1+ week, 1+ day ago   (422+ words) No exploitation in the wild or public proof-of-concept (PoC) has been confirmed as of September 4, 2026. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no CISA-confirmed active exploitation. However, the exposure is automatable…...

1+ week, 1+ day ago   (299+ words) The breach demonstrates a pattern of targeting CI/CD platforms for supply chain compromise, credential theft, and lateral movement. The lack of timely patching, even by the vendor, highlights the importance of rapid vulnerability management in environments with access to…...

2+ week, 1+ day ago   (126+ words) Indicators of compromise include anomalous minting or burning of tokens, transactions involving vesting accounts with balances wrapping to 2^256, and the rapid creation and exploitation of vesting accounts. The exploit contracts were deployed to precomputed addresses and immediately used to trigger…...

2+ week, 5+ day ago   (209+ words) Both vulnerabilities are remotely exploitable via HTTP(S) requests to the vulnerable endpoint and require no authentication or user interaction. The attack surface is significant, with over 600 internet-exposed instances identified through search engine reconnaissance, including those hosted on Kaltura’s own infrastructure....

3+ week, 4+ day ago   (698+ words) Rescana Active Exploitation of MLflow SSRF Vulnerability (CVE-2026-64849) Enables Cloud Credential Theft and Account Compromise A critical vulnerability has been identified and is being actively exploited in MLflow, a widely used open-source platform for managing the machine learning lifecycle. The…...