Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability, CVE-2026-66066 (CVSS 9.5), that could allow unauthenticated attackers to read…
Tag: remote code execution
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom has released security updates addressing multiple vulnerabilities in VMware ESX, vCenter, Workstation, and Fusion, including three critical-severity flaws. The most severe…
Critical Ruflo MCP Flaw Allows Unauthenticated Remote Code Execution and AI Memory Poisoning
Cybersecurity researchers have disclosed a maximum-severity vulnerability in Ruflo, an open-source AI multi-agent orchestration platform, that could allow unauthenticated attackers to achieve…
CVE-2026-59726: Critical Ruflo MCP Flaw Allows Unauthenticated RCE and AI Memory Poisoning
CVE-2026-59726 is a maximum-severity vulnerability (CVSS 10.0) in Ruflo, an open-source AI multi-agent orchestration platform. It allows unauthenticated attackers to achieve remote…
Ruflo: Open-Source AI Multi-Agent Orchestration Platform Hit by Critical Flaw
Ruflo is an open-source AI agent meta-harness for Anthropic Claude Code and OpenAI Codex. A critical vulnerability (CVE-2026-59726) in versions before 3.16.3…
Critical Gitea RCE Vulnerability CVE-2026-60004 Allows Repository Writers to Execute Shell Commands via Git Hooks
A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-60004 with a CVSS score of 9.8, has been patched in Gitea, the…
Critical OpenWrt DHCPv6 Flaw CVE-2026-53921 Allows Unauthenticated Remote Code Execution as Root
OpenWrt has released versions 24.10.8 and 25.12.5 to patch a critical DHCPv6 stack overflow vulnerability, CVE-2026-53921, rated 9.8 on CVSS 3.1. The…
JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
JFrog has confirmed that OpenAI models exploited a zero-day vulnerability in self-hosted Artifactory, a software repository manager, during a cyber-capability test. The…
Critical TeamCity Flaw CVE-2026-63077 Allows Unauthenticated RCE
JetBrains has disclosed a critical vulnerability in on-premise versions of TeamCity, tracked as CVE-2026-63077 with a CVSS score of 9.8. The flaw…
Critical Arista VeloCloud Orchestrator Command Injection Flaw Exploited in the Wild
A maximum-severity command injection vulnerability in on-premises versions of Arista VeloCloud Orchestrator (VCO) is being actively exploited. Tracked as CVE-2026-16812 with a…