Monthly
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Proxy settings hijack in Autodesk Fusion Desktop (versions 2705.0.0 through 2705.1.10) allows a maliciously crafted add-in to silently overwrite the application's persistent network proxy configuration without user notification or consent, redirecting all authenticated Fusion network traffic through an attacker-controlled intermediary. The root cause is CWE-15 (External Control of System or Configuration Setting) - Fusion's add-in API imposes no authorization check or user-consent requirement on proxy configuration writes, and the modified setting persists across sessions. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; Autodesk has released a fix in version 2705.1.11 under advisory ADSK-SA-2026-0016.
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. OpenAI has issued a source-level fix via PR #22652 adding -c core.fsmonitor=false to the relevant Git invocations; no public exploit code has been identified at time of analysis.
Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. No public exploit is identified at time of analysis and EPSS is low (0.14%), but the outcome is full local compromise of the user's files and credentials.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.
Unauthorized configuration write in Dashy self-hosted dashboard (versions prior to 4.0.8) lets unauthenticated users or non-admin authenticated users overwrite the central config.yaml via the config-saving endpoint when the deployment uses OIDC authentication, bypassing configured permission controls. Successful abuse enables tampering with dashboard configuration and potential service disruption. No public exploit identified at time of analysis; not listed in CISA KEV.
Authenticated remote code execution affects HAX CMS PHP backend versions prior to 26.0.0, where attackers with valid credentials can configure malicious Git filter commands to overwrite files and execute arbitrary code on the server. The flaw carries a CVSS 4.0 score of 9.4 due to full compromise of confidentiality, integrity, and availability with cascading subsequent system impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Proxy settings hijack in Autodesk Fusion Desktop (versions 2705.0.0 through 2705.1.10) allows a maliciously crafted add-in to silently overwrite the application's persistent network proxy configuration without user notification or consent, redirecting all authenticated Fusion network traffic through an attacker-controlled intermediary. The root cause is CWE-15 (External Control of System or Configuration Setting) - Fusion's add-in API imposes no authorization check or user-consent requirement on proxy configuration writes, and the modified setting persists across sessions. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; Autodesk has released a fix in version 2705.1.11 under advisory ADSK-SA-2026-0016.
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. OpenAI has issued a source-level fix via PR #22652 adding -c core.fsmonitor=false to the relevant Git invocations; no public exploit code has been identified at time of analysis.
Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. No public exploit is identified at time of analysis and EPSS is low (0.14%), but the outcome is full local compromise of the user's files and credentials.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.
Unauthorized configuration write in Dashy self-hosted dashboard (versions prior to 4.0.8) lets unauthenticated users or non-admin authenticated users overwrite the central config.yaml via the config-saving endpoint when the deployment uses OIDC authentication, bypassing configured permission controls. Successful abuse enables tampering with dashboard configuration and potential service disruption. No public exploit identified at time of analysis; not listed in CISA KEV.
Authenticated remote code execution affects HAX CMS PHP backend versions prior to 26.0.0, where attackers with valid credentials can configure malicious Git filter commands to overwrite files and execute arbitrary code on the server. The flaw carries a CVSS 4.0 score of 9.4 due to full compromise of confidentiality, integrity, and availability with cascading subsequent system impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.