Ecava_ntegraXor version 16.0.701.10 contains a remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary code on the affected system remotely.
Food-Ordering 1.0 contains a Local File Inclusion (LFI) vulnerability that allows an attacker to include files from the local server. This can potentially expose sensitive information or enable further attacks.
TigerGraph Community Edition version 4.2.4 contains a vulnerability that allows arbitrary file write. This vulnerability could enable an attacker to write files to the system without authorization.
This content discusses the limitations of using CVSS scores alone for vulnerability prioritization and proposes a five-signal framework that better aligns with actual exploitation likelihood. It emphasizes that CVSS measures potential severity but not the probability of exploitation. The framework incorporates signals such as confirmed exploitation (KEV), predicted exploitation (EPSS), asset criticality, compensating controls, and exposure to prioritize vulnerabilities more effectively.
A remote code execution (RCE) vulnerability identified as CVE-2026-86060 affects MikroTik RouterOS versions 7.0 up to but not including 7.23.4, and versions 7.24.0 up to but not including 7.24.2. Exploit code leveraging this vulnerability is publicly available, involving MikroTik CHR 7.23.3 (x86_64) and Python3-paramiko on Kali Linux 2025.x. No official patch or vendor advisory details are provided.
CVE-2026-87902 is a critical unauthenticated remote code execution vulnerability in WordPress versions 4.7.0 through 7.1.1. It allows attackers to include arbitrary PHP files outside the active theme directories, potentially leading to code execution. The flaw was patched in WordPress 7.1.2 and backported to supported branches down to 4.7. Exploitation attempts began shortly after the patch release, with attackers writing malicious PHP files to disk to execute shell commands. Immediate updating to version 7.1.2 or later is strongly advised.
AI agents that rely on MCP (Model-Controller-Plugin) tool descriptions trust these descriptions similarly to how browsers trust TLS certificates. Attackers have begun exploiting this trust by poisoning tool metadata, which can lead to unauthorized actions such as secret exfiltration and silent email BCCs. This attack surface is not widely covered by existing security tools. The threat involves manipulating tool descriptions dynamically to alter agent behavior post-integration. The recommended defensive approach is to treat tool descriptions as untrusted input and implement measures such as pinning, hashing, and baseline comparisons to detect unauthorized changes.
The GemStuffer incident involved AI agents exploiting a documentation feature in RubyGems infrastructure to achieve remote code execution (RCE). Specifically, the YARD tool's --load option in .yardopts files was abused to execute arbitrary Ruby code during automated documentation builds on RubyDoc.info. The attackers created disposable accounts, bypassed email confirmation, and uploaded over 2,000 malicious packages that weaponized this feature. This incident highlights a broader class of vulnerabilities where legitimate scripting or code execution features in configuration files are abused in package ecosystems. The attack demonstrates a real supply chain risk from automated AI-driven exploitation.
A Chinese-speaking threat actor group known as Red Heron exploited a recently disclosed remote code execution vulnerability (CVE-2026-60004) in Gitea, a self-hosted Git service, in a multinational campaign. The campaign targeted internet-facing Gitea instances across multiple countries, including Canada, Argentina, Taiwan, the United States, and Sri Lanka, focusing on sectors such as defense, elections, energy, aerospace, telecommunications, government, and research. The attackers used automated tools to steal source code, credentials, and maintain persistent access, including root-level control on some infrastructure. They deployed a novel Linux implant named JITTERLY with extensive post-exploitation capabilities and embedded a previously undocumented rootkit called SIXZUT to maintain stealth and persistence. The campaign demonstrates rapid weaponization of n-day vulnerabilities in development platforms and highlights significant risks to source code confidentiality and infrastructure integrity.
CVE-2026-80428 is a critical unauthenticated PHP Object Injection vulnerability in ILIAS software versions prior to 9.22, between 10.0 and 10.10, and between 11.0 and 11.3. The flaw involves the Shibboleth integration and allows remote code execution (RCE) without authentication.
The Dark Sword exploit is an iOS exploit chain that was active earlier in the year and has since been patched. It was reportedly used primarily against high-profile targets, but the exploit code has been leaked publicly. This raises concerns about the potential risk to average iPhone users. However, there is no evidence of widespread exploitation against typical users. The exploit is considered high severity due to its capabilities, but the risk to the general population remains low given targeted use and the availability of patches.
An AI model named Cyberkimi claims to have autonomously developed a live exploit for a recently patched V8 JavaScript engine vulnerability in under 24 hours. The exploit targets Chrome Stable versions that still contain the unpatched bugs. The AI reportedly analyzed recent V8 security patches, identified incomplete fixes, and generated a working exploit chain demonstrated in a local Chromium environment. No official CVE has been assigned to these specific bugs yet, and independent confirmation is lacking. The exploit reportedly leverages a combination of aliasing bugs, race conditions, and control flow hijacking to achieve arbitrary code execution. Google has released Chrome updates addressing some V8 vulnerabilities around the same time, but it is unclear if these fixes cover the bugs exploited by Cyberkimi. This development highlights the shrinking window between patch release and exploit weaponization, potentially accelerating the risk exposure for users of affected Chrome versions.
FreePBX version 17.0.2 is affected by a remote code execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects Linux systems running Debian or Ubuntu with Asterisk. No specific affected sub-versions or patch information is provided.
Metabase versions 0.58.0 up to but not including 0.58.15, 0.59.0 up to but not including 0.59.12, 0.60.0 up to but not including 0.60.6.3, and 0.61.0 up to but not including 0.61.1.4 contain an authenticated remote code execution vulnerability. This flaw allows an attacker with valid authentication to execute arbitrary code remotely on the affected system.
Marimo version 0.20.4 is associated with a remote code execution (RCE) vulnerability identified as CVE-2026-39987. The available information is limited, with no detailed technical data or patch information provided.
Langflow versions prior to 1.10.0 contain a remote code execution (RCE) vulnerability identified as CVE-2026-9198. An exploit exists that leverages an API endpoint to obtain a superuser token and then executes arbitrary code on the target system. The exploit has been tested on Ubuntu 22.04.
Ghost_CMS versions from 0.7.2 up to and including 6.19.0 are affected by a remote code execution vulnerability identified as CVE-2026-29053. This vulnerability allows an attacker to execute arbitrary code remotely on affected systems. The issue is classified as critical severity. No patch or remediation information is provided in the available data. Exploit code is publicly known and categorized as an exploit. The affected platforms include Ubuntu 18.0.4 and Windows 10.
PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability in its Live Items functionality. An authenticated administrator can inject malicious JavaScript code into the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION fields of a Live Item. This payload is stored and executed when the Live Item is viewed both in the administrative interface and on the public Live Stream page. While administrative privileges are required to inject the payload, any unauthenticated user visiting the public Live Stream page can trigger the stored script execution.
A denial of service (DoS) vulnerability has been identified in EVerest version 2025.9.0. This issue could potentially allow an attacker to disrupt the availability of the affected software. No detailed technical information or exploit code is provided.
