Skip to content
skopnix
Every edition · newest first

The archive.

1,109 dispatchespage 9 / 19№ 629 – 570

  1. Fri 11 Sep 2026

    29 dispatches
    GHSA-325j-mg25-8q58: yayson: Prototype pollution in Store/LegacyStore deserializationVULN
  2. GHSA-rqx4-3f6q-3x2v: @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theftVULN
  3. GHSA-h8m9-jgf8-vwvp: Prowler: SAML Domain Claiming Enables Cross-Tenant Account TakeoverVULN
  4. GHSA-2cg9-97gq-9mqp: Shopper: Missing authorization on product removal actions in CollectionProducts componentVULN
  5. GHSA-g3f9-g5vj-p62f: Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock componentVULN
  6. GHSA-j328-xmgp-j4q3: Shopper: privilege escalation via improper Livewire admin component authorizationVULN
  7. GHSA-243p-f3cv-c5wh: Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-deleteVULN
  8. GHSA-vjfw-cpmh-xwv3: Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)VULN
  9. GHSA-2j95-gqxf-v3vg: Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables clusterVULN
  10. GHSA-rqfv-2mw9-78g2: MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL ExecutionVULN
  11. Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploitKEV
  12. CISA adds CVE-2026-84869 (ConnectWise ScreenConnect) to the Known Exploited Vulnerabilities catalogKEV
  13. CISA adds CVE-2026-42018 (JFrog Artifactory) to the Known Exploited Vulnerabilities catalogKEV
  14. Artifactory flaws chained in attacks deploying backdoor malwareEXPL
  15. CVE-2026-68497: jackson-databind binds a JSON string to a javax.xml.datatype.DurationVULN
  16. Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation AttacksAPT
  17. GitLab Vulnerability Exploited One Day After DisclosureEXPL
  18. Claude Used to Automate Exploitation and Data Theft Across Multiple VictimsAPT
  19. CVE-2026-71416: Headroom compresses data before the data reaches a large language model. Prior to versionVULN
  20. Metasploit Wrap Up: This One Goes to Sixteen!KEV
  21. The Cyber Express Weekly Roundup: Iranian Bounty, Airline Data Leak, and AI-Model Prompt InjectionMISC
  22. Anthropic caught Russia-linked spies using Claude in hacking operationsAPT
  23. GitLab urges users to patch max severity path traversal flawKEV
  24. Anthropic Says Russian Hackers Used Claude AI to Automate Malware EvasionAPT
  25. Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant BackdoorsSUPL
  26. China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT BackdoorAPT
  27. UK Council Attack Linked to Mass Exploitation of SonicWall FlawEXPL
  28. PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited FlawsEXPL
  29. CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVKEV

  30. Thu 10 Sep 2026

    31 dispatches
    GHSA-w4v4-9rw7-5326: Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and IncorrectVULN
  31. GHSA-v67p-phpq-fc8x: Traefik entrypoint header-name sanitization bypassed via request trailersVULN
  32. GHSA-qqjf-53cj-pwvv: Traefik HTTP/3 Backend NTLM Connection ReuseVULN
  33. GHSA-f52w-8j3h-j724: Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scopedVULN
  34. GHSA-xwwr-4h3p-r22c: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypassVULN
  35. GHSA-p569-5gjg-9cmj: rclone: RC per-server auth-proxy bypassVULN
  36. GHSA-c476-6w5q-jw77: rclone: FTP cross-session auth-proxy backend confusionVULN
  37. GHSA-2p48-j3qc-rx9f: rclone: S3 multipart declared-length memory exhaustionVULN
  38. GHSA-3g9q-v48f-hh9w: Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutVULN
  39. GHSA-4x45-gxvp-6283: @argos-ci/core: CI Branch Name OS Command InjectionVULN
  40. GHSA-m3wp-48jr-vr4g: mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoSVULN
  41. GHSA-wfgq-w7cq-qj7j: mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_urlVULN
  42. GHSA-wpmr-8h3q-fwj7: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteVULN
  43. GHSA-hf57-cqmx-p4gr: OmniRoute ACP Custom-Agent Remote Code Execution (RCE)VULN
  44. CVE-2026-86083: n8n is an open source workflow automation platform. …VULN
  45. GHSA-v3p8-whq6-r5jg: Angular: SSR XSS via Unescaped Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsVULN
  46. GHSA-f6mr-pjwc-34m4: Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRVULN
  47. GHSA-23rh-xw42-fq82: Pimcore: SQL Injection in Custom Reports via Malicious Report ConfigurationVULN
  48. CVE-2026-88058: Angular is a development platform for building mobile and desktop web applications usingVULN
  49. Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off scriptEXPL
  50. AI-powered attack exploited PaperCut flaws to hack 395 organizationsEXPL
  51. Cisco FMC flaws exploited by ransomware gang, state-sponsored hackersEXPL
  52. CVE-2026-86082: n8n is an open source workflow automation platform. …VULN
  53. CVE-2026-86075: n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuthVULN
  54. CVE-2026-86076: n8n is an open source workflow automation platform. …EXPL
  55. GHSA-jmc6-2wr8-h3wj: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originEXPL
  56. GHSA-4v28-j6q3-5m4r: Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loaderEXPL
  57. GHSA-2724-6cpj-gf3v: Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletionVULN
  58. GHSA-34r3-9m95-vq73: Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetchEXPL
  59. GHSA-x7m8-jrm8-hpvx: @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family nameVULN
  60. SloppyRAT: A New Tool For Ransomware AttacksMALW