24h | 7d | 30d

CVE-2026-116690

Overview

  • mlflow
  • mlflow
27 Oct 2026
Published
28 Oct 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.56%
KEV

Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

An MLflow vulnerability, CVE-2026-116690, is exploited in the wild as proof-of-concept code for it and RCE flaw CVE-2026-116692 goes public. Patch now.

securityonline.info/mlflow-vul

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-103406

Overview

  • Juniper Networks
  • Session Smart Conductor
28 Oct 2026
Published
28 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
Pending
KEV

Description

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Juniper security bulletin fixes 18 Session Smart Router vulnerabilities, including CVSS 9.8 flaws CVE-2026-103406 and CVE-2026-103409. Update now.

securityonline.info/juniper-se

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-116692

Overview

  • mlflow
  • mlflow
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.70%
KEV

Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

An MLflow vulnerability, CVE-2026-116690, is exploited in the wild as proof-of-concept code for it and RCE flaw CVE-2026-116692 goes public. Patch now.

securityonline.info/mlflow-vul

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-93865

Overview

  • WatchGuard
  • Fireware OS
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
0.46%
KEV

Description

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

Statistics

  • 1 Post
Last activity: 18 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

WatchGuard fixes 18 Fireware OS vulnerabilities on the Firebox firewall, including critical CVE-2026-103594 (CVSS 9.5). Upgrade to 2026.4 now.

securityonline.info/watchguard

  • 0
  • 0
  • 0
  • 18h ago

CVE-2026-0257

Overview

  • Palo Alto Networks
  • Cloud NGFW
13 May 2026
Published
15 Oct 2026
Updated
CVSS v4.0
HIGH (7.8)
EPSS
95.01%
KEV

Description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

Statistics

  • 1 Post
Last activity: 2 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Spiderlabs~ Q3 attackers increasingly abused trusted access to steal data, with exfiltration in 83% of intrusions. - IOCs: CVE-2026-72898, CVE-2026-0257 - #CVE-2026-72898 #DataExfiltration #ThreatIntel
  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-103409

Overview

  • Juniper Networks
  • Session Smart Router
28 Oct 2026
Published
28 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
Pending
KEV

Description

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Juniper security bulletin fixes 18 Session Smart Router vulnerabilities, including CVSS 9.8 flaws CVE-2026-103406 and CVE-2026-103409. Update now.

securityonline.info/juniper-se

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-72898

Overview

  • Metabase
  • Metabase
10 Aug 2026
Published
12 Aug 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
98.55%
KEV

Description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Statistics

  • 1 Post
Last activity: 2 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Spiderlabs~ Q3 attackers increasingly abused trusted access to steal data, with exfiltration in 83% of intrusions. - IOCs: CVE-2026-72898, CVE-2026-0257 - #CVE-2026-72898 #DataExfiltration #ThreatIntel
  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-115884

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
The CyberSec Guru @guru

GoAhead TLS Vulnerabilities Explained: CVE-2026-115881 and CVE-2026-115884

Three GoAhead embedded web server TLS vulnerabilities, explained with code: a missing CRL check, a chain-depth bypass and a one-byte DH prime. Fixed in 6.1.1

thecybersecguru.com/news/goahe

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-111585

Overview

  • TeamViewer
  • Full Client
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
0.29%
KEV

Description

An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 11 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update to TeamViewer 15.83 to patch three high-severity TeamViewer vulnerabilities: CVE-2026-92372, CVE-2026-111585, and CVE-2026-92374.

securityonline.info/teamviewer

  • 0
  • 1
  • 0
  • 11h ago

CVE-2026-92372

Overview

  • TeamViewer
  • Full Client
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
0.43%
KEV

Description

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 11 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update to TeamViewer 15.83 to patch three high-severity TeamViewer vulnerabilities: CVE-2026-92372, CVE-2026-111585, and CVE-2026-92374.

securityonline.info/teamviewer

  • 0
  • 1
  • 0
  • 11h ago
Showing 71 to 80 of 93 CVEs