⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary. Home devices became a routing cover. Clean code pulled dirt from a dependency. Identit...

Insignary Closes SBOM Accuracy Gap With Binary-Level Clarity for Regulatory Risk

Toronto, Canada, 6th July 2026, CyberNewswire...

RHSA-2026:35830 Red Hat Security Advisory: grafana security update

Bulletin has no description...

RHSA-2026:35806 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

CVE-2026-6900

CVE-2026-6900 affects B&R Industrial Automation GmbH APROL, with a vulnerability in improper certificate validation. The issue impacts APROL versions before R 4.4-01P5. The CVSS metrics indicate a high to critical impact depending on the vector set: CVSS 3.1 base score 7.4 (HIGH) with network acc...

EUVD-2026-41832

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer MailProducer.getSender scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present...

PT-2026-56030

Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.0 Description An unauthenticated mass assignment issue exists in the client self-registration endpoint. This allows a visitor to assign themselves to an arbitrary client group during the sign-up process. Since...

PT-2026-56020

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471 Description An authenticated command injection exists in the GetLogs Livewire component. Users with team membership, including those with the lowest privilege role, can execute arbitrary commands as roo...

PT-2026-55959

Name of the Vulnerable Software and Affected Versions OP-TEE versions 3.10.0 through 4.10.x Description OP-TEE is a Trusted Execution Environment TEE designed as a companion to a non-secure Linux kernel running on Arm Cortex-A cores using TrustZone technology. An unbounded recursion can cause the...

Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass

Exploit Title: Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass Google Dork: N/A Date: 2026-06-19 Exploit Author: Onur BILICI @basekill Vendor Homepage: https://github.com/enesgkky/pulpy Software Link: https://github.com/enesgkky/pulpy Version: /Library/" or critical configuration directories like...

[SECURITY] Fedora 43 Update: python-jupyter-server-2.20.0-1.fc43

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila...

CVE-2026-13015

creationtimestamp| type| source ---|---|--- 2026-07-04 09:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpspx567d22e 2026-07-04 09:15:08+00:00| seen| https://bsky.app/profile/potato.software/post/3mpspx5mi4n2r...

BELL-CVE-2026-53351 CVE-2026-53351 does not affect BellSoft software

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2026-14544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in HPLIP HP Linux Imaging and Printing Software. This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escala...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the OAuth sign-in callback process. An attacker can regain access to accounts that have been disabled by an administrator by initiating an OAuth sign-in, resulting in unauthorized re-enablement of those account...

CVE-2026-58523

creationtimestamp| type| source ---|---|--- 2026-07-03 21:49:12+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mprjmlunko2x 2026-07-03 21:49:13+00:00| seen| https://bsky.app/profile/potato.software/post/3mprjmmwam72h 2026-07-03 21:49:17+00:00| seen|...

CVE-2026-26231

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write...

CVE-2026-14459

Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

CVE-2026-14460

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

EUVD-2026-41552

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...