Monthly
The GitHub Action shipped with psf/black can be induced to install and execute attacker-controlled code when the optional use_pyproject: true input is enabled. Because the action read tool.black.required-version from the checked-out pyproject.toml and passed it to pip without validating it as a plain version specifier, a pull request that rewrites that value into a direct reference (such as a URL to a malicious package or wheel) causes pip to fetch and run that package inside the victim repository's CI workflow. Only repositories that opt into the non-default use_pyproject setting and run the action against pull-request-supplied content are exposed, and unattended execution is most plausible for returning or authorized contributors since GitHub normally gates first-time contributors behind maintainer workflow approval; the complete fix is Black 26.10.1, which now rejects anything other than released version specifiers.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 accepts SVG and EPS files for contact photo uploads and passes them to ImageMagick for resizing, allowing authenticated users to supply content that can reference external resources or invoke ImageMagick delegates; this may lead to file disclosure, SSRF, or command execution depending on the server's ImageMagick configuration. No public exploit has been identified at time of analysis, and vendor patches are available in 1.6.20 and 1.7.5.
Argo CD deployments that run Kustomize with --enable-helm enabled can be tricked into executing attacker-supplied code inside argocd-repo-server, because helmGlobals.configHome lets a repository redirect Helm's config/data home to a repository-controlled path and Helm then auto-loads and runs a downloader plugin from <configHome>/.data/plugins without any plugin-install step. The barrier is low-privilege authenticated access (CVSS PR:L, scope-changed, 9.9): an attacker can either commit the Kustomization and plugin to a Git repository an Application already builds, or push the same files through POST /api/v1/applications/manifestsWithFiles (also reachable via argocd app diff --local --server-side-generate), which requires only Application get permission on an existing Application - no update, sync, or repository write rights. The payload runs as the repo-server user and can read repository credentials and other process-accessible data, so the blast radius extends beyond the Application itself; no public exploit code or confirmed active exploitation was identified at time of analysis, and the --enable-helm flag is a hard prerequisite - deployments that never enabled it are unaffected.
Apple Xcode before version 27 fails to enforce library validation on certain bundled binaries, allowing a malicious app already running inside Xcode's sandbox to load untrusted libraries and break out of that sandbox (CVSS 8.8, scope-changed, high confidentiality/integrity/availability impact). Exploitation is strictly local: an attacker must first get code executing on the macOS host - for example through a trojanized developer tool, plugin, or dependency - and the flaw then provides sandbox escape and privilege escalation rather than initial access. Apple addressed the issue by enforcing library validation, shipping the fix in Xcode 27 (available from https://support.apple.com/en-us/149040); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.
Code execution in JetBrains Junie CLI before 26.8.3 allows an attacker to run arbitrary code via a malicious MCP server configuration embedded in an untrusted project. The victim must open and interact with the project (user interaction required), and local access is necessary, but no privileges are required. No public exploit code has been identified at time of analysis.
Code execution in .NET and Visual Studio can be triggered when a developer or user processes attacker-supplied content - such as a crafted project, build input, or dependency - that pulls functionality in from an untrusted control sphere and executes it. Affected builds are .NET 8.0 before 8.0.132, .NET 9.0 before 9.0.319, .NET 10.0 before 10.0.113, Visual Studio 2022 17.14 before 17.14.42, and Visual Studio 2026 18.10 before 18.10.4; the issue is network-reachable and unauthenticated (PR:N) but requires user interaction (UI:R) and non-trivial preconditions (AC:H), so an attacker cannot silently trigger it remotely. There is no public exploit identified at time of analysis and no confirmed active exploitation - the CISA SSVC exploitation value is 'none' - which keeps this a moderate-priority issue rather than a drop-everything emergency despite the 7.5 High CVSS score, especially since the SSVC technical impact is assessed as 'total' once exploitation conditions are met.
Privilege escalation in Microsoft Exchange Server allows an authenticated local attacker to gain elevated privileges on the server. The vulnerability, tracked as CVE-2026-87695, affects Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM before specific patched builds. Exploitation requires the attacker to already have low-privileged access on the Exchange server itself (CVSS PR:L, AV:L), which significantly limits the attack surface; no public exploit has been identified at time of analysis. A vendor patch is available.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Authenticated code execution in Microsoft SharePoint Server Subscription Edition affects all builds from 16.0.0 up to (but not including) 16.0.20326.20190, allowing an attacker who already holds high (farm-administrative) privileges to run arbitrary code over the network with no user interaction. Because the CVSS vector is PR:H (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), the flaw is not reachable by anonymous or low-privileged users, but for a privileged actor it yields complete loss of confidentiality, integrity, and availability. There is no CISA KEV listing and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', although technical impact is assessed as total, and a vendor patch is available.
The GitHub Action shipped with psf/black can be induced to install and execute attacker-controlled code when the optional use_pyproject: true input is enabled. Because the action read tool.black.required-version from the checked-out pyproject.toml and passed it to pip without validating it as a plain version specifier, a pull request that rewrites that value into a direct reference (such as a URL to a malicious package or wheel) causes pip to fetch and run that package inside the victim repository's CI workflow. Only repositories that opt into the non-default use_pyproject setting and run the action against pull-request-supplied content are exposed, and unattended execution is most plausible for returning or authorized contributors since GitHub normally gates first-time contributors behind maintainer workflow approval; the complete fix is Black 26.10.1, which now rejects anything other than released version specifiers.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 accepts SVG and EPS files for contact photo uploads and passes them to ImageMagick for resizing, allowing authenticated users to supply content that can reference external resources or invoke ImageMagick delegates; this may lead to file disclosure, SSRF, or command execution depending on the server's ImageMagick configuration. No public exploit has been identified at time of analysis, and vendor patches are available in 1.6.20 and 1.7.5.
Argo CD deployments that run Kustomize with --enable-helm enabled can be tricked into executing attacker-supplied code inside argocd-repo-server, because helmGlobals.configHome lets a repository redirect Helm's config/data home to a repository-controlled path and Helm then auto-loads and runs a downloader plugin from <configHome>/.data/plugins without any plugin-install step. The barrier is low-privilege authenticated access (CVSS PR:L, scope-changed, 9.9): an attacker can either commit the Kustomization and plugin to a Git repository an Application already builds, or push the same files through POST /api/v1/applications/manifestsWithFiles (also reachable via argocd app diff --local --server-side-generate), which requires only Application get permission on an existing Application - no update, sync, or repository write rights. The payload runs as the repo-server user and can read repository credentials and other process-accessible data, so the blast radius extends beyond the Application itself; no public exploit code or confirmed active exploitation was identified at time of analysis, and the --enable-helm flag is a hard prerequisite - deployments that never enabled it are unaffected.
Apple Xcode before version 27 fails to enforce library validation on certain bundled binaries, allowing a malicious app already running inside Xcode's sandbox to load untrusted libraries and break out of that sandbox (CVSS 8.8, scope-changed, high confidentiality/integrity/availability impact). Exploitation is strictly local: an attacker must first get code executing on the macOS host - for example through a trojanized developer tool, plugin, or dependency - and the flaw then provides sandbox escape and privilege escalation rather than initial access. Apple addressed the issue by enforcing library validation, shipping the fix in Xcode 27 (available from https://support.apple.com/en-us/149040); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.
Code execution in JetBrains Junie CLI before 26.8.3 allows an attacker to run arbitrary code via a malicious MCP server configuration embedded in an untrusted project. The victim must open and interact with the project (user interaction required), and local access is necessary, but no privileges are required. No public exploit code has been identified at time of analysis.
Code execution in .NET and Visual Studio can be triggered when a developer or user processes attacker-supplied content - such as a crafted project, build input, or dependency - that pulls functionality in from an untrusted control sphere and executes it. Affected builds are .NET 8.0 before 8.0.132, .NET 9.0 before 9.0.319, .NET 10.0 before 10.0.113, Visual Studio 2022 17.14 before 17.14.42, and Visual Studio 2026 18.10 before 18.10.4; the issue is network-reachable and unauthenticated (PR:N) but requires user interaction (UI:R) and non-trivial preconditions (AC:H), so an attacker cannot silently trigger it remotely. There is no public exploit identified at time of analysis and no confirmed active exploitation - the CISA SSVC exploitation value is 'none' - which keeps this a moderate-priority issue rather than a drop-everything emergency despite the 7.5 High CVSS score, especially since the SSVC technical impact is assessed as 'total' once exploitation conditions are met.
Privilege escalation in Microsoft Exchange Server allows an authenticated local attacker to gain elevated privileges on the server. The vulnerability, tracked as CVE-2026-87695, affects Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM before specific patched builds. Exploitation requires the attacker to already have low-privileged access on the Exchange server itself (CVSS PR:L, AV:L), which significantly limits the attack surface; no public exploit has been identified at time of analysis. A vendor patch is available.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Authenticated code execution in Microsoft SharePoint Server Subscription Edition affects all builds from 16.0.0 up to (but not including) 16.0.20326.20190, allowing an attacker who already holds high (farm-administrative) privileges to run arbitrary code over the network with no user interaction. Because the CVSS vector is PR:H (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), the flaw is not reachable by anonymous or low-privileged users, but for a privileged actor it yields complete loss of confidentiality, integrity, and availability. There is no CISA KEV listing and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', although technical impact is assessed as total, and a vendor patch is available.