opsecsafe — cyber intelligence

2026-03-30

2026-03-30 08:16Z

CRIT

CVE-2025-15379 — Lfprojects Mlflow: A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15379

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution o CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile

CWECWE 77VNDLfprojectsTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-30

2026-03-30 06:48Z

CRIT

New widespread EvilTokens kit: device code phishing as-a-service – Part 1

Sekoia.io·sekoia.ioin the wild

Sekoia's TDR team discovered EvilTokens, a new Phishing-as-a-Service (PhaaS) kit leveraging Microsoft device code authentication flows to harvest access and refresh tokens at scale since mid-February 2026. The kit provides turnkey phishing pages impersonating trusted services (Adobe, DocuSign, SharePoint), automated token weaponization including Primary Refresh Token (PRT) conversion, and reconnaissance capabilities, with widespread adoption across finance, HR, and logistics sectors globally. EvilTokens enables attackers to bypass MFA and establish persistent access to Microsoft 365 accounts without triggering interactive authentication challenges.

TACTA0001TACTA0006SRFIdentitySRFCloudVNDMicrosoftTYPResearchTYPThreat IntelSTGInitial Access

Edit Score

2026-03-30

2026-03-30 02:16Z

CRIT

CVE-2025-15036 — Lfprojects Mlflow: A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15036

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in mult CVSSv3.1 10.0 (CRITICAL) · EPSS 4th percentile

CWECWE 29VNDLfprojectsTYPVulnerability

10.0

CVSS v3.1

100

Edit Score

2026-03-30

2026-03-30 00:16Z

HIGH

CVE-2026-2370 — Gitlab Gitlab: has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2370

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks. CVSSv3.1 8.1 (HIGH)

CWECWE 233VNDGitlabTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-30

2026-03-30 00:00Z

HIGH

Incident responders, s'il vous plait: Invites lead to odd malware events

Sophos X-Ops·news.sophos.com

Sophos X-Ops tracked a phishing campaign (STAC6405) targeting 80+ organizations since April 2025, primarily in the US, using invitation-themed lures to trick users into installing legitimate RMM tools (LogMeIn Resolve, ScreenConnect) preconfigured to attacker-controlled accounts. In two cases, attackers escalated to deploy an infostealer and a Java-based RAT, suggesting either access-as-a-service resale or active experimentation; campaign infrastructure remains active as of publication.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0006TACTA0007TACTA0009

Edit Score

2026-03-30

2026-03-30 00:00Z

CRIT

TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM

Trend Micro Research·trendmicro.comin the wild

TeamPCP compromised Telnyx Python SDK versions 4.87.1 and 4.87.2 on PyPI, injecting malicious code that activates on import. The payload uses split-file injection, WAV-based steganography to hide credential-stealing malware, and adds Windows persistence via Startup folder placement—a significant evolution from their earlier LiteLLM attack. PyPI quarantined the packages after ~6.5 hours of exposure; affected systems should be treated as fully compromised.

SRFApplicationTACTA0004TACTA0001TACTA0006TACTA0007TACTA0003TACTA0009SRFSupply Chain

Edit Score

2026-03-29

2026-03-29 20:16Z

HIGH

CVE-2026-4946 — Nsa Ghidra: versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4946

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when cl CVSSv3.1 8.8 (HIGH) · EPSS 31th percentile

CWECWE 78VNDNsaVNDGhidraTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-29

2026-03-29 20:07Z

CRIT

Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)

watchTowr Labs·labs.watchtowr.comCVE-2026-3055in the wild0day

watchTowr Labs disclosed that CVE-2026-3055 is not a single vulnerability but at least two distinct memory overread flaws in Citrix NetScaler affecting /saml/login and /wsfed/passive endpoints. The /wsfed/passive variant leaks kilobytes of memory via a malformed wctx parameter lacking a value, returning sensitive data including active administrative session IDs in base64-encoded NSC_TASS cookies. In-the-wild exploitation began by March 27th, 2026, with evidence from watchTowr's honeypot network showing threat actor activity.

SRFNetwork ApplianceTACTA0006TACTA0007VNDCitrixTYPResearchTYPExploitTYPVulnerabilitySTGInitial Access

Edit Score

2026-03-29

2026-03-29 17:16Z

HIGH

CVE-2026-34005 — Sofia: In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34005

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 78VNDSofiaTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 20:39Z

HIGH

The Sequels Are Never As Good, But We're Still In Pain (Citrix NetScaler CVE-2026-3055 Memory Overread)

watchTowr Labs·labs.watchtowr.comCVE-2026-3055

watchTowr Labs disclosed CVE-2026-3055, a memory overread vulnerability in Citrix NetScaler/Gateway when configured as a SAML IdP. The flaw allows unauthenticated attackers to leak sensitive memory contents via malformed SAML requests, potentially exposing credentials and session data. The vulnerability affects versions before 14.1-26.x and is patched in 14.1-60.58, 14.1-66.59, and 13.1-62.23+.

TACTA0001SRFNetwork ApplianceTACTA0006SRFIdentityVNDCitrixTYPWriteupTYPVulnerabilitySTGInitial Access

Edit Score

2026-03-28

2026-03-28 19:16Z

CRIT

CVE-2026-3256 — Ktat Http\: HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3256

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. The CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile

CWECWE 338CWECWE 340VNDHttpVNDKtatTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2018-25225 — Sipp_project Sipp: 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25225

SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the configuration file. Attackers can craft a configuration file with oversized values that overflow a stack buffer, overwriting the return address and executing arbitrary code through return-oriented programming gadgets. CVSSv3.1 8.4 (HIGH)

CWECWE 306VNDSipp ProjectVNDSippTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2018-25224 — Kimtore Practical_music_search: PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25224

PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious values in the configuration file. Attackers can craft configuration files with oversized input that overflows the stack buffer and execute shell commands via return-oriented programming gadgets. CVSSv3.1 8.4 (HIGH) · EPSS 8th percentile

CWECWE 306VNDKimtoreVNDPmsTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

CRIT

CVE-2018-25223 — Ftnapps Crashmail_ii: Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25223

Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787VNDFtnappsVNDCrashmailTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2018-25222 — SC v7.16 contains a stack-based buffer overflow vulnerability that allows local attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25222

SC v7.16 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying oversized input that exceeds buffer boundaries. Attackers can craft malicious input strings exceeding 1052 bytes to overwrite the instruction pointer and execute shellcode in the application context. CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

CWECWE 787TYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

CRIT

CVE-2017-20227 — Varaneckas Jad_java_decompiler: JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-20227

JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying overly long input that exceeds buffer boundaries. Attackers can craft malicious input passed to the jad command to overflow the stack and execute a return-oriented programming chain that spawns a shell. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787VNDVaraneckasVNDJadTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2017-20226 — Mapscrn: 2.0.3 contains a stack-based buffer overflow vulnerability that allows local attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-20226

Mapscrn 2.0.3 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized input buffer. Attackers can craft a malicious buffer with junk data, return address, NOP instructions, and shellcode to overflow the stack and achieve code execution or denial of service. CVSSv3.1 8.4 (HIGH) · EPSS 5th percentile

CWECWE 787VNDMapscrnTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

CRIT

CVE-2017-20225 — Ticalc Tiemu: 2.08 and prior contains a stack-based buffer overflow vulnerability that allows attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-20225

TiEmu 2.08 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on user-supplied input. Attackers can trigger the overflow through command-line arguments passed to the application, leveraging ROP gadgets to bypass protections and execute shellcode in the application context. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787VNDTicalcVNDTiemuTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2016-20048 — iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability that allows local attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20048

iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized value to the -k/--key parameter. Attackers can craft a malicious argument containing a NOP sled, shellcode, and return address to overflow a 1024-byte stack buffer and gain code execution with user privileges. CVSSv3.1 8.4 (HIGH) · EPSS 7th percentile

CWECWE 22TYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2016-20046 — Client: zFTP Client 20061220+dfsg3-4.1 contains a buffer overflow vulnerability in the NAME parameter handling of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20046

zFTP Client 20061220+dfsg3-4.1 contains a buffer overflow vulnerability in the NAME parameter handling of FTP connections that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized NAME value exceeding the 80-byte buffer allocated in strcpy_chk to overwrite the instruction pointer and execute shellcode with user privileges. CVSSv3.1 8.4 (HIGH) · EPSS 5th percentile

CWECWE 787TYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2016-20045 — Hnb_project Hierarchical_notebook: HNB Organizer 1.9.18-10 contains a local buffer overflow vulnerability that allows local attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20045

HNB Organizer 1.9.18-10 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument to the -rc command-line parameter. Attackers can craft a malicious input string exceeding 108 bytes containing shellcode and a return address to overwrite the stack and achieve code execution. CVSSv3.1 8.4 (HIGH)

CWECWE 787VNDHnb ProjectVNDHnbTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2016-20044 — Surf Pinfo: 0.6.9-5.1 contains a local buffer overflow vulnerability that allows local attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20044

PInfo 0.6.9-5.1 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument to the -m parameter. Attackers can craft a malicious input string with 564 bytes of padding followed by a return address to overwrite the instruction pointer and execute shellcode with user privileges. CVSSv3.1 8.4 (HIGH)

CWECWE 787VNDSurfVNDPinfoTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2016-20043 — Nrss Nrss: RSS Reader 0.3.9-1 contains a stack buffer overflow vulnerability that allows local attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20043

NRSS RSS Reader 0.3.9-1 contains a stack buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument to the -F parameter. Attackers can craft a malicious input with 256 bytes of padding followed by a controlled EIP value to overwrite the return address and achieve code execution. CVSSv3.1 8.4 (HIGH)

CWECWE 787VNDNrssTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:16Z

HIGH

CVE-2016-20042 — TRN: 3.6-23 contains a stack buffer overflow vulnerability that allows local attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20042

TRN 3.6-23 contains a stack buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument to the application. Attackers can craft a malicious command-line argument with 156 bytes of padding followed by a return address to overwrite the instruction pointer and execute shellcode with user privileges. CVSSv3.1 8.4 (HIGH) · EPSS 5th percentile

CWECWE 787VNDTrnTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-03-28

2026-03-28 12:15Z

HIGH

CVE-2016-20041 — Yasr: 0.6.9-5 contains a buffer overflow vulnerability that allows local attackers to crash the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20041

Yasr 0.6.9-5 contains a buffer overflow vulnerability that allows local attackers to crash the application or execute arbitrary code by supplying an oversized argument to the -p parameter. Attackers can invoke yasr with a crafted payload containing junk data, shellcode, and a return address to overwrite the stack and trigger code execution. CVSSv3.1 8.4 (HIGH) · EPSS 7th percentile

CWECWE 22VNDYasrTYPVulnerability

8.4

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2025-15379 — Lfprojects Mlflow: A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in

New widespread EvilTokens kit: device code phishing as-a-service – Part 1

CVE-2025-15036 — Lfprojects Mlflow: A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of

CVE-2026-2370 — Gitlab Gitlab: has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before

Incident responders, s'il vous plait: Invites lead to odd malware events

TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM

CVE-2026-4946 — Nsa Ghidra: versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary

Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)

CVE-2026-34005 — Sofia: In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection

The Sequels Are Never As Good, But We're Still In Pain (Citrix NetScaler CVE-2026-3055 Memory Overread)

CVE-2026-3256 — Ktat Http\: HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.

CVE-2018-25225 — Sipp_project Sipp: 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to

CVE-2018-25224 — Kimtore Practical_music_search: PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to

CVE-2018-25223 — Ftnapps Crashmail_ii: Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute

CVE-2018-25222 — SC v7.16 contains a stack-based buffer overflow vulnerability that allows local attackers to execute

CVE-2017-20227 — Varaneckas Jad_java_decompiler: JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows

CVE-2017-20226 — Mapscrn: 2.0.3 contains a stack-based buffer overflow vulnerability that allows local attackers to execute

CVE-2017-20225 — Ticalc Tiemu: 2.08 and prior contains a stack-based buffer overflow vulnerability that allows attackers to

CVE-2016-20048 — iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability that allows local attackers to execute

CVE-2016-20046 — Client: zFTP Client 20061220+dfsg3-4.1 contains a buffer overflow vulnerability in the NAME parameter handling of

CVE-2016-20045 — Hnb_project Hierarchical_notebook: HNB Organizer 1.9.18-10 contains a local buffer overflow vulnerability that allows local attackers to

CVE-2016-20044 — Surf Pinfo: 0.6.9-5.1 contains a local buffer overflow vulnerability that allows local attackers to execute

CVE-2016-20043 — Nrss Nrss: RSS Reader 0.3.9-1 contains a stack buffer overflow vulnerability that allows local attackers

CVE-2016-20042 — TRN: 3.6-23 contains a stack buffer overflow vulnerability that allows local attackers to execute

CVE-2016-20041 — Yasr: 0.6.9-5 contains a buffer overflow vulnerability that allows local attackers to crash the