Rosetta Daily · Aug 24, 2026
Scanned 31 sources, curated 12 key items from 233 raw items collected in the last 36 hours.
Critical Vulnerabilities
NLTK (Python NLP library) batch disclosure: missing supply-chain integrity check, sandbox bypass, deserialization RCE (up to CVSS 9.3)
Researchers disclosed roughly a dozen vulnerabilities in NLTK versions before 3.10, including a missing package-integrity check in the downloader module (CVE-2026-63310, CVSS 9.3 — attackers can inject malicious packages via MITM or DNS poisoning), an incomplete allowlist check in AllowlistUnpickler leading to deserialization RCE (CVE-2026-71513, CVSS 8.7), and a default ENFORCE=False setting that silently disables all path-security checks (CVE-2026-62388, CVSS 8.7). NLTK is a dependency across many NLP/AI pipelines, making the supply-chain gap especially notable.
Joomla Fabrik extension: batch of critical flaws — unauthenticated RCE, SQL injection, path traversal (up to CVSS 10.0)
Fabrik before 4.7.2 shipped a fix for a cluster of critical bugs: unauthenticated RCE via the image element (CVE-2026-76605, CVSS 10.0), unauthenticated RCE via the PHP form element (CVE-2026-76604, CVSS 10.0), a missing ACL check on the download element (CVE-2026-76607, CVSS 10.0), and SQL injection via the list ORDER BY parameter (CVE-2026-76602, CVSS 9.3). Sites running Fabrik should upgrade to 4.7.2 promptly.
WS Form LITE (WordPress plugin) PHP Object Injection (CVE-2026-4703, CVSS 9.8)
Versions up to 1.10.80 are vulnerable to PHP Object Injection via deserialization of untrusted input. The plugin is widely used to build contact forms.
Sources: NVD
Mailgun for WordPress SSRF via path traversal (CVE-2026-78003, CVSS 9.8)
Versions up to 2.2.0 have insufficient input validation, letting attackers trigger server-side request forgery.
Sources: NVD
Google Cloud Application Integration missing authorization check (CVE-2026-12710, CVSS 9.3)
The QueryEngineTask component (versions from 2025-04-28 to 2026-04-04) is missing an authorization check, letting an external attacker access sensitive internal data.
Sources: NVD
TRENDnet TEW-821DAP router command injection (CVE-2026-77946, CVSS 9.3)
The uci_safe_get function in the NTP timezone configuration component is vulnerable to command injection, affecting firmware 2.2.01b05.
Sources: NVD
Netty disables TLS hostname verification on the OpenSSL provider client path (CVE-2026-62243, CVSS 8.7)
netty-handler 4.1.x/4.2.x skips hostname verification for plain-socket connections when using SslProvider.OPENSSL, opening a path to man-in-the-middle attacks. Netty underpins networking in a large share of the Java ecosystem.
Sources: NVD
AI Security
Note-taking app SiYuan's MCP tools leak secrets and allow arbitrary file deletion (up to CVSS 8.4)
SiYuan before 3.8.0 interpolates secret placeholders into the destination URL of its http_request MCP tool, letting an MCP client exfiltrate stored secrets (CVE-2026-59809); the /api/search/removeTemplate endpoint fails to validate a path parameter, enabling arbitrary file deletion (CVE-2026-60084, CVSS 8.4); and the MCP file tool's path blocklist is incomplete (CVE-2026-60083). This is a rare concrete case of a vulnerability targeting an MCP (Model Context Protocol) toolchain directly.
Other
Password-cracking tool hashcat has multiple memory-safety and command-injection flaws (up to CVSS 8.5)
A heap buffer overflow in outfile_write(), a one-byte out-of-bounds write in fgetl(), and unrestricted command-line option parsing when loading restore files let attackers craft a restore file that injects options like --outfile (CVE-2026-68766, CVSS 8.5).
Sources: NVD
ToxicPanda Android malware expands, uses VPN permissions to block Google Play
The malware family now targets 349 apps and supports 167 remote commands, up from earlier versions.
Sources: Bleeping Computer
Supply-chain attack infects Android car head units with proxy-botnet malware
Attackers are abusing a legitimate device-update app as a distribution channel, enlisting compromised units in a proxy botnet or other malicious uses.
Sources: Bleeping Computer
TikTok agrees to $400 million settlement in US child-privacy lawsuit
The DOJ announced ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit alleging violations of children's privacy law.
Sources: The Hacker News