📱 Critical Microsoft UFO Flaw Exposes ADB-Connected Android Devices
Teams using Microsoft UFO with ADB-connected Android devices should upgrade to 3.0.8 immediately, especially where the exposed MCP ports are remotely reachable. The lack of authentication makes this a high-priority remediation even though the entry does not state that exploitation is active.
CVE-2026-73296 affects Microsoft’s UFO open-source automation framework prior to version 3.0.8. Unauthenticated Streamable HTTP MCP services on ports 8020 and 8021 can let remote attackers capture screenshots, inspect UI data, control apps, enter text, and modify the state of an ADB-connected Android device. The vulnerability is CRITICAL with CVSS 9.4 and is fixed in version 3.0.8.
🔗 Read more 🔗
Source: NVD
⚡ Nagios Notification Macros Enable Authenticated RCE
Nagios administrators should patch affected Core and XI installations promptly and review notification commands for these macros in shell-reachable positions. Prioritize systems where less-trusted users have authenticated UI access and the required non-default configuration is present.
CVE-2026-48554 affects Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. Authenticated UI users can inject commands through NOTIFICATION-family macro substitution when $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ is referenced in a shell-executed notification command. The vulnerability is HIGH with CVSS 7.5, although exploitation requires a non-default vulnerable notification configuration.
🔗 Read more 🔗
Source: NVD
⚡ Nagios NRDP Macro Injection Opens Path to RCE
Organizations exposing NRDP to authenticated users should patch promptly and audit host, service, and contact custom variables used by shell commands. Environments matching the required configuration deserve accelerated remediation because successful exploitation yields command execution as the nagios user.
CVE-2026-48553 affects Nagios Core before 4.5.13 and Nagios XI before 2026R1.5. An authenticated attacker with NRDP access can inject operating-system commands through a custom-variable macro when that variable is referenced in a shell-executed command line. The vulnerability is HIGH with CVSS 7.5 and requires a non-default configuration containing such a custom variable.
🔗 Read more 🔗
Source: NVD
🛡️ Nagios CSRF Bypass Can Trigger Commands as Authorized Users
Nagios Core and XI administrators should patch promptly, particularly on deployments used by privileged operators who may encounter attacker-controlled links. Treat this as a meaningful account-context abuse risk because exploitation can cause commands to run as an authorized user.
CVE-2026-48551 affects Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. A self-supplied double-submit cookie can bypass CSRF protection when an attacker provides matching cookie and request parameter values, allowing malicious links to trigger commands with an authorized user’s privileges. The vulnerability is HIGH with CVSS 7.4.
🔗 Read more 🔗
Source: NVD
🎭 IBM i Navigator Spoofing Flaw Enables Credential Harvesting
Administrators running the affected IBM i releases should review available vendor guidance and apply any available fixes with high urgency. The stated remote unauthenticated credential-harvesting risk warrants prompt attention.
CVE-2026-18847 affects IBM i 7.6, 7.5, 7.4, and 7.3 through Navigator for i. A remote unauthenticated attacker could spoof Navigator for i and harvest user credentials. The vulnerability is HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
🔓 IBM i Navigator Flaw Lets Authenticated Users Reach Root
Administrators running the affected IBM i releases should review available vendor guidance and apply any available fixes promptly. Root-level privilege escalation makes this a serious post-authentication compromise path.
CVE-2026-18683 affects IBM i 7.6, 7.5, 7.4, and 7.3 through Navigator for i. An authenticated user can exploit the flaw to elevate privileges to root and execute commands. The vulnerability is HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
🌐 Chrome V8 Use-After-Free Enables Sandbox Code Execution
Chrome users and enterprise administrators should update to 151.0.7922.137 or later urgently. The stated remote attack path through a crafted HTML page makes rapid browser rollout appropriate.
CVE-2026-19556 is a use-after-free vulnerability in V8 affecting Google Chrome prior to 151.0.7922.137. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The vulnerability is HIGH with CVSS 8.8, and Chromium also classifies its security severity as High.
🔗 Read more 🔗
Source: NVD
🍎 Chrome for Mac TabStrip Flaw Could Escape the Sandbox
Mac fleets running Chrome should update to 151.0.7922.137 or later promptly. Because this flaw can provide a sandbox-escape path after renderer compromise, security teams should treat it as particularly important alongside other browser vulnerabilities.
CVE-2026-19557 is a use-after-free vulnerability in TabStrip affecting Google Chrome on Mac prior to 151.0.7922.137. An attacker who has already compromised the renderer process could use a crafted HTML page to potentially escape the Chrome sandbox. The vulnerability is HIGH with CVSS 8.3, and Chromium rates its security severity as High.
🔗 Read more 🔗
Source: NVD
🧩 Malicious Chrome Extensions Can Exploit Use-After-Free for Code Execution
Chrome administrators should update to 151.0.7922.137 or later promptly and consider restricting untrusted extension installation where appropriate. The need for a malicious extension limits the stated attack path, but affected managed environments should still remediate quickly.
CVE-2026-19558 is a use-after-free vulnerability in Extensions affecting Google Chrome prior to 151.0.7922.137. An attacker who convinces a user to install a malicious extension can execute arbitrary code inside the browser sandbox through a crafted Chrome Extension. The vulnerability is HIGH with CVSS 7.5, and Chromium rates its security severity as High.
🔗 Read more 🔗
Source: NVD