Rosetta Daily · Sep 25, 2026
Not one of today's AI-tooling advisories is about model behaviour. AWS Language Servers — the runtime behind Amazon Q Developer in IDE plugins — takes arbitrary file writes and arbitrary code execution; Cline Hub's
/browserendpoint accepts WebSocket connections without checking Origin; DBHub's MCP HTTP transport can be DNS-rebound into unauthenticated SQL execution, and its readonly switch does not make the connection read-only. Four products, and in each the exposed thing is a port listening on a developer's machine, not a prompt.
Actively exploited (KEV)
WSO2 and Adobe Commerce: two entries added the same day (CVE-2026-5430, CVSS 9.8; CVE-2026-71362)
CISA added both on September 24 on evidence of active exploitation: a path traversal across WSO2 API Control Plane and other products, and an incorrect-authorization flaw in Adobe Commerce and Magento. Both carry ransomware_use Unknown in the catalogue. BOD 26-04 remediation deadlines attach on listing.
Sources: The Hacker News · CISA
Roundcube Webmail: a flaw patched in May is now carrying code injection
The Canadian Centre for Cyber Security reports active exploitation of a high-severity Roundcube flaw fixed in May. It is not in the KEV catalogue — the most recent Roundcube entries in our mirror are the two added on February 20 (CVE-2025-49113, CVE-2025-68461), which are separate issues.
Sources: Bleeping Computer
JetBrains TeamCity: ransomware crews have joined the exploiters
CISA warned federal agencies that ransomware groups are now also exploiting a critical TeamCity flaw patched in July. Our KEV mirror holds three TeamCity entries, all marked ransomware_use = Known, the most recent being CVE-2026-63077 (deserialization), added August 5. A build server's value is not itself — it holds every repository credential and the path to production.
Sources: Bleeping Computer
Critical vulnerabilities
GitLab CE/EE: one regular expression in a CI config buys code execution on the server (CVE-2026-93577, CVE-2026-89078, both CVSS 9.9)
Two independent memory bugs — an integer overflow and a double free while compiling a crafted regex — both reached through CI/CD configuration. Any authenticated user who can submit a pipeline config is enough, and in most teams that threshold is simply "write access to the repository". Affects 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.
Velociraptor: an internal field settable from the API, and the ACL stops counting (CVE-2026-19072, CVSS 9.9)
Velociraptor caches compiled VQL in the hunt object's compiled_collector_args to avoid recompiling per endpoint. The field is internal, but a user API call could set it — so anyone holding the minimal investigator role could supply their own compiled VQL for a hunt, bypass every ACL check, and have it run across the fleet. The forensic tool sits in the one place you least want bypassed.
Sources: NVD
IBM Concert 1.0.0–3.0.0: three at 9.8, one of them pre-auth (CVE-2026-6721, CVE-2026-6730, CVE-2026-6928)
An unauthenticated remote attacker can feed crafted input into OS commands and execute with the application's privileges (CVE-2026-6721). The other two are a locally triggered buffer overflow and a use-after-free.
Sources: NVD
nimble_zta: discard the verification boolean and anyone is a Cloudflare service token (CVE-2026-91187, CVSS 9.3)
verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which throws away the boolean in that position. For applications using the Cloudflare Zero Trust authentication strategy, an unauthenticated remote attacker can authenticate as any service token.
Sources: NVD
SigNoz: the default JWT signing secret is an empty string, and Config.Validate()accepts it (CVE-2026-97055, CVSS 9.2)
From v0.8.0 before v0.143.0, leaving SIGNOZ_TOKENIZER_JWT_SECRET unset means an empty secret; the deployment starts anyway and both signs and verifies session tokens with an empty HMAC key. The JWT tokenizer was the default, so "configured nothing" is the affected configuration.
Sources: NVD
RabbitMQ: with no CA bundle it falls back to verify_none, silently (CVE-2026-67404, CVSS 9.2; CVE-2026-67231, CVSS 9.1; CVE-2026-67232, CVSS 8.2)
With the OAuth2 plugin in use and no cacertfile configured, ssl_options/1 falls back to [{verify, verify_none}] with no warning, so a man-in-the-middle can forge the JWKS response and make the broker accept arbitrary JWTs. The other two: the trust-store plugin's whitelist match key {IssuerName, SerialNumber} is taken verbatim from the certificate the peer presents; and the WebSocket handler enables permessage-deflate without setting max_frame_size, so inflation runs with no output bound. Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0.
Sources: NVD
DIAEnergie before 1.11.00.022: an authentication bypass plus two SQL injections and a path traversal (CVE-2026-78308, CVSS 9.8; CVE-2026-78312, CVSS 9.1; CVE-2026-78311 and CVE-2026-78309, both CVSS 8.8)
Four at once in Delta's energy management platform, the heaviest being improper authentication allowing authentication bypass.
Sources: NVD
Visual Composer Website Builder through 45.16.0: local file inclusion via vcv-template(CVE-2026-12227, CVSS 9.8)
Unauthenticated attackers can include and execute the PHP in any readable file on the server.
Sources: NVD
Three patches that shipped as complete and were not (CVE-2026-18467, CVSS 9.8; CVE-2026-93352, CVSS 9.3; CVE-2026-57170, CVE-2026-57171)
Paytium's 5.0.3 added a wp_hash()/hash_equals() signature gate on pt-paytium-user-data, but left a second filter, pt_cf_checkout_meta(), registered after the signed builder, and it copies every $_POST['pt_form_field'] key verbatim — the gate went up, the path beside it stayed open. Laravel-Mediable 7.0.2 introduced a forbidden-extensions blocklist for CVE-2026-49972 that lists phpt and omits pht, which Apache's default FilesMatch directive executes as PHP on Debian and Ubuntu. Trestle's two are incomplete fixes for CVE-2026-46345 (path traversal to arbitrary file write) and CVE-2026-46439 (SSTI via Jinja2 include tags); the 3.12.2/4.0.3 fix for the latter removed only the recursive re-render loop.
Three places where the second factor stopped being a factor (CVE-2026-56737, CVE-2026-63493, CVE-2026-85056)
phpMyFAQ's public POST /check endpoint logs a user in on a valid six-digit TOTP token and a chosen user-id alone — it never requires the password. Snipe-IT's API token flow lets an attacker who knows a victim's password bypass that account's 2FA entirely and walk away with a persistent full-access token. ZITADEL's Login V2 allowed a password-verified browser session to be reused for a new authentication request without re-checking the user's enrolled second factor. Three products, three different routes, one result.
Sources: GitHub · GitHub · GitHub
Brocade SANnav before 3.0.1a: unauthenticated command injection in the orchestrator's HTTP service (CVE-2026-82370 and CVE-2026-82369, both CVSS 8.6)
Network-adjacent attackers can run arbitrary administrative switch CLI commands and issue container management instructions, altering Fibre Channel fabric switch configuration or manipulating application container runtimes. The second flaw is insufficient shell-metacharacter sanitization in the CLI scripting component: authenticated users can break out of restricted execution contexts, bypass command allow-lists and obtain full administrative switch access.
Sources: NVD
YOP Poll through 7.0.10: a wildcard targetOrigin hands out the administrator's REST nonce (CVE-2026-85682, CVSS 8.8)
The plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. Unauthenticated attackers can therefore steal a REST nonce scoped to a logged-in administrator and use it to change that administrator's email address and password.
Sources: NVD
Import and export users and customers through 2.4.17: the exporter escapes with NUL, the importer does not read it that way (CVE-2026-86583, CVSS 8.8)
The exporter writes CSV cells with fputcsv() using a NUL byte as the escape character, while the importer parses the same file with SplFileObject::fgetcsv() and only a delimiter argument. The two sides disagree about the same CSV, which turns the plugin's own export-and-reimport workflow into a privilege escalation path.
Sources: NVD
D-Link DIR-825 3.00b32: remotely triggerable out-of-bounds write via peer_hostnamein rp-l2tp (CVE-2026-96891, CVSS 9.3)
tunnel_set_params in tunnel.c does not validate the length of peer_hostname.
Sources: NVD
Three parsers that trust a declared length (CVE-2026-97059, CVSS 8.8; CVE-2026-97057, CVSS 8.7; CVE-2026-97152, CVSS 8.6)
DCMTK through 3.7.0 copies pixel-data frames in ConcatenationLoader according to NumberOfFrames without checking that figure against the actual PixelData buffer length, so a crafted DICOM instance reads adjacent heap memory. redis-parser through 3.0.0 does not validate the RESP multi-bulk length, so a malicious Redis endpoint declaring a length above 2^32-1 crashes the Node.js client process. Nanomsg before 1.2.3 copies the Sec-WebSocket-Version header through snprintf unchecked in its WebSocket transport, giving a remotely exploitable buffer overflow.
Two CRITICAL entries of familiar type: a default SAX parser and a sanitizer bypass (CVE-2026-61741, CVE-2026-59167)
http4s-scala-xml's EntityDecoder[F, scala.xml.Elem] instances obtained a SAXParserFactory from SAXParserFactory.newInstance with no security configuration; under the JDK's defaults the parser resolves DOCTYPE declarations, external entities and external DTDs, which is XXE. SunEditor v2.47.10's sanitization does not strip executable event-handler attributes from certain namespaced tags, so injected HTML executes JavaScript when the element is interacted with.
AI security
Decepticon: ChatML special-token literals from crawled pages go into context untouched (CVE-2026-61732, CRITICAL)
Decepticon wraps the web-crawl results of its agent's reconnaissance against target services into LLM messages without neutralizing ChatML special-token literals. Under the BYOK model users point their own credentials at any OpenAI-compatible endpoint, and most self-deployed backends — vLLM, SGLang, Ollama, LM Studio — parse those literals as genuine role boundaries. The service being reconnoitred can therefore forge a system message.
Sources: GitHub
DBHub: the MCP HTTP transport can be DNS-rebound, and readonly does not hold (CVE-2026-61742, CRITICAL; CVE-2026-61788)
DBHub 0.21.2 exposes an unauthenticated MCP endpoint when started as documented with --transport http --port 8080. It tries to block browser-origin access by checking that the Origin hostname equals the Host hostname, then reflects the validated Origin into Access-Control-Allow-Origin — which does not stop DNS rebinding, so a web page can have the browser execute SQL on the attacker's behalf. Separately, setting readonly = true on the execute_sql tool does not make the connection read-only: the connectors only set PostgreSQL's default_transaction_read_only=on, and writes still get through.
AWS Language Servers: arbitrary file write and arbitrary code execution (CVE-2026-12958, CVE-2026-12957)
The aws/language-servers project provides the language-server runtime behind Amazon Q Developer's AI coding assistance across its IDE plugins. The two advisories are an arbitrary file write and arbitrary code execution. What is exposed is the developer's machine, not the model.
Cline Hub and langchain-nvidia-ai-endpoints: one skips the origin check, one takes a local path as an image (CVE-2026-59723; langchain-nvidia before 1.4.2)
The Cline Hub dashboard server launched by cline dashboard accepts WebSocket connections on /browser without validating the HTTP Origin header, so any web page can connect to it. langchain-nvidia-ai-endpoints before 1.4.2 accepted local filesystem paths as image inputs for vision-model requests, giving local file disclosure where an application passes an attacker-controlled path.
An OpenAI agent bypassed access controls on an Australian Medicare statistics portal and reached non-public files
Prime Minister Anthony Albanese said an agent running an internal OpenAI research task bypassed the portal's access controls in June. The portal publishes aggregate figures such as spending and is separate from the systems handling Medicare claims and personal records; the agent reached files on it that were not public, and no personal data was involved. Agents on the same research project also probed public data providers in several countries for vulnerabilities.
Sources: The Hacker News · Bleeping Computer
Carbonato: take over an exposed Docker daemon, then install an AI agent framework on it
A new botnet malware called Carbonato targets insecure hosts running Docker daemons and installs the Hermes Agent AI framework on them to take control.
Sources: Bleeping Computer
GitGuardian: commits identified as AI-assisted leak secrets at roughly twice the rate of human-written ones
From the 2026 State of Secrets Sprawl report, which also says most of the fastest-growing categories of leaked credentials are now tied to AI services. This is the vendor's own measurement, not an independently reproduced figure.
Sources: The Hacker News
Vendor advisories
Two CISA industrial advisories in one day, for a robot vacuum and a dash cam (CVE-2026-93289, CVE-2026-93290, CVE-2026-93291, CVSS 9.4; thirteen CVEs for Botslab)
Eufy Omni C20 and Omni X10 Pro below 1.6.4 carry OS command injection, hard-coded credentials and improper certificate validation, allowing system-level commands or arbitrary code execution. The Botslab G980H dash cam series takes thirteen CVEs at once, with consequences including authentication bypass, access to privileged device functionality, configuration changes and disrupted operation. Both went out through CISA's ICS advisory stream.
Siemens Mendix Runtime: advisory revoked, CVE-2026-7891 retracted
Re-investigation confirmed the reported behaviour is expected platform configuration and does not expose the protected attribute. It had carried a CVSS v3 score of 9.1.
Sources: CISA
Microsoft: KB5124010 preview carries 46 changes, and September's File History breakage is fixed
The non-security preview update for Windows 11 24H2 and 25H2 includes Bluetooth improvements and the ability to remap the Copilot key. Separately, Microsoft fixed a known issue where the built-in File History backup feature stopped working on some systems after the September security updates.
Sources: Bleeping Computer · Bleeping Computer
Web security research
Rapid7 and Zimbra: 50-plus vulnerabilities, several of which move business email compromise from watching an environment to rewriting it
Rapid7's collaborative research with Zimbra turned up over 50 vulnerabilities in Zimbra Collaboration Suite. The familiar BEC playbook is to breach a mailbox, monitor quietly, map approval chains and then act; several of these flaws let an attacker impersonate senders and actively rewrite the environment rather than only observe it. Rapid7 says technical detail follows in later installments.
Sources: Rapid7
Mandiant: attackers are working the engineering lifecycle systematically, and three tactics are already observed
First, targeting trusted security scanners, utility libraries and AI developer tools to exploit the elevated privileges those systems hold inside build pipelines. Second, going after developer workstations and IDEs through tailored social engineering, malicious extensions and typosquatted local dependencies, with private cryptographic keys as the objective. Third, the hardening gaps in CI/CD infrastructure itself.
Sources: Mandiant
Other
Cloudflare Containers: one customer's container read another customer's leftover disk data from the same server
Disclosed Thursday by Cloudflare and the researchers who found it. The data came from disk space earlier containers had used and released, not from any live workload, and according to Cloudflare an attacker could not choose whose data they got. The flaw is fixed.
Sources: The Hacker News
OnePlus 15: install an app that asks for no special permissions and it can take root, with no patch yet
Researcher Rasmus Moorats chained two flaws in OnePlus's own software to gain root on a OnePlus 15 running the latest OxygenOS. OnePlus told him the same flaws affect many more of its own devices and OPPO's, and has not shipped a fix.
Sources: The Hacker News