Rosetta Daily · Sep 5, 2026
Three of today's entries are not new bugs but fixes that did not hold. vLLM's guard for CVE-2025-62164 wraps prompt-embedding reconstruction in a context that PyTorch 2.11.0 implements over process-global state, so two concurrent prompt parts switch it off for each other; the same project's ReDoS fix wrapped the xgrammar and outlines backends and left lm-format-enforcer compiling attacker-supplied regexes with no timeout; and MapLibre's sanitizer iterates a live attribute collection while deleting from it, so the index shift lets an adjacent
onloadsurvive (CVSS 10). The patch is where to look, not only the advisory.
Actively exploited
Google Chrome: V8 type confusion exploited in the wild, added to KEV the same day (CVE-2026-85046, CVSS 8.8)
A remote attacker gets code execution inside the sandbox from a crafted HTML page. Google shipped 12 fixes in 152.0.7977.82, and CISA added this one to the KEV catalog that day. Chromium-based browsers including Edge and Opera are affected too.
Sources: Bleeping Computer · The Hacker News · CISA
Citrix NetScaler: critical auth bypass now under attack (CVE-2026-19490)
Vulnerability intelligence firm Previdian reports in-the-wild exploitation of the auth bypass. NetScaler sits at the perimeter, so bypassing authentication means reaching the internal entry point behind it with no credentials at all. The CVE is not in the KEV catalog yet.
Sources: Bleeping Computer
[Added detail] Super Forms and Elementor Pro: Wordfence logs more than 440,000 exploit attempts (CVE-2026-14894, CVSS 9.8)
Super Forms – Drag & Drop Form Builder performs no file type validation, letting unauthenticated attackers upload files of any type. Wordfence counts attempts against this flaw together with the Elementor Pro RCE, and the combined figure is over 440,000 — campaign scale, not scattered probing.
Sources: The Hacker News
Critical vulnerabilities
ASUS Control Center: one chain from an unauthenticated HTTP request to root on every managed machine (CVE-2026-75754, CVSS 10)
An unauthorized user retrieves the encryption key over HTTP, which causes a local service to enable SSH on port 2222; hardcoded credentials then give a root shell. Control Center is the central management product, so taking it means remote control of every server, PC and workstation it manages.
Sources: NVD
MOOS / MOOS-IvP: around twenty flaws land at once in the marine autonomy middleware, worst a pre-auth heap overflow during the handshake (CVE-2026-85440, CVSS 9.3)
core-moos has no authentication in its wire protocol at all: any client can connect under an arbitrary name and run privileged operations including DB_CLEAR (CVE-2026-85424). pAntler parses a MISSION_FILE message and runs its Run entries through execvp() with no authentication check, so publishing one executes arbitrary programs (CVE-2026-85427, CVSS 9.2), and iSay and uMemWatch build shell commands from unsanitized text. uFldShoreBroker and uFldNodeBroker do not verify the source of node pings or TRY_SHORE_HOST messages, so an attacker can enrol its own shore route and receive bridged vehicle traffic including sensor and control data.
FreeIPMI: five stack overflows triggered by a BMC returning more bytes than requested (CVE-2026-85504 through CVE-2026-85509, CVSS 9.8)
Versions before 1.6.19 validate no lengths when parsing FRU data, Dell OEM system-info responses, or Fujitsu SEL long text. The attack surface is the out-of-band management side: whatever answers IPMI only has to return oversized data to overflow the host running the ipmi tooling.
Sources: NVD
OpenChoreo: the cluster-gateway internal proxy authenticates no caller and is not read-only (CVE-2026-73842)
The control-plane cluster-gateway tunnels /api/proxy/, /api/exec/ and /api/wirelogs/ requests through to connected data planes' Kubernetes APIs, and its internal listener authenticates nobody. Its request validator permits mutating HTTP methods and reads of Secrets in tenant namespaces — only kube-system Secrets are blocked. The result is data-plane Secret disclosure plus arbitrary Kubernetes mutation.
Sources: GitHub Advisory
SiYuan: over twenty advisories published at once for publish mode, including two SQL injections and disclosure of the session signing key (CVE-2026-72811, CVE-2026-69083)
The backlink and mention search concatenates stored block metadata and the client keyword into a SQL statement, escaping only the double quote and not the single quote, giving both a first-order and a second-order break-out on the read-write handle (CVE-2026-72811). Method 2 of fullTextSearchAssetContent passes a client-supplied SQL statement straight through (CVE-2026-69083). Separately, /api/system/getConf returns Conf.CookieKey, the key that signs session cookies, to anonymous readers (CVE-2026-72794), alongside a long run of missing publish-access filters that leak protected document content.
Sources: GitHub Advisory · GitHub Advisory · GitHub Advisory
ConfigServer Security & Firewall: a blocked attacker is the one who gets to run commands as the Apache user (CVE-2026-67402, CVSS 9.2)
The CSF Messenger v3 HTTPS virtual host maps all of /usr/bin as CGI programs. A remote unauthenticated attacker whose address the firewall has blocked can request one of those mapped executables and run arbitrary commands. CSF is widely deployed on shared hosting and cPanel/Plesk servers. WebPros fixed it in 16.31.
Sources: NVD
Fastify: middleware and router resolve the same request to different paths, and authentication is skipped entirely (CVE-2026-85184, CVSS 9.1)
@fastify/middie decides whether to run path-scoped middleware by matching the raw request target, while the Fastify router resolves an absolute-form target to its path before dispatching. The two layers compare different strings, so an absolute-form request reaches the route handler while the authentication or authorization middleware scoped to that path never runs. In the same batch, CVE-2026-84504 (CVSS 8.1) lets a root-level property named value replace the entire request body after it passed schema validation.
MapLibre GL JS: the sanitizer deletes from the collection it is iterating, and the adjacent dangerous attribute survives (CVE-2026-85061, CVSS 10)
DOM.sanitize() iterates the live elem.attributes NamedNodeMap while removeAttributes() removes from that same collection, shifting indexes and skipping the next attribute. An attacker who controls third-party style attribution strings or user-supplied custom attributions supplies two consecutive dangerous attributes, and an onload or ontoggle passes sanitization and fires when the attribution control inserts the content. Fixed in 6.4.1.
Sources: NVD
WordPress: three plugins each give an unauthenticated path to full takeover (all CVSS 9.8)
The AI Website Builder plugin (GitHub build) 1.0.0 performs no authorization or nonce check on its REST routes, so unauthenticated attackers can install and activate plugins and themes, import content from a URL they control, and write a file into the uploads directory — remote code execution on any host that serves PHP from uploads (CVE-2026-82923). ACPT Premium through 2.0.66 has missing authorization in submit(), letting unauthenticated submissions choose the target user ID and overwrite any account's email and password, administrators included (CVE-2026-15354). Divi Ajax Filter through 5.1.2 has a local file inclusion via the custom_loop_template parameter (CVE-2026-11613).
Canva Android app: an external origin can be loaded in a privileged WebView (CVE-2026-85085, CVSS 9.6)
Before 2.376.0 the app allowed an external origin to load in a privileged WebView, so an attacker controlling that page can talk to Canva using the user's session. CVE-2026-85094 (CVSS 8.8) in the same version does not restrict the headers returned to an external origin in that WebView, giving direct access to the session.
Sources: NVD
SurrealDB: namespace parameters from the URL are applied to the session before the caller's scope is checked (CVE-2026-63735)
The route /api/{namespace}/{database}/{endpoint} takes the namespace and database from the URL and applies them to the caller's session before the endpoint is looked up or run, without checking the caller's authenticated scope — so a user in one tenant can invoke another tenant's custom API. In the same batch, CVE-2026-63733 evaluates data-modifying statements inside a PERMISSIONS ... WHERE clause with enforcement disabled, so a permission check can write to tables the caller cannot write.
Sources: GitHub Advisory · GitHub Advisory
AI security
CodeWhale: nine advisories, most of them about approval prompts that never appear (CVE-2026-75856 and others)
exec_shell is approval-gated; its sibling exec_shell_interact sends model-controlled input to a running shell with no prompt (CVE-2026-75857), and rlm_eval auto-approves an arbitrary Python string chosen by the model (CVE-2026-75858). Argument injection in git_blame and git_show gives arbitrary file read and file write without approval (CVE-2026-75912, CVE-2026-75913). The SSRF protection's DNS pinning has a TOCTOU race on resolution failure (CVE-2026-75856). And a cloned repository's own .codewhale/config.toml can override allow_shell and instructions, reading arbitrary files into the system prompt or simply turning the shell on (CVE-2026-75911, CVE-2026-75859). Fixed in 0.8.64.
Sources: GitHub Advisory · GitHub Advisory · GitHub Advisory
vLLM: two advisories exist only because the previous fix was incomplete (CVE-2026-73557, CVE-2026-73556)
The follow-up protection for CVE-2025-62164 wraps prompt-embedding reconstruction in torch.sparse.check_sparse_tensor_invariants(), but PyTorch 2.11.0 implements that context with save/enable/restore over process-global state — two concurrent prompt-embedding parts overwrite each other's state and the guard is gone (CVE-2026-73557). The ReDoS fix added a compile timeout to the xgrammar and outlines backends and missed lm-format-enforcer, which still compiles the attacker-supplied regex with no timeout and no buildability check (CVE-2026-73556). The same batch includes internal path and username disclosure through validation error messages (CVE-2026-73555) and derender endpoints that decode caller-supplied token IDs with no output bounds (CVE-2026-71486).
Sources: GitHub Advisory · GitHub Advisory
Google Cloud Agent Development Kit: unauthenticated arbitrary file read in the builder endpoint (CVE-2026-79707, CVSS 8.7)
ADK versions 1.9.0 through 1.21.0 on Python have a path traversal in the builder endpoint, letting an unauthenticated remote attacker read arbitrary files through a crafted file_path query parameter. ADK is the kit developers build agents with, and the machines it runs on usually hold credential files next to the agent configuration.
Sources: NVD
[Added detail] GPT-6 Astra scores 100% on ExploitBench while OpenAI blocks PoC exploit requests
OpenAI formally launched Astra, describing it as state of the art on computer use, browsing, software engineering and cybersecurity. The company had already said the model reached the "Critical" cybersecurity capability threshold under its Preparedness Framework; what the launch adds is the perfect ExploitBench score and a product-side block on requests to produce proof-of-concept exploit code.
Sources: The Hacker News
Web security research
Passkeys: 39 ways in that never touch the FIDO2 cryptography
Token's research puts the attack surface outside the protocol — authentication prompts, synced credentials, enrollment, recovery, and other trust boundaries. Passkeys do remove a large class of password attacks; the flows built around them still leave 39 documented routes. An advisory published the same day is an instance of exactly this kind: SimpleWebAuthn's validateCertificatePath() stops at the first self-signed certificate it encounters, which can be one the user supplied, and returns before ever reaching the configured Apple or Google trust anchor.
Sources: Bleeping Computer · GitHub Advisory
Other
Ted: a backdoor compiled into the victims' own HAProxy builds
A previously undocumented Linux toolkit was found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named it ted in debug strings. It is not a HAProxy vulnerability — installing it requires code execution on the host first; what is worth noting is that the implant lives inside a binary the organization built itself rather than in an extra process.
Sources: The Hacker News
Invisible Unicode characters used to split lure words past email filters
Microsoft is warning about a high-volume phishing campaign that inserts invisible Unicode tag characters inside lure words such as "funding" so email filters cannot parse them. The Microsoft Security Research team notes that these characters are normally used the other way round — hidden from people while still visible to AI models; here the target is the filter.
Sources: The Hacker News
[Added detail] Identity verification firm IDScan sued over 153 million driver's licenses
Multiple lawsuits have been filed against IDScan, alleging that hackers breached the service and offered more than 153 million driver's licenses for sale. What was public before stopped at the dataset being sold on the dark web and the FBI investigating; the new development is civil litigation aimed at the identity verification provider itself.
Sources: Bleeping Computer
PostgreSQL fixes a 12-year-old logical decoding flaw (CVE-2026-6471, CVSS 7.2)
An account with the REPLICATION attribute can run arbitrary code as the operating-system user running the database server. The flaw has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. Versions before 18.6, 17.11, 16.15, 15.19 and 14.24 are affected.
Sources: The Hacker News
Plex urges an immediate update without saying what it fixed
Plex Media Server 1.43.3 and Plex Desktop 1.115.0 patch multiple security flaws. Plex did not elaborate on what they are, saying only that CVE identifiers have been requested. For self-hosted server owners this update-first-details-later shape means a shorter patching window than usual.
Sources: The Hacker News