The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Apple Patches iOS and macOS

Published: 2026-08-17

Last Updated: 2026-08-17 20:26:39 UTC

by Johannes Ullrich (Version: 1)

Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.

None of the vulnerabilities has been exploited so far. There are a few WebKit vulnerabilities, but no standalone Safari patch for older operating systems. 87 of the vulnerabilities affect only iOS 18, making this more of an iOS 18 release than one for the newer operating systems. Only six vulnerabilities affect all three OSs released today. All 6 vulnerabilities affect WebKit.

Apple's vulnerability summary notes that the vulnerabilities patched in today's VisionOS release will be enumerated at a later date ...

Read the full entry: https://isc.sans.edu/diary/Apple+Patches+iOS+and+macOS/33254/

Apple Screen Sharing Security

Published: 2026-08-17

Last Updated: 2026-08-17 14:33:58 UTC

by Johannes Ullrich (Version: 1)

About 20 years ago, with macOS 10.5 (Leopard), Apple introduced screen sharing. Apple did not invent a new protocol for screen sharing. Instead, it used the established VNC protocol. VNC is a pretty simple, unencrypted protocol using TCP port 5900. Historically, the protocol used a simple global password for authentication. Apple adapted the protocol for its own use, but overall, left the VNC protocol itself alone.

A couple of weeks ago, two severe vulnerabilities exposed issues Apple introduced when it bolted on its own modifications to VNC. Currently, these vulnerabilities are being exploited, and a system with screen sharing exposed should be considered compromised. But here are some tips to improve screen sharing security.

One weakness exposed by these recent vulnerabilities is Apple's support for both "regular" VNC authentication and authentication via Apple's own macOS authentication system ...

Read the full entry: https://isc.sans.edu/diary/Apple+Screen+Sharing+Security/33252/

Linux Kernel Process Accounting

Published: 2026-08-12

Last Updated: 2026-08-12 14:21:10 UTC

by Johannes Ullrich (Version: 1)

A couple of days ago, Xavier posted about Atuin to gain more insight into the command history. Atuin does a great job of better organizing what is usually handled by "bash_history" and collecting meaningful additional data. Our reader David commented that this can also be done quite well with Linux's kernel process accounting feature, and I think he is very right. I really like Linux process accounting for a number of reasons, so here is a quick introduction.

Process accounting is a kernel feature. You will not see a specific process responsible for it. Instead, the "accton" command signals the kernel to start logging process data to a specific location (usually /var/log/account/pacct). Once a process terminates, the kernel will log respective details to the binary log file.

1 - Installation

I don't think process accounting is enabled by default on any Linux system. It does add a little additional overhead, but some users may shy away from it because it requires additional disk writes to collect the information. Memory and other CPUs should not be significantly impacted by process accounting. On my not very busy Proxmox system, it uses about 50 MB/day of disk space. So nothing that should be noticeable for most systems ...

Read the full entry: https://isc.sans.edu/diary/Linux+Kernel+Process+Accounting/33240/

Wireshark 4.6.8 Released (2026.08.16)

https://isc.sans.edu/diary/Wireshark+468+Released/33248/

Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI (2026.08.12)

https://isc.sans.edu/diary/Using+Gemma4+with+Ollama+Testing+File+Hash+Analysis+and+Recommendations+with+AI/33242/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-33824 - Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Product: Microsoft Internet Key Exchange (IKE) Service Extensions

CVSS Score: 9.8

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33824

ISC Diary: https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+April+2026/32898/

ISC Podcast: https://isc.sans.edu/podcastdetail/9892

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824

CVE-2026-55040 - Microsoft SharePoint Weak Authentication Vulnerability

Product: Microsoft SharePoint Server

CVSS Score: 0

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55040

ISC Podcast: https://isc.sans.edu/podcastdetail/10050

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040

CVE-2026-70306 - Microsoft Office SharePoint Spoofing Vulnerability

Product: Microsoft Office SharePoint

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70306

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70306

CVE-2026-65400 - Apple macOS Improper Authentication Vulnerability

Product: Apple macOS

CVSS Score: 0

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65400

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400

CVE-2026-59310 - Broadcom VMware vCenter Path Traversal Vulnerability

Product: Broadcom VMware vCenter

CVSS Score: 0

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59310

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310

CVE-2026-68820 - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Product: Microsoft Windows

CVSS Score: 7.0

** KEV since 2026-08-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68820

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820

CVE-2026-20349 - Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Product: Cisco Secure Firewall ASA and FTD

CVSS Score: 8.6

** KEV since 2026-08-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20349

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF

CVE-2026-72898 - Metabase SQL Injection Vulnerability

Product: Metabase

CVSS Score: 0

** KEV since 2026-08-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72898

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898

CVE-2026-9198 - IBM Langflow Code Injection Vulnerability

Product: IBM Langflow

CVSS Score: 0

** KEV since 2026-08-04 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9198

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198

CVE-2026-19297 - IBM Langflow OSS versions 1.0.0 through 1.9.6 could be exploited by a remote attacker to access user accounts through unrestricted authentication attempts.

Product: IBM Langflow OSS

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19297

NVD References: https://www.ibm.com/support/pages/node/7283558

CVE-2026-59124 - Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59124

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59124

CVE-2026-62893 - Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62893

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62893

CVE-2026-62815 - Microsoft QUIC Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62815

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815

CVE-2026-62878 - Windows DNS Server Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62878

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62878

CVE-2026-65791 - Windows iSCSI Target Service Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65791

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65791

CVE-2026-73296 - Microsoft UFO open-source framework prior to version 3.0.8 exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing remote attackers to manipulate connected Android devices.

Product: Microsoft UFO open-source framework

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73296

NVD References: https://github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm

CVE-2026-50540 - Kata Containers: Config Path Annotation Arbitrary File Loading

Product: Kata Containers

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50540

CVE-2026-72603 - wg-easy 15.3.0 is vulnerable to OS command injection, allowing users with clients.create permission to execute arbitrary commands as root through newline-delimited WireGuard PostUp directives injected into the client name field.

Product: wg-easy

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72603

CVE-2026-12571 - An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

Product: ManageEngine DDI Central

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12571

NVD References: https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

CVE-2026-48362, CVE-2026-71384 - Vulnerabilities in Adobe ColdFusion

Product: Adobe ColdFusion

CVSS Score: 9.6 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48362 (OS command injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71384 (Incorrect Authorization)

NVD References: https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html

CVE-2026-27302, CVE-2026-48381, CVE-2026-71398 - Multiple vulnerabilities in Adobe Campaign Classic (ACC).

Product: Adobe Campaign Classic

CVSS Scores: 9 .0 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-27302 (Incorrect Authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48381 (SQL Injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71398 (Incorrect Authorization)

NVD References: https://helpx.adobe.com/security/products/campaign/apsb26-123.html

CVE-2026-71362 - Adobe Commerce is vulnerable to an Incorrect Authorization flaw allowing attackers to escalate privileges and access sensitive resources without user interaction.

Product: Adobe Commerce

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71362

NVD References: https://helpx.adobe.com/security/products/magento/apsb26-92.html

CVE-2026-44758 - SAP Manufacturing Integration and Intelligence (MII) is vulnerable to arbitrary command execution by attackers with high privileges, compromising confidentiality, integrity, and availability.

Product: SAP Manufacturing Integration and Intelligence (MII)

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44758

CVE-2026-58231 - SAP Commerce Cloud is vulnerable to unauthenticated attackers abusing a default authentication client, leading to arbitrary code execution and compromise of internal components with high impact on security.

Product: SAP Commerce Cloud

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58231

CVE-2026-34265 - SAP NetWeaver Application Server ABAP is vulnerable to memory corruption via logical errors in DIAG protocol parsing, potentially leading to disclosure of sensitive information or system crashes with high impact on confidentiality, integrity, and availability.

Product: SAP NetWeaver Application Server ABAP

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-34265

CVE-2026-58115 - SIMATIC IoT2050 Advanced has a vulnerability where unauthenticated access to programming nodes through the Node-RED HTTP interface could lead to remote code execution with maximum privileges.

Product: Siemens SIMATIC IoT2050 Advanced

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58115

NVD References: https://cert-portal.siemens.com/productcert/html/ssa-834709.html

CVE-2026-13716 - Crafty Controller is vulnerable to path traversal and admin file upload, enabling remote code execution by authenticated attackers.

Product: Crafty Controller

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13716

CVE-2026-72748 - AVideo is vulnerable to an unauthenticated arbitrary file write flaw in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content to the server filesystem and potentially execute remote code.

Product: AVideo

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72748

NVD References: https://github.com/WWBN/AVideo/security/advisories/GHSA-v7p7-jccx-h37c

CVE-2026-17061 - SIMULIA Execution Engine from Release 2023 through Release 2026 is vulnerable to unauthenticated remote code execution due to a Deserialization of Untrusted Data flaw.

Product: SIMULIA Execution Engine

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17061

NVD References: https://www.3ds.com/trust-center/security/security-advisories/cve-2026-17061

CVE-2026-45618 - LiquidJS is vulnerable to arbitrary code execution with crafted templates prior to version 10.26.0, which has been patched in the latest version.

Product: LiquidJS

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45618

NVD References: https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc

CVE-2026-73034 - DB-GPT v0.8.1 is vulnerable to unauthenticated path traversal, enabling remote attackers to write arbitrary files to any location on the server.

Product: DB-GPT v0.8.1

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73034

NVD References: https://www.vulncheck.com/advisories/db-gpt-path-traversal-arbitrary-file-write-via-user-id-header

CVE-2026-66145 - GMS 9.5.1 (Build 9510.1044) and earlier versions are susceptible to an unauthenticated remote code execution vulnerability allowing attackers to read sensitive data and perform arbitrary file write via zipslip.

Product: GMS 9.5.1

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66145

NVD References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011

CVE-2026-66147 - SonicWall GMS Dispatcher Service in GMS 9.5.1 and earlier versions has an unauthenticated command injection vulnerability that enables remote code execution by exploiting specially crafted requests.

Product: SonicWall GMS Dispatcher Service

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66147

NVD References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011

CVE-2026-5917 - Libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend have a shell command injection vulnerability enabling remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters.

Product: Libgit2

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-5917

NVD References: https://www.vulncheck.com/advisories/libgit2-shell-command-injection-via-ssh-libssh2-backend

CVE-2025-41769 - PROFINET service on the device is susceptible to a buffer overflow vulnerability, allowing unauthenticated remote attackers to reboot or execute arbitrary code.

Product: Siemens PROFINET service

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-41769

CVE-2026-26035 - Fortinet FortiWeb versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and 7.0.0 through 7.0.12 may allow remote unauthenticated attackers to login with arbitrary credentials.

Product: Fortinet FortiWeb

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-26035

NVD References: https://fortiguard.fortinet.com/psirt/FG-IR-26-158

CVE-2025-59321 - CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 has a default TPM PCR policy vulnerability, enabling unauthorized access through an alternate execution path or different hardware.

Product: CPSD CryptoPro Secure Disk

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59321

CVE-2025-59324 - CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 skips file integrity checks when LUKS encryption is present.

Product: CPSD CryptoPro Secure Disk

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59324

CVE-2025-59326 - CPSD CryptoPro Secure Disk for Bitlocker allows for unsigned code execution from temporary file systems due to lack of IMA policy enforcement.

Product: CPSD CryptoPro Secure Disk

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59326

CVE-2026-16860, CVE-2026-17083, CVE-2026-17218, CVE-2026-17276 - Multiple vulnerabilities in IBM i 7.6, 7.5, 7.4, and 7.3.

Product: IBM i

CVSS Scores: 9.6 - 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16860 (uncontrolled search path element)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17083 (stack-based buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17218 (out-of-bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17276 (Improper Privilege Management)

NVD References:

- https://www.ibm.com/support/pages/node/7283282

- https://www.ibm.com/support/pages/node/7283276

- https://www.ibm.com/support/pages/node/7283277

- https://www.ibm.com/support/pages/node/7283292

CVE-2026-16956 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to remote command execution due to improper handling of special OS command elements.

Product: IBM Db2 Mirror

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16956

NVD References: https://www.ibm.com/support/pages/node/7283281

CVE-2026-14525 - IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to an authentication bypass when certain features are enabled.

Product: IBM WebSphere Application Server

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14525

NVD References: https://www.ibm.com/support/pages/node/7283488

CVE-2026-17482 - IBM Documentation Offline 1.0.0 through 1.4.1 is vulnerable to remote code execution due to inadequate file path control.

Product: Ibm Documentation Offline

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17482

NVD References: https://www.ibm.com/support/pages/node/7283484

CVE-2024-27253 - IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 has a vulnerability that could allow an authenticated user to bypass security measures for unauthorized activities.

Product: IBM Doors Next

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27253

NVD References: https://www.ibm.com/support/pages/node/7282705

CVE-2026-71193 - In OpenStack Designate before version 22.0.1, a vulnerability exists that allows authenticated users to bypass zone creation checks and perform cross-tenant DNS hijacking or denial of service attacks.

Product: OpenStack Designate

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71193

NVD References: https://www.openwall.com/lists/oss-security/2026/08/11/6

CVE-2026-49481 - UpSnap has an OS command injection vulnerability in versions prior to 5.4.0, allowing authenticated users to execute arbitrary commands on the server.

Product: UpSnap

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49481

NVD References: https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-6mc7-6948-w5h4

CVE-2026-49819 - UpSnap is vulnerable to a missing-authentication / privilege-escalation chain in `backend/pb/handlers.go:249`, allowing an unauthenticated network-adjacent attacker to register the initial superuser account and pivot to root remote code execution.

Product: UpSnap

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49819

NVD References: https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-w4jr-728f-5jhq

CVE-2026-58443 - Gitea allows a public-only,write:repository token to update a private pull request head branch through a public base repository route.

Product: Gitea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58443

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2

CVE-2026-55982 - OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Product: Gitea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55982

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-mg4f-x9v4-6h2p

CVE-2026-56443 - Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Product: Gitea

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56443

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3

CVE-2026-56654 - Privilege Escalation via Access Token Scope Escalation in API

Product: Gitea

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56654

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-683j-3ff6-hh2x

CVE-2026-56750 - Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Product: Gitea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56750

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-rgv6-xp99-6mgj

CVE-2026-58433 - Gitea Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Product: Gitea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58433

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-m6qc-j894-7h9r

CVE-2026-58508 - Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Product: Gitea migration/mirror

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58508

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-j72v-mjr6-3424

CVE-2026-67614 - CyberPanel before version 3.0.0 has a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service, allowing unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888.

Product: CyberPanel

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67614

NVD References: https://www.vulncheck.com/advisories/cyberpanel-hard-coded-jwt-secret-authentication-bypass-via-webterminal

CVE-2026-73653 - Vitest prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6 allows for arbitrary file manipulation by clients accessing the Browser Mode API.

Product: Vitest

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73653

NVD References: https://github.com/vitest-dev/vitest/security/advisories/GHSA-p63j-vcc4-9vmv

CVE-2026-72776 - AgenticSeek (commit fc242c7) is vulnerable to unauthenticated remote code execution via crafted queries to the POST /query API endpoint, allowing attackers to execute arbitrary commands on the host system.

Product: AgenticSeek

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72776

NVD References: https://www.vulncheck.com/advisories/agenticseek-unauthenticated-rce-via-query-api-endpoint

CVE-2026-19425 - Win Men International's Travel Agency Management System has a SQL Injection vulnerability allowing unauthenticated remote attackers to manipulate database contents.

Product: Win Men International Travel Agency Management System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19425

NVD References: https://www.twcert.org.tw/en/cp-139-11099-56aa8-2.html

CVE-2026-19516 - mcp-grafana allows a caller to control outbound requests, leading to server-side request forgery.

Product: mcp-grafana

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19516

NVD References: https://grafana.com/security/security-advisories/cve-2026-19516

CVE-2026-10579 - Picketlink Federation SAML vulnerability allows unauthenticated attackers to authenticate as any principal in any role due to unsolicited response handler flaw.

Product: Picketlink Federation SAML

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-10579

CVE-2026-18972 - Velociraptor is vulnerable to identity spoofing where an attacker can impersonate a GUI user by using a custom header, potentially resulting in an account takeover from low privileges to administrator.

Product: Velociraptor

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18972

NVD References: http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/

CVE-2026-48056 - Streambert allows a compromised process to run arbitrary local binaries with application privileges in versions prior to 2.5.0.

Product: Streambert

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48056

NVD References: https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9

CVE-2026-51584 - Usememos v0.27.1 allows a remote attacker to achieve account takeover through a vulnerability in the SSO identity matching process.

Product: Usememos

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51584

CVE-2026-72920 - SeaweedFS allows unauthorized clients to gain S3 administrative control before version 4.24 due to lack of authentication in the SeaweedIdentityAccessManagement gRPC service.

Product: SeaweedFS

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72920

NVD References: https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg

CVE-2026-73080 - SeaweedFS version prior to 4.24 allows unauthorized users to send requests to arbitrary hosts, including loopback and cloud metadata endpoints, and potentially access sensitive data such as instance metadata and IAM credentials.

Product: SeaweedFS

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73080

NVD References: https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-87fv-vqqr-m4jr

CVE-2026-53413, CVE-2026-53415 - Zoom Clients remote code execution vulnerabilities

Product: Zoom Video Communications Zoom Clients

CVSS Score: 8.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53413

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53415

ISC Podcast: https://isc.sans.edu/podcastdetail/10048

NVD References:

- https://www.zoom.com/en/trust/security-bulletin/zsb-26015

- https://www.zoom.com/en/trust/security-bulletin/zsb-26017

CVE-2026-73069 - Twenty CRM version prior to 2.15.0 allows a workspace administrator to execute arbitrary PostgreSQL statements through PATCH /rest/metadata/fields/:id or updateOneField GraphQL mutation.

Product: Twenty CRM

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73069

NVD References: https://github.com/twentyhq/twenty/security/advisories/GHSA-mm7j-q9q3-qqwj

CVE-2026-69223 - Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF) before version 1.19.1, users should upgrade to fix the issue.

Product: Apache Allura

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69223

NVD References: https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb

CVE-2026-73240 - Apache Allura is vulnerable to git argument injection via specifically crafted inputs before version 1.19.1, users should upgrade to the fixed version 1.19.1.

Product: Apache Allura

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73240

NVD References: https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv

CVE-2026-71290 - Apache HttpComponents Client 5.4 or newer is vulnerable to improper TLS hostname verification, allowing an attacker to impersonate the server by presenting a valid certificate for a different domain.

Product: Apache HttpComponents

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71290

NVD References: https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq

CVE-2026-47705 - TypeBot is vulnerable to a CSV injection in the result export functionality due to a lack of input sanitization in Version 3.16.1.

Product: TypeBot

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-47705

NVD References: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-p52m-h5qg-8p8w

CVE-2026-69102 - MaxKey is vulnerable to unauthorized access through a hard-coded JWT signing secret, allowing attackers to forge valid tokens and obtain admin access via the password-skipped login endpoint.

Product: MaxKey

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69102

NVD References: https://www.vulncheck.com/advisories/maxkey-hard-coded-jwt-secret-unauthorized-access-via-login-jwt-trust

CVE-2026-73090 - PeerTube had a vulnerability prior to version 8.2.2 that allowed a malicious federated server to rewrite another server's video metadata and media files.

Product: PeerTube

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73090

NVD References: https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86

CVE-2026-73211 - PeerTube prior to version 8.1.6 is vulnerable to remote code execution due to an SQL injection flaw in the ActorFollowModel.updateScore().

Product: PeerTube

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73211

NVD References: https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x

CVE-2026-73032 - PapersGPT for Zotero 0.6.1 is vulnerable to remote code execution through unsanitized input in views.ts, allowing attackers to execute arbitrary JavaScript and gain access to sensitive data.

Product: PapersGPT for Zotero

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73032

CVE-2026-48765 - TypeBot's versions before 3.17.0 are vulnerable to allowing a low-privilege read collaborator to extract workspace OAuth credentials and overwrite them with an attacker-controlled workspace ID.

Product: TypeBot

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48765

NVD References: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-3788-7276-x4j4

CVE-2026-70398 - Red Hat Advanced Cluster Management (RHACM) is vulnerable to unauthorized manipulation of the GitOpsCluster controller by authenticated users, leading to potential disclosure of critical information and security policy bypass in ArgoCD AppProjects.

Product: Red Hat Advanced Cluster Management (RHACM)

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70398

CVE-2026-72508 - Red Hat Advanced Cluster Management (RHACM) contains a vulnerability that allows a namespace-admin tenant to perform a confused-deputy attack, escalating privileges and potentially executing arbitrary code across the cluster.

Product: Red Hat Advanced Cluster Management

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72508

CVE-2026-73268 - Red Hat Multicluster Engine (MCE) is vulnerable to arbitrary code execution and privilege escalation due to insufficient input validation in the ClusterCurator controller component, allowing unauthorized tenants to inject malicious Job specifications.

Product: Red Hat Multicluster Engine

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73268

CVE-2026-72526 - The Red Hat multicloud-integrations component allows for arbitrary code execution and privilege escalation on managed clusters due to a lack of validation in processing the `ocm-managed-cluster` annotation from Application Custom Resources.

Product: Red Hat multicloud-integrations

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72526

CVE-2026-73269 - Red Hat cluster-curator-controller is vulnerable to privilege escalation through unauthorized creation of a cluster-scoped ClusterRoleBinding, potentially leading to cluster-wide control.

Product: Red Hat cluster-curator-controller

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73269

CVE-2026-50561 - Yuxi, prior to version 0.6.2, allows an attacker to bypass authentication and gain administrator privileges by exploiting a flaw in the authentication mechanism.

Product: Yuxi Intelligent Knowledge Base Platform

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50561

NVD References: https://github.com/xerrors/Yuxi/security/advisories/GHSA-6959-99pq-c56x

CVE-2026-73263 - Prowler's Kubernetes provider connection test in versions prior to 5.36.0 allowed for an attacker to potentially run commands through subprocess.Popen on a shared worker.

Product: Prowler

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73263

NVD References: https://github.com/prowler-cloud/prowler/security/advisories/GHSA-ccqh-6cjc-wp4j

CVE-2026-73294 - Semaphore UI allows a project Manager or Owner to execute arbitrary OS commands in the server process before version 2.18.17 and 2.19.5-beta2 due to handling an attacker-controlled option in repository git_url.

Product: Semaphore UI

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73294

NVD References: https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p

CVE-2026-72850, CVE-2026-72851 - Vulnerabilities in Budibase before 3.40.0/

Product: Budibase

CVSS Scores: 9.1 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72850 (directory traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72851 (unauthenticated SQL injection)

NVD References:

- https://github.com/Budibase/budibase/security/advisories/GHSA-pxwc-66g3-5f27

- https://github.com/Budibase/budibase/security/advisories/GHSA-x7h8-ww3q-xv7c

CVE-2026-73300 - Budibase's MySQL integration component prior to version 3.40.0 allows attackers to inject malicious SQL commands through user input fields, leading to complete database compromise.

Product: Budibase MySQL integration component

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73300

NVD References: https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw

CVE-2026-19656 - ScadaLTS 2.7.8.1 allows any authenticated user to execute arbitrary OS commands, leading to full system compromise.

Product: ScadaLTS

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19656

NVD References: https://www.tenable.com/security/research/tra-2026-55

CVE-2026-62420, CVE-2026-63293, CVE-2026-63294, CVE-2026-63296 through CVE-2026-63300, CVE-2026-66898 - Multiple vulnerabilities in Canonical LXD

Product: Canonical LXD

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62420 (authorization bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63293 (arbitrary file read/write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63294 (link following flaw)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63296 (authorization bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63297 (authorization bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63298 (OS command injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63299 (authorization bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63300 (improper validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66898 (path traversal)

NVD References:

- https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g

- https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5

- https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m

- https://github.com/canonical/lxd/security/advisories/GHSA-gcr9-5q6r-w625

- https://github.com/canonical/lxd/security/advisories/GHSA-v989-qw7w-xvg4

- https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2

- https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989h

- https://github.com/canonical/lxd/security/advisories/GHSA-5g5r-wh97-qcq2

- https://github.com/canonical/lxd/security/advisories/GHSA-m857-c7gc-c984

CVE-2026-18749 - VinceTrack's type=track branch can potentially leak coordinator-uploaded material to non-authorized case members.

Product:VinceTrack

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18749

CVE-2026-73501 - Kin-openapi prior to version 0.144.0 allows unauthenticated users to bypass security requirements due to a flaw in its AuthenticationFunc handling.

Product: Kin-openapi

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73501

References: https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw

CVE-2026-53791 - Rsync daemon is vulnerable to IP address spoofing before version 3.5.0, allowing remote attackers to bypass access controls and gain unauthorized access.

Product: Rsync daemon

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53791

NVD References: https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header

CVE-2026-13051 - Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template.

Product: Form::Processor Field::HtmlArea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13051

CVE-2026-73656 - Trigger.dev allows attackers with a valid API key to link an attacker-owned background worker to another project's deployment in versions prior to 4.5.6.

Product: Trigger.dev

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73656

NVD References: https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-j6vv-pq9h-f4wj

CVE-2026-8715 - Vault Secrets Operator versions 1.3.0 to 1.4.1 allow for arbitrary file read and credential exfiltration through AppRole authentication, potentially enabling unauthorized access and privilege escalation in Kubernetes clusters (CVE-2026-8715), now resolved in version 1.5.0.

Product: Vault Secrets Operator

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8715

NVD References: https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645

CVE-2026-72839 - Filebrowser through 2.63.16 allows unauthenticated attackers to gain full access to all files by registering accounts with self-signup enabled and default CreateUserDir setting.

Product: Filebrowser

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72839

NVD References: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6

CVE-2026-72841 - OpenWrt luci-app-openvpn allows authenticated users to perform path traversal and write arbitrary files outside the intended directory, leading to potential root code execution through uploading malicious payloads.

Product: OpenWrt luci-app-openvpn

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72841

NVD References: https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8

CVE-2026-72842 - OpenWrt luci-app-lxc is vulnerable to a path traversal attack that allows low-privileged authenticated users to gain unauthorized access to backend container management routes on OpenWrt.

Product: OpenWrt luci-app-lxc

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72842

NVD References: https://github.com/openwrt/luci/security/advisories/GHSA-jf59-v86x-fwf2

CVE-2026-59118 - Copilot Cowork Elevation of Privilege Vulnerability

Product: Copilot Cowork

CVSS Score: 9.3

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59118

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59118

CVE-2026-50516 - Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Product: Microsoft Azure Kubernete

CVSS Score: 9.4

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50516

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50516

Linux Kernel Vulnerabilities

On July 19th and 20th, the Linux kernel project released patches for 432 different vulnerabilities. Many, if not all, of these vulnerabilities were discovered and fixed using AI tools. @Risk will not enumerate these vulnerabilities individually. Linux distributions will include these patches in future kernel updates. The Linux kernel team does not prioritize patches, and takes a quite liberal approach as to what it considers a vulnerability. For more details regarding the Linux kernel’s policy on assigning CVEs see: http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignment-process/