🔐 Velociraptor Permission Bypass Enables Analyst-to-Investigator Escalation
Velociraptor deployments that give analysts arbitrary VQL access should patch promptly. Until updated, restrict VQL execution where possible and review whether analyst accounts have performed unexpected collection activity.
CVE-2026-64954 affects Velociraptor and allows a user who can run arbitrary VQL to reset the authorization provider and bypass the COLLECT_CLIENT permission required for scheduling new collections. This can escalate a user with the analyst role to investigator-level collection capabilities. The vulnerability is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD
⚠️ Socket Syscall TOCTOU Race Can Corrupt Kernel Heap Memory
Systems with CONFIG_USERSPACE enabled and the affected zsock_sendmsg or zsock_recvmsg syscalls available should prioritize the fix, especially where untrusted users or processes can invoke them. The issue crosses the user-to-kernel privilege boundary and can lead to kernel memory corruption.
CVE-2026-12234 affects userspace socket syscall verification for zsock_sendmsg and zsock_recvmsg, where repeated reads of a user-controlled msg_iovlen create a double-fetch TOCTOU race. An unprivileged thread can potentially drive writes past an allocated kernel-heap shadow buffer, resulting in memory corruption that could enable local privilege escalation or a kernel-fault denial of service. The vulnerability is rated HIGH with CVSS 7.8.
🔗 Read more 🔗
Source: NVD
🚨 VentraConnect WordPress Login Flaw Enables Administrator Takeover
WordPress administrators using this plugin through version 1.4.3 should patch as a top priority. Because successful exploitation can provide unauthenticated administrator access, review recent login and OAuth activity for suspicious account access.
CVE-2026-18961 affects the Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress in all versions up to and including 1.4.3. The plugin trusts an unverified email returned through Spotify OAuth, allowing an unauthenticated attacker to log in as an existing WordPress user, including an Administrator, by supplying a known target email address. The vulnerability is rated HIGH with CVSS 8.1.
🔗 Read more 🔗
Source: NVD
🔓 RHACM Channel Flaw Exposes Cross-Tenant Secrets and ConfigMaps
Red Hat Advanced Cluster Management operators should patch promptly, particularly on multi-tenant hubs. If a managed-cluster agent may have been compromised, investigate access to Channel namespaces and rotate potentially exposed repository credentials.
CVE-2026-73122 affects the multicloud-operators-channel component of Red Hat Advanced Cluster Management. A compromised agent from a managed cluster can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants’ Git and Helm repositories. The vulnerability is rated HIGH with CVSS 7.7.
🔗 Read more 🔗
Source: NVD
💥 Multicloud Integrations Flaw Can Force Malicious ArgoCD Synchronization
Deployments using the affected multicloud-integrations component should treat this as an urgent patch, especially where tenants can create Application resources. The flaw can turn ordinary tenant permissions into code execution or privilege escalation on managed clusters.
CVE-2026-72526 affects the multicloud-integrations component, where the Application propagation controller fails to properly validate the ocm-managed-cluster annotation on an Application Custom Resource. A tenant allowed to create Applications on the hub cluster can target arbitrary managed clusters and force ArgoCD on spoke clusters to synchronize attacker-controlled manifests, potentially leading to arbitrary code execution or privilege escalation. The vulnerability is rated CRITICAL with CVSS 9.9.
🔗 Read more 🔗
Source: NVD
🔑 RHACM GitOps Flaw Can Expose Spoke Cluster Bearer Tokens
Red Hat Advanced Cluster Management administrators should patch urgently, particularly in multi-tenant GitOps environments. Investigate unexpected GitOpsCluster changes and rotate bearer tokens that may have been exposed.
CVE-2026-70398 affects multicloud-integrations, a component of Red Hat Advanced Cluster Management. An authenticated tenant can manipulate the GitOpsCluster controller to redirect sensitive spoke-cluster bearer tokens into a namespace they control, causing credential disclosure and potentially bypassing security policies within ArgoCD AppProjects. The vulnerability is rated CRITICAL with CVSS 9.6.
🔗 Read more 🔗
Source: NVD
🗝️ Multicloud Subscription Flaw Enables Cross-Namespace Secret Disclosure
Deployments using multicloud-operators-subscription should patch promptly where namespace administrators can create Channel and Subscription resources. Review for unexpected cross-namespace secret access and rotate credentials if sensitive Secrets may have been copied.
CVE-2026-66878 affects multicloud-operators-subscription and can be exploited by a namespace administrator able to create Channel and Subscription resources. By manipulating Channel.Spec.SecretRef.Namespace, that user can cause sensitive Secret contents from another namespace to be copied into a namespace they control. The vulnerability is rated HIGH with CVSS 7.7.
🔗 Read more 🔗
Source: NVD
🧬 UEFI Verified-Boot Gap May Permit Arbitrary Code Execution
Organizations should check applicable UEFI and firmware updates for affected systems and patch promptly where exposure is confirmed. Because the entry does not name a vendor or implementation, remediation first requires matching the CVE against deployed firmware.
CVE-2026-6484 describes a UEFI vulnerability where a lack of verified boot for certain firmware volumes may allow arbitrary code execution. The provided entry does not identify a specific vendor or implementation. The vulnerability is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD
✏️ calibre Content Server Lets Read-Only Users Change Annotations
Operators running calibre Content Server should upgrade to version 9.12.0 or later promptly. Unauthenticated deployments deserve particular attention because anonymous users may be able to modify stored annotations.
CVE-2026-73249 affects calibre before version 9.12.0. A missing database-write authorization check on the Content Server annotation-update endpoint allows a read-only user, or an anonymous user on an unauthenticated deployment, to persist unauthorized book annotation changes. The vulnerability is rated HIGH with CVSS 7.5 and is fixed in version 9.12.0.
🔗 Read more 🔗
Source: NVD
🐍 Malicious E-Books Can Execute Python Code in calibre
calibre users who open or import files from untrusted sources should upgrade to version 9.12.0 or later as a priority. Until patched, avoid processing unsolicited or otherwise untrusted e-book and metadata files.
CVE-2026-73248 affects calibre before version 9.12.0. Attacker-controlled composite_template metadata in a malicious EPUB, OPF, PDF, or similar file can reach Python template compilation through nested template processing and execute arbitrary Python code when the file is opened or imported. The vulnerability is rated HIGH with CVSS 8.5 and is fixed in version 9.12.0.
🔗 Read more 🔗
Source: NVD
🌐 Kestra SSRF Lets Unauthenticated Attackers Reach Internal Services
Kestra operators should upgrade to version 2.0.0 or later urgently where untrusted users can import or execute flows. The flaw can expose internal services and cloud metadata that would otherwise be unreachable to an external attacker.
CVE-2026-73247 affects Kestra before version 2.0.0. Its http() function accepts attacker-controlled URIs without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata. The vulnerability is rated HIGH with CVSS 8.6.
🔗 Read more 🔗
Source: NVD
📡 Kestra Worker Endpoint Exposes Credentials Without Authentication
Kestra deployments with the worker endpoint reachable by untrusted clients should upgrade to version 2.0.0-rc6 or later immediately and restrict access to that endpoint. Review exposure and rotate credentials if task data may have been disclosed.
CVE-2026-73246 affects Kestra before version 2.0.0-rc6. The unauthenticated GET /worker endpoint serializes complete live Task objects and can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers even when the main API remains protected. The vulnerability is rated HIGH with CVSS 7.5 and is fixed in version 2.0.0-rc6.
🔗 Read more 🔗
Source: NVD