60
Search: “U.S. Cybersecurity and Infrastructure Security Agency”
10,327 stories
60
60
60
60
60
60
60
U.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog
CISA added two exploited TrueConf Server flaws (CVE-2026-72529, CVE-2026-72530) to its KEV catalog with federal patch deadlines.
CISA added two TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-72529 (CVSS 9.3), a missing-authentication remote code execution flaw reachable on TCP port 4307, and CVE-2026-72530 (CVSS 9.5), a sandbox escape allowing code execution on the underlying host. Both flaws affect TrueConf Server versions 5.3.x through 5.5.5 and earlier, and were discovered by Vyacheslav Kopeytsev of Kaspersky ICS CERT. Under BOD 22-01, federal civilian agencies must patch CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2, 2026.
72
U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.
CISA added CVE-2026-64849, a critical unauthenticated server-side request forgery in MLflow, to its Known Exploited Vulnerabilities catalog. The flaw affects MLflow versions before 3.15.0 and allows unauthenticated attackers to reach internal services including cloud metadata endpoints, exposing temporary cloud credentials. watchTowr observed in-the-wild exploitation exfiltrating credentials and secrets, plus widespread scanning of exposed MLflow instances within hours of the CVE's assignment on August 17, 2026. MLflow is an open-source platform for managing the machine learning and AI development lifecycle with over 60 million monthly downloads.
85
60
60
60
60
60
60
60
60
U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
U.S. CISA adds Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
60
60
U.S. CISA adds Fortinet FortiOS flaw to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
CISA adds Apache Superset bug to its Known Exploited Vulnerabilities catalog
60