🔓 CrateDB Blob API Bypasses Table Privileges
CrateDB operators using BLOB TABLE should upgrade to 6.2.8, 6.3.2, or later promptly. Prioritize environments where untrusted or lower-privileged users have authenticated database access.
CVE-2026-49989 affects CrateDB prior to versions 6.2.8 and 6.3.2 and allows any authenticated user to read, delete, or plant blobs in any BLOB TABLE when the digest is known. The HTTP blob API authenticates users but fails to enforce AccessControl privileges that protect equivalent SQL operations. The issue is rated HIGH with CVSS 7.1.
🔗 Read more 🔗
Source: NVD
💥 Malicious Projects Can Trigger Code Execution in Cortex MCP
Users of Cortex MCP should update to version 3.17.1 or later, especially developers who open repositories from untrusted sources. Treat unfamiliar projects as potentially capable of local code execution until patched.
CVE-2026-49986 affects the Cortex MCP server neuro-cortex-memory prior to version 3.17.1. A malicious project can abuse trust in CLAUDE_PROJECT_DIR and specially placed marker files to make Cortex execute an attacker-controlled visualize_bootstrap.py with the victim user’s privileges. The issue is rated HIGH with CVSS 7.1.
🔗 Read more 🔗
Source: NVD
🧨 Recursive Jinja Rendering Enables Command Execution in compliance-trestle
Teams using compliance-trestle with externally supplied SSP data, lookup tables, or other untrusted inputs should patch urgently. Upgrade to 3.12.3, 4.0.3, or a later fixed release before processing potentially hostile compliance data.
CVE-2026-46439 is a Server-Side Template Injection vulnerability in the compliance-trestle trestle author jinja command. In affected versions, attacker-controlled data rendered into an otherwise trusted template can be recursively recompiled and executed, allowing arbitrary command execution with the privileges of the running process. The issue is rated HIGH with CVSS 7.8, and versions 3.12.3 and 4.0.3 patch it.
🔗 Read more 🔗
Source: NVD
📡 Public Exploit Targets TOTOLINK A800R DHCP Handler
Owners and administrators of affected TOTOLINK A800R devices should apply vendor remediation as soon as available and restrict management exposure immediately. The publicly disclosed exploit materially increases the urgency even though the entry does not state confirmed active exploitation.
CVE-2026-19845 affects TOTOLINK A800R firmware 4.1.2cu.5137_B20200730. Manipulating the Comment argument in setStaticDhcpConfig can trigger a remotely reachable stack-based buffer overflow. The issue is rated HIGH with CVSS 8.8, and an exploit has been publicly disclosed.
🔗 Read more 🔗
Source: NVD
📡 Public Exploit Exposes TOTOLINK A800R IPv6 Stack Overflow
Patch or replace affected A800R devices promptly and keep administrative interfaces inaccessible from untrusted networks. Public exploit availability raises the risk of opportunistic attacks.
CVE-2026-19844 affects TOTOLINK A800R firmware 4.1.2cu.5137_B20200730. A crafted radvdinterfacename argument passed to setRadvdCfg can cause a remotely triggerable stack-based buffer overflow. The issue is rated HIGH with CVSS 8.8, and a public exploit is available.
🔗 Read more 🔗
Source: NVD
⚙️ Tenable Security Center Admin Configuration Enables Command Injection
Tenable Security Center administrators should apply the vendor fix promptly, particularly in environments with multiple administrative users or delegated administration. The exploit requires administrator access, but successful abuse reaches the underlying OS.
CVE-2026-19628 is a command injection vulnerability in Tenable Security Center. An authenticated administrator can modify application configuration values so that specific backend operations execute arbitrary commands on the underlying operating system. The issue is rated HIGH with CVSS 7.2.
🔗 Read more 🔗
Source: NVD
🚨 Critical Tenable Security Center Report RCE Needs Immediate Attention
Security Center operators should treat this as an emergency patch because exploitation only requires a non-admin authenticated account and yields server-side code execution. Prioritize internet-facing or broadly accessible deployments and review access by lower-privileged users.
CVE-2026-19626 is a remote code execution vulnerability in Tenable Security Center report generation. An authenticated non-administrative user can supply crafted input that is processed unsafely during server-side report rendering, resulting in arbitrary code execution as the service account. The issue is rated CRITICAL with CVSS 9.9.
🔗 Read more 🔗
Source: NVD
📤 Dangerous File Upload Can Lead to RCE in Dell Wyse Management Suite
Dell WMS administrators should upgrade to 2605.0.2 or later promptly. The required privilege level reduces exposure, but remote code execution makes the issue important wherever administrative accounts could be compromised or shared.
CVE-2026-66271 affects Dell Wyse Management Suite versions prior to 2605.0.2. A high-privileged remote attacker can exploit unrestricted upload of a dangerous file type and potentially achieve Remote Code Execution. The issue is rated HIGH with CVSS 7.2.
🔗 Read more 🔗
Source: NVD
⬆️ Dell Wyse Management Suite Permissions Allow Local Privilege Escalation
Organizations running Dell WMS should update to 2605.0.2 or later, especially on systems where lower-privileged users can obtain local access. Prioritize shared administration hosts and other environments where local privilege boundaries matter.
CVE-2026-63700 affects Dell Wyse Management Suite versions prior to 2605.0.2. Incorrect default permissions can allow a low-privileged attacker with local access to escalate privileges. The issue is rated HIGH with CVSS 7.8.
🔗 Read more 🔗
Source: NVD
🔗 ZeroBrew Missing Integrity Checks Enable Supply-Chain Code Execution
ZeroBrew users who build packages from source should update as soon as a fixed release is available and avoid untrusted networks or mutable download sources in the meantime. Build systems and CI environments deserve particular attention because injected content executes as part of the build.
CVE-2026-53970 affects ZeroBrew version 0.3.1 and prior. Its Ruby compatibility shim fails to verify checksums for secondary formula resources and URL-based patches, allowing a network attacker who can replace or intercept those downloads to inject code that executes during source builds. The issue is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🗂️ Opening a Malicious Repository Can Execute Code in Eclipse Theia
Users and vendors shipping Theia-based IDEs should move to 1.70.0 or later urgently, particularly where developers routinely open third-party repositories. Until patched, treat opening an untrusted repository as a potential code-execution event.
CVE-2026-19884 affects Eclipse Theia versions up to and including 1.69.0 and applications built on Theia with Git integration. Git operations can run before a workspace is trusted, allowing attacker-controlled repository configuration such as core.fsmonitor to execute arbitrary commands when a malicious repository is cloned and opened. The issue is rated HIGH with CVSS 8.4 and is addressed in version 1.70.0.
🔗 Read more 🔗
Source: NVD
🧵 piControl Race Condition Can Corrupt Kernel Memory
Operators of systems running piControl 2.6.2 should apply KUNBUS remediation promptly, especially where local authenticated access is available to less-trusted users. The attack is local, but kernel memory corruption makes successful exploitation operationally serious.
CVE-2026-13197 affects KUNBUS piControl version 2.6.2. A local authenticated attacker can issue concurrent crafted requests through the piControl character device to trigger use-after-free conditions and invalid pointer dereferences, causing kernel memory corruption and denial of service. The issue is rated HIGH with CVSS 7.3.
🔗 Read more 🔗
Source: NVD