Critical MLflow Vulnerability Exploited by Hackers: CISA Issues Alert
PremiumCISA warns threat actors are actively exploiting a critical MLflow flaw to steal cloud credentials and internal data.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesFriday, August 21
Wednesday, August 19
Microsoft Races to Patch ShieldBreak Zero-Day Vulnerability in Defender
Microsoft developing a Defender patch for ShieldBreak zero-day (CVE-2026-69414) disclosed by researcher 'Nightmare Eclipse'.
Critical Vulnerability in macOS Screen Sharing Allows Unauthorized Root Access
CVE-2026-43760 logic flaw in macOS Screen Sharing can be exploited to execute commands as root via file-copy helpers.
GitLab Faces Critical Security Flaw with Urgent Remediation Needed
CVE-2026-19478 zero-click GitLab vulnerability lacks technical details, complicating detection for self-managed deployments.
Microsoft Copilot Vulnerability: Data Exfiltration Risks Uncovered
CoSnitch vulnerabilities in Microsoft Copilot Personal let a crafted link exfiltrate connected-app data with a single click.
GitLab Addresses Critical Vulnerabilities in Latest Security Update
GitLab fixed a critical code injection flaw allowing unauthenticated actors to modify or delete user data and public projects.
Unisoc Chipsets Vulnerable to Exploit Chain Granting Full Kernel Access
Two-stage Unisoc VoLTE exploit chain achieves full Android kernel access via a specially crafted video call payload.
Critical Software Vulnerability Exposes NASA Ground Systems to Unauthorized Access
Critical AIT-GUI vulnerabilities allow unauthenticated attackers to issue spacecraft commands and manipulate ground-control scripts.
Massive Security Flaw in WordPress Plugin Leaves 300,000 Sites Vulnerable
CVE-2026-15748 arbitrary file upload bug in a WordPress form plugin lets unauthenticated attackers upload executable files on ~300,000 sites.
CISA Warns of Ransomware Abuse of Windows Task Host Vulnerability
CISA confirms ransomware groups are exploiting a high-severity Windows Task Host vulnerability previously flagged as actively exploited.
CISA Highlights Critical Flaw in Ray Framework Amid Active Exploitation
CISA added a critical Ray vulnerability to its Known Exploited Vulnerabilities catalog due to observed active exploitation.
Critical Vulnerability in MLflow Exploited for Credential Theft
Active exploitation of MLflow SSRF (CVE-2026-64849) leads to cloud credential and secret theft from ML deployments.
Monday, August 17
Urgent Patching Required for SharePoint, Winsock, and VMware vCenter Vulnerabilities
PremiumSANS warns of exploited flaws in SharePoint, Winsock, VMware vCenter, and other vendor vulnerabilities requiring urgent patching.
Critical Security Flaws Uncovered Across Major Tech Firms
PremiumNewsletter outlines multiple critical zero-days (Cisco, Windows), Outlook RCE, and high-profile vendor patches and incidents this week.
GeoServer Zero-Day Vulnerability: Immediate Exploitation Risks Highlighted
PremiumAn unpatched GeoServer SQL-injection zero-day is being exploited in the wild, potentially enabling remote code execution and data theft.
Metabase Zero-Day Exploit Exposes Salesforce and ServiceNow Portals for 17 Months
PremiumMetabase zero-day impacted Salesforce and ServiceNow portals, exposing long-running data leakage and authentication bypass risk to enterprise tenants.
Massive Bank Fraud Uncovered: Vulnerability in Software Exploited
PremiumThreat actors exploited a service-provider vulnerability to withdraw funds in a massive bank fraud affecting multiple customers and banking services.
SAP Commerce Cloud Vulnerability Under Siege: Immediate Action Required
PremiumMaximum-severity RCE (CVE-2026-58231) in SAP Commerce Cloud is being actively probed and targeted shortly after patch release.
Friday, August 14
Gunra Ransomware Exploits Fortinet Flaws to Breach Critical Infrastructure
PremiumGunra actors exploit Fortinet vulnerabilities to exfiltrate large volumes of Microsoft service data, targeting critical infrastructure.
Federal Agencies Urged to Patch Critical Microsoft Vulnerability Amid North Korean Cyber Threat
PremiumCISA ordered federal agencies to patch a Microsoft bug exploited in a long-running DPRK job-application campaign within two weeks.
Get these articles delivered to your inbox.
Subscribe free