CVE-2026-100888 is an out-of-bounds write vulnerability in the Trusted Domain Project OpenDKIM software, specifically in the dkim_canon_selecthdrs function of the DKIM Signature Header Selection component. This flaw affects OpenDKIM versions 2.0 through 2.11.0. The vulnerability can be exploited remotely without authentication by manipulating a function argument, potentially leading to memory corruption. Public exploit code is available, but no vendor response or patch has been provided as of the publication date.
CVE-2026-100891 is a medium severity vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2. It involves an encoding error in the Internationalized Domain Name Handler component, specifically in the opendmarc_policy_query_dmarc function. This flaw can be exploited remotely without authentication. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-100882 is a cross-site scripting (XSS) vulnerability in Krayin laravel-crm versions 2.2.0 through 2.2.5. It affects the Admin Settings Endpoint component, specifically the general.settings.footer.label argument in the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php. The vulnerability allows remote attackers to inject malicious scripts. A patch is available in version 2.2.6 and upgrading is recommended to mitigate this issue.
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-101061 is a server-side request forgery (SSRF) vulnerability affecting the universal-tool-calling-protocol python-utcp versions before 1.1.1. The flaw exists because the GraphQL plugin's prefix check can be bypassed with crafted URLs, and the WebSocket plugin lacks URL validation. This allows attackers to make the server connect to internal services or cloud metadata endpoints and potentially exfiltrate sensitive API keys and OAuth tokens. The vulnerability has a low CVSS score of 2.3 and requires user interaction and high attack complexity.
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.
CVE-2026-101058 is a Server-Side Request Forgery (SSRF) vulnerability in the python-utcp package (pip package utcp-http) versions before 1.1.12. The flaw allows an attacker who can serve a UTCP manual to a victim to cause the client to send requests to services bound to the victim's loopback interface (127.0.0.1). This occurs because the package does not verify if tool URLs declared in a UTCP manual fetched from a remote origin point to the loopback interface. The vulnerability affects the http, sse, and streamable_http protocols. Exploitation requires a loopback service that responds to unauthenticated requests with useful data. The issue is fixed in version 1.1.12, which rejects manuals fetched from non-loopback origins that declare loopback tool URLs.
CVE-2026-101057 is a vulnerability in the utcp-mcp plugin of python-utcp up to version 1.1.2 where it connects to HTTP and WebSocket MCP server URLs without enforcing secure URL validation. This allows cleartext transmission of the MCP handshake to non-secure HTTP servers, potentially exposing sensitive information to network interception. The vulnerability is limited by the fact that the server URLs are operator-configured and the OAuth2 authentication path is not invoked in affected versions. The issue is fixed in version 1.1.3 by validating server URLs before connection.
Fleet versions before 4.87.0 have a vulnerability where two endpoints serving in-house iOS application packages and manifests are not protected by the intended random, time-limited URL token. This allows unauthenticated attackers with network access to the Fleet server to download in-house IPA binaries and metadata by guessing sequential title identifiers. The issue affects only the enterprise tier and does not impact the free tier. The vulnerability results in read-only information disclosure without privilege escalation or write access.
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.
CVE-2026-101045 is an OS command injection vulnerability in fleetdm's fleet product affecting macOS app install and uninstall scripts generated from Homebrew cask metadata before 2026-08-19. The vulnerability arises because some shell metacharacters in the metadata were not properly escaped, allowing crafted metadata to execute arbitrary commands as root on managed macOS hosts. Exploitation requires the malicious metadata to pass both upstream Homebrew cask review and Fleet's automated ingestion review. The issue was fixed in Fleet v4.92.0 with a patch applied centrally on 2026-08-19, which escapes all interpolation sites in the generated manifests. This fix was distributed to all deployments with no customer action required.
This content is a curated list of publicly accessible, keyless (zero-authentication) cyber threat intelligence (CTI) and infostealer API endpoints useful for rapid triage and investigation. It includes various free APIs for credential exposure, infrastructure reconnaissance, vulnerability scoring, and botnet command-and-control feeds. Additionally, an open-source Python script is provided to query these endpoints concurrently, facilitating efficient threat analysis workflows.
Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. [...]
CyberCodex v3.2 is an open-source Python CLI tool designed to aggregate cyber threat intelligence (CTI) from 22 public sources without requiring API keys. It provides live enrichment of indicators of compromise (IOCs) and hashes, vulnerability prioritization using MITRE CVE data combined with exploitation probability scores, and telemetry on infostealers and breaches. The tool also includes offline encyclopedic data on advanced persistent threat (APT) operations and actor profiles, supporting multiple languages and exporting data in Markdown or JSON formats.
An investigation reveals that placeholder domains commonly used in documentation are serving malicious content through advertising chains. Two domains, yoursite[.]com and your-domain[.]com, present in hundreds of thousands of GitHub files and agent skills, use cloaking techniques to display scams specifically to macOS visitors while showing legitimate parking pages to others. The scams include fake MacOS Security Center warnings and counterfeit news articles promoting investment schemes. These attacks leverage affiliate fraud models, funneling victims through multiple redirectors to genuine services like McAfee subscriptions to earn commissions. Static security checks fail to detect these threats because malicious redirects occur after JavaScript execution. This follows an earlier disclosure about third-party[.]com serving ClickFix lures. The widespread citation of unregistered placeholder domains in documentation creates significant exposure, particularly for AI agents that fetch and act on this content.
This content provides guidance on how Open-Source Intelligence (OSINT) can enhance incident response capabilities. Using the September 2026 Revolut incident as a case study, it illustrates how OSINT can support detection, analysis, containment, eradication, recovery, and lessons learned phases of incident response. The Revolut incident involved criminals impersonating officials via a compromised government email system to request customer information, resulting in data exposure but no direct intrusion into Revolut's core systems. The guidance emphasizes that OSINT is a disciplined intelligence capability that can reduce financial, reputational, and operational harm when integrated into incident response workflows.
An undocumented remote-access Trojan named Kothamine Agent has been discovered with support for over 30 commands, enabling attackers to control infected Windows systems through command execution, file manipulation, and capability extension. Some variants include browser data theft and camera/microphone recording functionality. The malware has been distributed through malicious npm packages and utilizes tailcat, an open-source Tailscale tool, to establish encrypted command-and-control communications that evade conventional network inspection and blocking. Earlier versions employed Tailscale VPN before transitioning to tailcat. Active since July based on VirusTotal and GitHub evidence, Kothamine features a plugin system for loading additional DLLs, UAC bypass capabilities in certain builds, and employs AES-GCM encryption for C2 communications. The malware achieves persistence through scheduled tasks and adds Windows Defender exclusions during installation.