An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
CVE-2026-88805 is a high-severity vulnerability in SUSE Rancher versions 2.15.0 and 2.15.1 where insufficient session expiration occurs due to incorrect credential cleaning on logout. This flaw allows remote attackers to retain access credentials even after the user logs out, potentially leading to unauthorized access. The issue is fixed starting from version 2.15.2.
The JadePuffer ransomware operator conducts agent-driven attacks targeting Microsoft Azure tenants. These attacks automate reconnaissance, credential theft, lateral movement, and destruction of cloud resources, including storage accounts, Key Vaults, Function Apps, Virtual Machines, and App Services. The attacker used compromised service principals to access and delete resources, removing backup protections to hinder recovery. Attempts to delete Azure SQL databases failed due to unsupported API versions. The threat actor is tracked as Storm-3168. Microsoft recommends activating cloud workload protections, auditing for exposed credentials, and enforcing least-privilege permissions.
CVE-2026-101861 is a low severity vulnerability in langflow versions 0.0.94 through before 1.12.0 and 1.0.16 through before 1.12.0. It involves unsafe use of Python's eval() function in schema.py, allowing authenticated users to execute arbitrary code by injecting malicious Python objects with crafted __repr__ methods into component input options. The vulnerability is triggered when components are converted into LangChain tools, including during API-based custom component saves.
CVE-2026-12342 is a critical vulnerability in SailPoint Technologies IdentityIQ affecting versions 8.3 through 8.5p2. It allows unauthenticated remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-88808 is a high-severity vulnerability in SUSE Rancher Fleet where the Fleet agent improperly uses cluster-admin credentials instead of the intended ServiceAccount credentials when writing resources to downstream clusters. This affects multi-tenant environments sharing downstream clusters, potentially allowing unauthorized overwriting of configuration files. The issue impacts SUSE Rancher Fleet versions 0.14 before 0.14.11, 0.15 before 0.15.7, and 0.16 before 0.16.2.
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
CVE-2026-101333 is a medium severity vulnerability in the Micrometer user-event metrics listener of Red Hat Build of Keycloak. When configured to include the idp tag, an unauthenticated attacker can send requests with arbitrary provider aliases to the identity broker login endpoint, causing the creation of unlimited metric time series. This can lead to excessive memory consumption and degrade server and monitoring tool performance.
A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Unsloth Zoo versions from 2025.9.9 up to but not including 2026.8.14 contain a code injection vulnerability in the model-loading compile path. The vulnerability arises because the get_transformers_model_type() function does not enforce a character allowlist on model_type values, allowing malicious input to inject arbitrary Python code. This can lead to remote code execution when a malicious model is loaded for training or inference.
Dutch authorities arrested Pepijn van der Stap, a convicted cybercriminal linked to the hacker group ShinyHunters, on suspicion of aiding data thefts and extortions. Van der Stap, known by the alias 'Umbreon,' was involved in multiple data breaches and extortion campaigns, including a major social engineering attack on Odido, the largest Dutch mobile provider, compromising data of over 6.2 million people. Following his arrest, ShinyHunters escalated attacks, breaching the FBI's job application site and extorting the Russian ransomware group Cl0p. The FBI breach exploited a recently patched PeopleSoft vulnerability (CVE-2026-35273). ShinyHunters used evasion techniques to bypass mitigations. Van der Stap had previously been convicted and sentenced to prison, released in late 2025, and had publicly claimed to be reformed before his recent arrest. The investigation and arrests are ongoing, with Dutch authorities seeking public assistance to identify members involved in social engineering intrusions.
CVE-2026-101076 is a critical OS command injection vulnerability in Netcore NR289-GE version 1.4.5102. It affects the system function in the /set_ntp_server_ip.cgi CGI Handler component, allowing remote attackers to inject OS commands via the ntp_ip argument. Exploit code is publicly available, and the vendor has not responded to disclosure attempts.
The Practical AI Pentest Associate (PAPA) certification offered by TCM Security is an associate-level exam and training program designed to teach and assess skills in penetration testing AI-based applications. It includes hands-on training, a real-world exam environment, and report writing. The certification aims to prepare penetration testers, developers, and security professionals to understand and exploit vulnerabilities in AI and large language model (LLM) environments. This content is educational and promotional in nature, not a security threat or vulnerability.
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.
This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write(text,text,bool), pg_file_rename(text,text,text), pg_file_unlink(text), and pg_logdir_ls(). These functions are executable by any authenticated database role with no GRANT required, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived implementations as part of Greenplum's merge to a PostgreSQL 12 base. A non-superuser can use pg_file_write, pg_file_rename, and pg_file_unlink to create, overwrite (append), rename, and delete files under the data and log directories, and can use pg_logdir_ls() to enumerate log file names. Because postgresql.auto.conf resides in the data directory, a non-superuser can append configuration directives such as shared_preload_libraries or archive_command to it, resulting in arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected, as the equivalent functions there enforce a superuser check internally.
A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.
Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.