55
Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities
60
42
55
30
35
42
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.
CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.
35
VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check
CVE-2026-80047: Hugging Face Transformers 4.49.0 through 5.8.1 writes attacker-controlled Python files to disk before the trust_remote_code consent check.
CERT/CC vulnerability note VU#456290 describes CVE-2026-80047 in the Hugging Face Transformers library, affecting versions 4.49.0 through 5.8.1. The library performs a remote module fetch and writes attacker-controlled Python files to the local disk before evaluating the trust_remote_code consent prompt, without user authorization. This violates the security contract enforced across other dynamic module-loading paths in the library. Transformers is a primary framework for training and inference across NLP, vision, audio, video, and multimodal machine learning systems.
45
60
42
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
60
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
60
60
47
60
30
47
60
57
60
60
42
47
47
60
35
47
30
55
60
55
30
42
60
Week in review: vBulletin 0-day, open source projects under attack, critical security updates galore
60
42
60
35
55