Threat Intelligence Database

Suno, an AI music generator, experienced a limited security incident in late 2025 that was publicly disclosed in mid-2026. The breach involved outdated source code that is no longer in use, and the company confirmed no sensitive personal information was compromised. The incident revealed that Suno trained its AI model by scraping millions of songs and lyrics from platforms including YouTube, Deezer, and Genius. Suno is currently facing copyright infringement lawsuits from major music labels. The hacker claimed no specific motivation beyond general interest in hacking. Users are advised to be cautious if they have Suno accounts.

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

JavaCV versions prior to 1.5.14 contain an integer overflow vulnerability in IPCameraFrameGrabber. The issue arises when doubling a 32-bit buffer capacity without checking for overflow or bounding the Content-Length header in MJPEG streams. A malicious or tampered MJPEG source can supply an oversized Content-Length, causing the frame-grabbing thread to enter a permanent CPU-spinning loop, resulting in a denial of service. This vulnerability is fixed in version 1.5.14.

CVE-2026-108743 is an OS Command Injection vulnerability in Apache Kylin affecting versions from 4.0.4 through 5.0.4. The vulnerability involves improper neutralization of special elements used in OS commands. It primarily impacts Kylin services exposed directly to public networks, which is uncommon, and most in-house deployments are not affected. The issue is fixed in version 5.0.5.

CVE-2026-96620 is a critical vulnerability in the anthropics claude-agent-sdk-python prior to version 0.2.121. The issue arises because the resume option is passed to the Claude CLI without proper input validation, allowing dash-leading values to be interpreted as separate CLI flags. This enables an attacker to inject the --mcp-config flag, potentially causing arbitrary command execution at CLI startup outside the SDK's permission controls. The vulnerability is exploitable when untrusted input is passed as the session ID to the resume option. The issue is fixed in version 0.2.121.

An authentication bypass vulnerability exists in Apache Kylin versions 4.0.4 through 5.0.4. The issue primarily affects Kylin services exposed directly to public networks, which is uncommon. In-house deployments are mostly not impacted. The vulnerability is fixed in version 5.0.5.

Apache Kylin versions 4.0.0 through 5.0.4 contain a vulnerability (CVE-2026-69080) that exposes the SQL Black List to unauthorized actors. This exposure can lead to sensitive information disclosure. The issue is resolved in version 5.0.5, which users are advised to upgrade to.

Apache Kylin versions 4.0.0 through 5.0.4 contain a vulnerability (CVE-2026-69077) that allows unauthorized exposure of sensitive information through cross-project job manipulation. This issue primarily affects Kylin services exposed directly to public networks, which is uncommon; typical in-house deployments are mostly unaffected. The vulnerability is fixed in version 5.0.5.

CVE-2026-69076 is a vulnerability in Apache Kylin versions 4.0.0 through 5.0.4 that allows exposure of sensitive information (Job Discard) to unauthorized actors. The issue primarily affects Kylin services exposed directly to public networks, which is uncommon. In-house deployments are mostly not impacted. The vulnerability is fixed in version 5.0.5.

An improper authentication vulnerability (CWE-287) exists in Apache Kylin versions 4.0.0 through 5.0.4. This flaw allows unauthenticated users to perform system cleanup actions. The impact is primarily on Kylin services exposed directly to public networks, which is uncommon; typical in-house deployments are mostly unaffected. The issue is fixed in Apache Kylin version 5.0.5.