1 10.0 (CRITICAL)

CWECWE 918VNDPrebidTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-07-29
2026-07-29 16:16Z
CRIT

CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity

Rapid7 Research·rapid7.comCVE-2026-63077

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in TeamCity On-Premises affecting all versions. The flaw exploits deserialization of untrusted data in the agent polling protocol, allowing unauthenticated attackers to execute arbitrary OS commands with TeamCity server privileges and compromise CI/CD pipeline integrity. Fixed versions (2025.11.7, 2026.1.3) and a security patch plugin are available; TeamCity Cloud is unaffected.

SRFApplicationTACTA0001SWTeamcityVNDJetbrainsTYPVulnerabilitySTGInitial AccessTECT1190EXPRce
92
Edit Score
2026-07-29
2026-07-29 16:00Z
HIGH

Clustered Points of Failure

SpecterOps·specterops.io

SpecterOps researcher Garrett Foster presents novel attack techniques against Windows Server Failover Clusters (WSFC), demonstrating how cluster nodes share credentials and Kerberos keys stored in the cluster database, enabling complete cluster compromise through resource-based constrained delegation (RBCD) abuse. The research reveals that cluster Name Objects (CNO) and Virtual Cluster Objects (VCO) maintain synchronized passwords across all nodes, allowing forged Kerberos service tickets to be decrypted by any cluster member regardless of the intended target service.

SRFOsTACTA0004TACTA0008OSWindowsVNDMicrosoftTYPResearchSTGPrivescSTGInitial Access
88
Edit Score
2026-07-29
2026-07-29 15:48Z
INFO

v9.5.1-rc1

BloodHound releases·github.com

BloodHound v9.5.1-rc1 release candidate published with a single fix for data quality batching behind a new feature flag (BED-9078). This is a pre-release version addressing internal data handling improvements.

SWBloodhoundTYPTool
28
Edit Score
2026-07-29
2026-07-29 15:16Z
CRIT

CVE-2026-65888 — Balbooa Gridbox: Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-65888

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site. CVSSv3.1 9.8 (CRITICAL) · EPSS 16th percentile

CWECWE 284VNDJoomlaVNDBalbooaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score