47
47
47
47
47
47
47
47
57
60
47
47
47
42
47
42
42
CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.
CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.
65
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.
Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.
62
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.
Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.
50
47
57
57
Exposed Vite servers are being probed for AWS and Azure credentials
F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.
F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.
65
BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
Attackers BGP-hijacked Softaculous IP space via Hetzner routing lapses to push malicious Virtualizor updates to hosting servers.
Unknown attackers hijacked the 162.55.80.0/24 prefix used by Softaculous' Virtualizor update service by abusing lax routing security at hosting provider Hetzner Online, announcing the range through AS6204, AS62390, and AS24940 with a forged but RPKI-valid origin. The hijack pulsed intermittently over roughly 33 hours, delivering modified update packages to Virtualizor servers, which lacked cryptographic code signing for updates. Softaculous says only a small number of servers were likely affected but cannot produce a definitive list, urging administrators to treat every Virtualizor server as in scope for checks.
65
Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution
NASA/JPL's AIT-GUI web console (CVSS 9.4) lacked authentication and CSRF protection, letting anyone send unauthenticated commands to spacecraft instruments; fixed in 2.5.2.
Cycode researchers found that AIT-GUI, the browser console of NASA/JPL's open-source AMMOS Instrument Toolkit, ran an HTTP server with no authentication, no session checks, and no CSRF protection on state-changing endpoints, allowing arbitrary commands to spacecraft instruments. The issue combines four weaknesses: binding to 0.0.0.0 regardless of configured host, missing authentication, missing CSRF defense, and path traversal in the /seq and /script/run endpoints. Tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, it is fixed in AIT-GUI 2.5.2. The findings came from AI-assisted code analysis confirmed with working proofs-of-concept, including a headless-browser CSRF demonstration.
46
60
42
42
2026-003: Multiple Vulnerabilities in Citrix NetScaler and Citrix ADC
Citrix NetScaler ADC and Gateway flaws enable memory information disclosure and user session mix-up; no active exploitation is observed yet.
Citrix patched CVE-2026-3055 (CVSS 9.3), an out-of-bounds read that can expose sensitive memory on systems configured as a SAML Identity Provider, and CVE-2026-4368 (CVSS 7.7), a race condition causing user session mix-up on Gateway and AAA virtual server configurations. Affected builds include NetScaler ADC and Gateway versions prior to 14.1-66.59 and 13.1-62.23. At publication there was no public evidence of active exploitation; CERT-EU recommends prioritizing internet-facing appliances, applying the Global Deny List mitigation, and terminating all sessions after patching.
55
57
42
60
57
42
57
57
57
57
42