Tag
#security
MLflow Unauthenticated RCE on Tracking Servers (CVE-2026-116692)
CVE-2026-116692 (CVSS 9.8) lets any caller of a default MLflow 3.12.0-3.16.x tracking server upload and run Python code as the server process; fixed in 3.17.0.
Oct 28, 2026
Magento and Adobe Commerce PolyShell RCE Exploited in the Wild (CVE-2026-48356)
PolyShell (CVE-2026-48356) is an unauthenticated file upload in Magento's REST API, mass-exploite...
Oct 28, 2026
AuthMask: Microsoft Authenticator for Android Token Theft (CVE-2026-80097)
Before 6.2606.4246, Microsoft Authenticator for Android handed work-account tokens to any app pos...
Oct 27, 2026
Authlib JWS Signature Bypass, Fixed in 1.9.0 (CVE-2026-96760)
Authlib up to 1.8.0 treats a JWS JSON object with empty signatures as verified without checking t...
Oct 27, 2026
More tagged #security
OpenHands Software Agent SDK Unauthenticated Sandbox RCE (CVE-2026-112346)
The OpenHands Software Agent SDK exposes its sandbox agent port on every interface with auth off by default, allowing root commands; 1.52.0 fixes Docker but not Apptainer.
Oct 27, 2026
Tailworm: Tailscale SSH Privilege Escalation to Root
Tailscale SSH's root daemon dials and replaces unix sockets for approved users, reaching root on permitted servers; upgrade to 1.104.4 or later; disable forwarding until updated.
Oct 27, 2026
Malicious OVHcloud CLI Release Archives Steal Secrets
Swapped archives on five OVHcloud CLI releases delivered a secret-stealing build for 94 minutes on October 19, 2026; rotate every secret and install v0.16.0.
Oct 26, 2026
OpenCode MCP OAuth Sign-In RCE on Windows, Fixed in 1.18.33
In OpenCode 1.0.137 to 1.18.32 on Windows and WSL, a malicious MCP server's OAuth sign-in URL reaches PowerShell and runs code as the developer; fixed in 1.18.33, with no CVE.
Oct 26, 2026
Linux KSMBD Pre-Auth Flaw, ZDI-Rated CVSS 9.0 RCE, No Released Fix Yet (ZDI-CAN-33774)
Two flaws in KSMBD, the Linux kernel's built-in SMB server, are rated CVSS 9.0 by ZDI, one reachable before authentication, with no fix in any released kernel and no CVE id yet.
Oct 26, 2026
FortiSIEM gRPC Path Traversal RCE with a Public PoC (CVE-2026-106173)
FortiSIEM 7.5.0's unauthenticated gRPC service on TCP 27918 lets an attacker overwrite files for RCE; fixed in 7.5.1, public PoC, no known exploitation.
Oct 26, 2026
Postiz Full Takeover by Any Registered User (CVE-2026-115931, CVE-2026-115932, CVE-2026-115933)
In self-hosted Postiz 2.23.0 to 2.25.2 any registered user can read server files, and in 2.15.0 to 2.25.2 they can forge sign-in tokens to take over other organizations; fixed in 2.25.3.
Oct 26, 2026
Pillow Ghostscript Argument Injection RCE (CVE-2026-112900)
Pillow 2.6.0 to 12.3.0 passes an attacker-controlled EPS or PostScript filename to Ghostscript unsanitized, allowing argument injection and command execution; fixed in 13.0.0.
Oct 26, 2026
GitLab Unauthenticated RCE Across 12 Years (CVE-2026-110264)
CVE-2026-110264, a 10.0 integer overflow, exposes every self-managed GitLab since 7.0 to unauthenticated RCE; fixed October 21; its sibling is in KEV.
Oct 25, 2026
Node2Shell: Brotli RCE in Node.js, Bun and Python (CVE-2026-111497)
CVE-2026-111497 (CVSS v4.0 9.2): Brotli decoder overflow in Node.js, Bun, .NET, Python, Envoy and Istio, now in CISA's Known Exploited Vulnerabilities catalog.
Oct 25, 2026