Rosetta Daily · Sep 14, 2026
Two entries today are cases of a protection built at a level that cannot carry it. CrewAI's sandbox blocks module names at import time, but
ctypes.CDLL(None)loads the C library without any import statement; Socket Firewall turns off TLS verification by itself when two keys are left out of its config, so the proxy screening your dependencies accepts any certificate. Both are security tooling.
Critical vulnerabilities
CryptoPayment Gateway WordPress plugin 1.2.1–1.2.2: unauthenticated calls retrieve cleartext wallet credentials (CVE-2026-81648, CVSS 10)
One of its AJAX endpoints carries no authorization check, so unauthenticated users can invoke administrative operations directly: delete arbitrary files on the server, overwrite the payment gateway configuration, and read out stored wallet credentials — which are kept in cleartext.
Sources: NVD
Strapi 4.x through 4.26.2 and 5.x before 5.48.1: an Author role reaches a Super Admin session (CVE-2026-90561, CVSS 9.3)
The content manager's WYSIWYG preview component fails to strip script tags from rich text. A user with only Author rights stores a script in a rich text field, and it executes in an Editor's or Super Admin's session when they expand the preview pane. That is a path from the lowest editorial privilege to account takeover.
Sources: NVD
LangBot before 4.10.11: 24-bit recovery keys and an unrate-limited reset endpoint (CVE-2026-90562, CVSS 9.2)
Password recovery keys are generated with only 24 bits of entropy, and the unauthenticated reset-password endpoint applies no rate limiting. A remote attacker who knows the administrator's email can exhaust the keyspace with concurrent requests and reset the admin password. Neither flaw is fatal alone; together they are an enumerable admin takeover.
Sources: NVD
Three WordPress plugins: a nonce is present, a capability check is not (CVE-2026-88793, CVE-2026-85129, CVE-2026-74933, all CVSS 8.8)
In YouTube Embed 10.0 to 10.3, one AJAX action relies only on a nonce printed on every front-end page, performs no authorization check, and does not escape stored data. Hoo Companion 1.0.2 has neither authorization nor validation on one of its import features, and the same request destroys the site's existing theme settings. GenieWords 1.5.27 to 1.5.34 lacks authorization checks on some REST API and AJAX actions and decodes stored values before printing them. The outcome is identical in all three: scripts stored by an unauthenticated attacker execute in the session of anyone viewing the site, administrators included.
D-Link DIR-823G 1.0.2B05_20181207: stack overflow in HNAP1 static route settings (CVE-2026-90680, CVSS 9.4)
The strcpy in /HNAP1/SetStaticRouteSettings handles the PAddress, SubnetMask and Gateway arguments directly, giving a remotely triggerable stack-based buffer overflow.
Sources: NVD
Totolink A3002MU: four overflows in the boa service, all with public exploits (CVE-2026-90605 through CVE-2026-90608, all CVSS 8.6)
ip6addr in formFilter, static_ipv6 in formIpv6Setup, submit-url in formNewSchedule, service_type in formPortFw — four arguments, four buffer overflows, all reachable remotely. All four NVD records state that exploit code is public.
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35–2.37: certificate validation can be bypassed (CVE-2026-90647, CVSS 9.1)
The IEC 60870-5-104 TLS client (Task Mode) lets validation pass for a certificate carrying multiple simultaneous faults, allowing a network-positioned attacker to run a man-in-the-middle against protected communications. This is test equipment used on power-grid protocol links.
Sources: NVD
AI security
CrewAI before fb2323b: an import-time module name blocklist cannot govern the in-process object graph (CVE-2026-37008, CVSS 8.1)
CrewAI sandboxes with a Python module name blocklist, but the blocking happens at the import layer. ctypes.CDLL(None) loads the C library without going through any import statement, so the blocklist is effectively absent. NVD states this is a different vulnerability from CVE-2026-2275 — the earlier fix changed the contents of the list, while this one points at the level itself: a within-process sandbox cannot merely account for imports.
Sources: NVD
ESPnet before 202609: pretrained checkpoints loaded with weights_only=False (CVE-2026-90777, CVSS 8.7)
The initialization and fine-tuning paths call torch.load with weights_only disabled, so an attacker-supplied checkpoint file executes code during deserialization.
Sources: NVD
Other
Socket Firewall in registry mode before 2.0.0: upstream TLS certificates unverified by default (CVE-2026-90651, CVSS 8.1)
When the api_ssl_verify and upstream_ssl_verify keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests then accepts any certificate. This is a proxy whose job is screening dependency packages.
Sources: NVD
Spug through 3.4.0: monitor addresses interpolated straight into a shell command (CVE-2026-90770, CVSS 8.7)
ping_check inserts a user-supplied monitor address into a shell command without validation. An authenticated user holding monitor permissions can inject shell metacharacters via /monitor/run_test/ and execute arbitrary commands as the Spug process user.
Sources: NVD
rustypaste before 0.18.1: the path is validated, then the custom filename is applied (CVE-2026-90774, CVSS 8.7)
Validation of the destination path happens before the optional custom filename HTTP header is applied. An attacker puts path traversal sequences in that header and writes files anywhere outside the configured upload directory — get the order wrong and the check means nothing.
Sources: NVD
Amundsen through 4.3.0: table and dashboard descriptions rendered without sanitization (CVE-2026-90772, CVSS 8.3)
ResourceListItem components render table, dashboard and feature descriptions with dangerouslySetInnerHTML and no HTML sanitization. Markup such as an img element with an onerror handler, written into a description via the metadata service or Elasticsearch, executes in the browser of every user who views search results.
Sources: NVD
Open Notebook before 1.11.0: the URL parameter on POST /api/sources is not validated (CVE-2026-90769, CVSS 8.3)
Authenticated users can submit arbitrary URLs for the application server to fetch, reading cloud metadata, internal network services and services bound only to localhost.
Sources: NVD
SIPp through 3.7.7: three buffer overflows (CVE-2026-90778, CVE-2026-90779, CVE-2026-90780, all CVSS 8.7)
get_header() handling header content above 20,490 bytes and get_peer_tag() handling To-header tag parameters of 2,049 bytes or more are both reachable by crafted messages from an unauthenticated remote attacker; createAuthHeader() corrupts the stack on an oversized algorithm parameter in a 401 or 407 challenge returned by a malicious SIP server. NVD describes the consequence in all three as a process crash.
MKVToolNix through 101.0: 32-bit integer wraparound in AVI parsing (CVE-2026-90783, CVSS 8.5)
The bundled avilib library's ODML superindex parser wraps around in 32-bit arithmetic. A crafted AVI file trades oversized entry counts for an undersized heap allocation, and mkvmerge writes past it while parsing.
Sources: NVD
Internet Download Manager through 6.42 Build 63: improper access control in a kernel driver, vendor silent (CVE-2026-90493, CVSS 8.5)
idmwfp.sys on Windows has improper access controls, local access is required, and exploit code is public. The NVD record states the vendor was contacted early in the disclosure and never responded in any way.
Sources: NVD
Actively exploited
[Added detail] Tencent Sogou Input Method: the exploited flaw is now identified as CVE-2026-51990
The Sogou Input Method for Windows flaw used to deploy the GRAYRABBIT backdoor now carries a CVE number and a critical rating. It is not yet in the CISA KEV catalog.
Sources: Bleeping Computer