Latest cyber news, threats, security, and guidelines. Stack up.
Fri 7 Aug
Progress LoadMaster Command Injection Vulnerability. Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Thu 6 Aug
CVE-2026-65400
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApple's 6 August 2026 security content for macOS Tahoe 26.6.1 (and matching Sequoia/Sonoma notes) says an authentication issue in Screen Sharing was addressed with improved state management. Impact: an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. Fixed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. CISA added the CVE to KEV on 18 August 2026 (due 21 August for federal agencies under BOD 26-04) and CISA-ADP rates CVSS 3.1 9.8. Apply the Apple builds above; if Screen Sharing is not required, disable it and keep TCP 5900 off the public internet.
Thu 6 Aug
Updated Wed 28 Oct
CVE-2026-72898
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HMetabase GHSA-vwf4-m7j8-wcjf (published 6 August 2026; CVE-2026-72898) is an unauthenticated SQL injection on /api/session/reset_password that lets a remote attacker inject SQL into the Metabase application database and obtain administrator access, then steal connected-database credentials and export data. CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Metabase confirmed active exploitation. Affected OSS lines include ≥0.58.0 before the patched builds; fixed releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 (Enterprise 1.x counterparts on the same minors). Temporary workaround: block /api/session/reset_password. After upgrade on a previously exposed instance: delete core_session rows, review API keys and admin accounts, rotate connected-database credentials, and review warehouse and Metabase query history. (source: Metabase GitHub security advisory) Correction (28 Oct 2026): removed the statement that this CVE is the flaw behind the Mathspace breach and the ShipMonk/Trezor incident, and the 'exploited in Australia' marking that rested on it, because none of the linked sources ties this CVE to those incidents. (source: Metabase GitHub security advisory)
Tue 4 Aug
Updated Sat 17 Oct
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCyberArk (now Idira, the Palo Alto Networks identity security platform) published security bulletins CA26-37 and CA26-38. The public Technical Community notice, edited 4 August 2026, says CA26-37 is High severity and affects Privilege Cloud Central Policy Manager (CPM), all versions prior to 15.0, and CA26-38 is High severity and affects Secrets Manager, Self Hosted, version 13.9.0. Full technical detail sits behind the CyberArk/Idira Technical Community login. No CVE identifiers or CVSS vectors are in that public post. Idira is the May 2026 rebrand of CyberArk after the Palo Alto Networks acquisition; it is not a separate invented product. Confirm the exact patched builds from the logged-in bulletins before upgrading. UPDATE 15–16 October 2026: Palo Alto Networks, as CVE numbering authority, published CVE-2026-45165 for the CA26-38 Secrets Manager flaw on 15 October. The CVE record describes improper authorisation in the REST API (CWE-863) of Idira Secrets Manager (Self-Hosted), also referred to as Conjur, version 13.9.0: an authenticated user with limited privileges can perform unauthorised actions on a policy branch and, under specific circumstances, retrieve secrets they should not see, alter administrative access controls on the branch, or cause a denial of service. It is rated CVSS 4.0 8.6 High, with no exploitation recorded in the CVE record's SSVC data. The fix is Secrets Manager Self-Hosted 13.9.1, per the vendor release notes linked from the CVE record. Canada's Cyber Centre issued advisory AV26-1056 on 16 October covering the same product (prior to 13.9.1).
Tue 4 Aug
CISA lists CVE-2026-9198 as a Langflow code-injection issue that allows unauthenticated remote code execution on default deployments. Do not internet-expose unauthenticated AI workflow UIs. Apply vendor mitigations; this Cyberstack does not invent a patch build.
Tue 4 Aug
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability. Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Fri 31 Jul
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-14540 (CNA: Google LLC; published 31 July 2026) is a server-side request forgery in the generic HTTP source/tool components of Google mcp-toolbox (MCP Toolbox for Databases) versions 0.3.0 through 1.4.0. The Go HTTP client lacked a restrictive CheckRedirect policy and target IP validation, so a crafted path parameter (including via a malicious data-driven prompt to a connected agent) could coerce redirects to internal or arbitrary endpoints (CWE-918). Google CVSS 4.0 base 8.0 HIGH: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U. Fixed in mcp-toolbox 1.5.0+ via SSRFGuard (GitHub PR #3448 — DNS-rebinding/TOCTOU protection, IP allow/block lists, base-URL fail-fast). Credited: Syed Anas Mohiuddin. No public in-the-wild exploitation stated on the CVE record. (sources: CVE.org; googleapis/mcp-toolbox PR #3448; Researcher write-up)
Fri 31 Jul
Updated Wed 28 Oct
CVE-2026-66755
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NThe CVE record for CVE-2026-66755, published by Apache as CVE numbering authority on 31 July 2026 (Perth), describes a relative path traversal in the ISA-Tab parser of Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1. It 'allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output', via a 'Study Assay File Name' value in the ISA-Tab investigation file that traverses outside the dataset directory. The affected package is org.apache.tika:tika-parser-scientific-module. Apache rates it CVSS 4.0 5.9 (Medium), local attack vector, and recommends upgrading to 3.3.2 or 4.0.0-beta-1. CISA's enrichment in the record lists exploitation as none. Credited finders: BugQore, and independently n0mi1k. Correction (28 Oct 2026): removed the Ubuntu USN-8717-1 link, its Ubuntu ESM package versions and its 10 September date, because the notice could not be read by Cyberstack; the card is now sourced to the CVE record and re-dated to the record's publication date. (source: CVE record)
Wed 29 Jul
Updated Mon 26 Oct
CVE-2026-66066
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HThe Rails project's GitHub advisory says an unauthenticated attacker can abuse Active Storage image variant processing with libvips to read arbitrary files accessible to the Rails process, including environment secrets; exposed signing or service credentials can enable remote code execution or lateral movement. The affected configuration uses libvips for Active Storage and accepts untrusted image uploads. Upgrade Active Storage to 7.2.3.2, 8.0.5.1 or 8.1.3.1, use libvips 8.13 or later, and rotate secret_key_base plus every other secret readable by the application process. Rails branches without a fixed release should move to a supported branch or remove libvips until they can patch. No vendor, CISA or other source Cyberstack can cite has confirmed exploitation of CVE-2026-66066 in the wild; it was not in CISA's Known Exploited Vulnerabilities catalogue when checked on 26 October 2026. Correction (26 Oct 2026): a 1 September report of exploitation against honeypots in Singapore, Israel and the UK from a single IP address in France, with command-and-control in Israel, has been removed: The Hacker News attributed it to one threat-intelligence company's honeypot data, and no vendor, CISA or other independent source confirms it. A SecurityWeek link this Cyberstack does not use has also been removed. (source: Rails security advisory)
Mon 27 Jul
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability. Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Mon 27 Jul
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability. Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Wed 22 Jul
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability . Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.