Security Feeds

Gitea contains a code injection vulnerability in the diffpatch API endpoint that allows attackers with repository write access to plant malicious Git hooks and execute shell commands as the Gitea service account. This vulnerability is currently being actively exploited in the wild.

Impact: Organizations running vulnerable Gitea instances are at critical risk of unauthorized code execution and potential compromise of the Gitea service account with full access to repositories and potenti…

Remediation: Update Gitea to the latest patched version immediately and audit repository access permissions to restrict write access to trusted users only. Review Git hook configurations and disable unnecessary hooks if not required for operations.

CISA Known Exploited VulnerabilitiesView at sourceCheck on VirusTotal

Chainlit contains a command injection vulnerability in its MCP stdio transport that allows unauthenticated attackers to execute arbitrary code remotely. This vulnerability is rated critical severity and affects the pip package chainlit.

Impact: Any deployment of Chainlit using MCP stdio transport is vulnerable to complete system compromise by unauthenticated remote attackers.

Remediation: Update chainlit to a patched version as soon as available. Review and restrict access to systems running Chainlit until a patch can be applied.

GitHub Security AdvisoriesCVSS 9.8View at sourceCheck on VirusTotal

nextcloud-mcp-server has an unauthenticated webhook endpoint that allows arbitrary deletion of vector data when the WEBHOOK_SECRET is unset in its default configuration. An attacker can send a POST request to /webhooks/nextcloud without authentication to trigger data deletion.

Impact: Any organization running nextcloud-mcp-server with default settings faces critical risk of unauthorized vector data loss and potential service disruption from remote attackers.

Remediation: Set a strong WEBHOOK_SECRET environment variable in your nextcloud-mcp-server configuration immediately, then update to a patched version when available. Restrict network access to the webhook endpoint to trusted sources only.

GitHub Security AdvisoriesCVSS 9.1View at sourceCheck on VirusTotal

The qwed-mcp package uses SymPy's parse_expr() function without sanitizing user input, allowing remote code execution through malicious math expressions. An attacker can inject arbitrary Python code that will be executed when the expression is parsed.

Impact: Any system using qwed-mcp to process user-submitted mathematical expressions is at critical risk of complete compromise, including code execution with the privileges of the running process.

Remediation: Update qwed-mcp to the patched version immediately and validate or sanitize all user-supplied mathematical expressions before passing them to parse_expr(), or use safer alternatives like evaluating expressions in a restricted sandbox.

GitHub Security AdvisoriesCVSS 9.8View at sourceCheck on VirusTotal

PraisonAI's WebSocket origin validation uses an unanchored regex pattern that can be bypassed, allowing attackers to connect from unauthorized origins. This bypasses a previous security patch for the same vulnerability class.

Impact: Any deployment of PraisonAI is at critical risk of unauthorized WebSocket connections that could lead to unauthorized browser control or data access.

Remediation: Update PraisonAI to the latest patched version immediately, ensuring the regex pattern for origin validation is properly anchored to prevent partial matches.

GitHub Security AdvisoriesCVSS 9.1View at sourceCheck on VirusTotal

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability allowing unauthorized access to critical data and administrative functions. This vulnerability is actively exploited in the wild.

Impact: Attackers can read, modify, or delete critical data on systems running vulnerable Oracle HTTP Server and Weblogic Server Proxy Plug-in installations, affecting any organization using these components.

Remediation: Apply the latest security patches from Oracle for affected HTTP Server and Weblogic Server versions immediately. Review access logs and restrict network access to these services to trusted networks only.

CISA Known Exploited VulnerabilitiesEPSS 42.0%View at sourceCheck on VirusTotal

CVE-2025-36939 is a critical vulnerability in OpenThread affecting MLE packet handling, allowing authenticated network attackers to trigger denial of service through specially crafted packets, assertion failures, and stack-based buffer overflow conditions. The issue affects any OpenThread implementation on a Thread network where an attacker has ne…

Impact: Any device running vulnerable OpenThread versions on a Thread network can be crashed or potentially exploited by an authenticated attacker with network connectivity to that network.

Remediation: Update OpenThread to the patched version addressing MLE packet validation and buffer boundaries immediately. If immediate patching is not possible, restrict network access to trusted devices and isolate Thread networks from untrusted endpoints.

NIST NVD: new high/critical CVEs (7 days)CVSS 10EPSS 0.2%View at sourceCheck on VirusTotal

The miniOrange OAuth Client Joomla extension before version 3.2.0 allows attackers to modify cookie values and gain unauthorized access to arbitrary user accounts, including administrator accounts. This vulnerability is network-exploitable and requires no user interaction.

Impact: Any Joomla installation using miniOrange OAuth Client below 3.2.0 is at critical risk of complete account compromise, including administrative takeover that could lead to full site control.

Remediation: Immediately upgrade the miniOrange OAuth Client extension to version 3.2.0 or later. If an upgrade is unavailable, disable the extension until a patched version is released.

NIST NVD: new high/critical CVEs (7 days)CVSS 10EPSS 0.3%View at sourceCheck on VirusTotal

UltimateAI versions 3.1.0 and earlier contain a critical arbitrary file upload vulnerability in subscriber functionality that allows remote exploitation. An attacker can upload arbitrary files to the affected system without authentication.

Impact: All systems running UltimateAI 3.1.0 or earlier are at risk of complete compromise including data theft, malware installation, and service disruption.

Remediation: Immediately upgrade UltimateAI to version 3.1.1 or later, or disable subscriber file upload functionality until patched. Implement strict file type validation and access controls on upload endpoints.

NIST NVD: new high/critical CVEs (7 days)CVSS 9.9EPSS 0.4%View at sourceCheck on VirusTotal

A path traversal vulnerability in LXD's template processing allows attackers with container edit permissions or users launching crafted images to overwrite arbitrary files on the host system with root privileges. The vulnerability exists in how LXD validates and processes target template paths specified in metadata.yaml.

Impact: Any system running LXD with untrusted users having container edit permissions or accepting images from untrusted sources faces critical risk of full host compromise through arbitrary file overwrite a…

Remediation: Update LXD to the latest patched version immediately. Review and restrict container edit permissions to trusted users only, and disable or carefully validate custom image sources.

NIST NVD: new high/critical CVEs (7 days)CVSS 9.9EPSS 0.6%View at sourceCheck on VirusTotal

A use-after-free vulnerability exists in Linux kernel UDP tunnel segmentation where the UDP header pointer may become invalid after memory reallocation during tunnel header processing. An attacker can exploit this remotely to cause crashes or potentially execute code.

Impact: Linux systems handling UDP tunneling traffic are at critical risk of denial of service or remote code execution exploitable over the network.

Remediation: Update the Linux kernel to a patched version that retrieves the UDP header after ensuring tunnel headers are properly pulled into the skb head, rather than before.

NIST NVD: new high/critical CVEs (7 days)CVSS 10EPSS 0.5%View at sourceCheck on VirusTotal

A Linux kernel vulnerability in veth (virtual Ethernet) allows XDP programs to cause inconsistent SKB length accounting when adjusting packet fragments, resulting in mismatched skb->len and skb->data_len values. This mismatch can lead to memory corruption or denial of service when packets are subsequently processed.

Impact: Systems running affected Linux kernel versions with veth and XDP programs enabled are vulnerable to network-based attacks causing kernel memory corruption, crash, or potential privilege escalation.

Remediation: Update the Linux kernel to a patched version that corrects the SKB length synchronization in veth_xdp_rcv_skb(). Systems using veth with XDP enabled should prioritize this kernel update.

NIST NVD: new high/critical CVEs (7 days)CVSS 10EPSS 0.5%View at sourceCheck on VirusTotal

Fabrik extension versions before 4.7.2 contain a missing access control list (ACL) check in the download element, allowing unauthorized file access over the network. This affects Joomla installations with the vulnerable Fabrik plugin.

Impact: Any user on the network can download files without proper authorization, potentially exposing sensitive data stored within Joomla instances running vulnerable versions of Fabrik.

Remediation: Update Fabrik to version 4.7.2 or later immediately. If immediate patching is not possible, disable or remove the Fabrik extension until the update can be applied.

NIST NVD: new high/critical CVEs (7 days)CVSS 10EPSS 0.2%View at sourceCheck on VirusTotal

A critical path traversal vulnerability exists in Fabrik versions before 4.7.2 that allows remote exploitation through image elements. An attacker can bypass directory restrictions to access arbitrary files on the affected server.

Impact: Any organization running vulnerable Fabrik versions on publicly accessible Joomla installations faces complete compromise of sensitive files and potential full server takeover.

Remediation: Update Fabrik to version 4.7.2 or later immediately. If immediate patching is not possible, restrict access to the Fabrik installation or disable image element functionality.

NIST NVD: new high/critical CVEs (7 days)CVSS 10EPSS 0.3%View at sourceCheck on VirusTotal

A critical remote code execution vulnerability exists in Fabrik extension versions below 4.7.2, exploitable through image element handling. The vulnerability has a CVSS score of 10 and can be triggered remotely over the network.

Impact: Any Joomla site running Fabrik before version 4.7.2 is at critical risk of complete compromise through remote code execution.

Remediation: Update Fabrik to version 4.7.2 or later immediately. If immediate patching is not possible, restrict network access to Joomla installations using affected Fabrik versions.

NIST NVD: new high/critical CVEs (7 days)CVSS 10EPSS 0.4%View at sourceCheck on VirusTotal