UAT-8302 and its box full of malware

Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat APT group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. After successful compromises, UAT-8302 deploys multiple custom-made...

PT-2026-37315

Name of the Vulnerable Software and Affected Versions ciguard versions 0.6.0 through 0.8.1 Description Both SCA HTTP clients in src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py call the function json.loads on response data without a maximum-bytes cap. A hostile or...

Google Chrome security vulnerabilities

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.96 contained a security vulnerability. This vulnerability stemmed from insufficient policy execution in DevTools, allowing attackers who persuade users to install malicious extensions to leak...

Google Chrome security vulnerabilities

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.96 contained a security vulnerability. This vulnerability stemmed from insufficient execution of DevTools policies, which could allow attackers to bypass navigation restrictions by convincing use...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.10 contained security vulnerabilities. These vulnerabilities were due to authorization bypasses, which could allow attackers to execute modified persistence configuration files...

PT-2026-37283

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.1.3 Description The MCP HTTP transport accepts JSON-RPC tools/call requests without requiring authentication, sessions, origins, or token checks, dispatching them directly to the orchestrator's tool registry...

OPENSUSE-SU-2026:10690-1 cri-tools-1.36.0-1.1 on GA media

These are all security issues fixed in the cri-tools-1.36.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-37364

These are all security issues fixed in the cri-tools-1.36.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-7608

A vulnerability was detected in TRENDnet TEW-821DAP up to 1.12B01. The affected element is the function toolsdiagnostic. The manipulation results in os command injection. The exploit is now public and may be used. The vendor explains: "That firmware version will only work on our hardware version...

CVE-2026-7609

A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function toolsdiagnostic of the file /tmp/diagnostic of the component Firmware Udpate. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publish...

GHSA-R35X-V8P8-XVHW pyp2spec is Vulnerable to Code Injection

Impact pyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. The macro...

org.apache.opennlp:opennlp-brat-annotator (1.9.5), org.apache.opennlp:opennlp-distr (1.9.5) +4 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.5)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - org.apache.opennlp:opennlp-brat-annotator 1.9.5 - org.apache.opennlp:opennlp-distr 1.9.5 -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42440 Source advisory: OSV:GHSA-659W-93R5-9J6M...

com.intel.analytics.bigdl:bigdl (0.13.0), com.intel.analytics.bigdl:bigdl-assembly-spark_2.4.6 (>=2.0.0, <=2.3.0) +32 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.2)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.intel.analytics.bigdl:bigdl 0.13.0 - com.intel.analytics.bigdl:bigdl-assembly-spark2.4.6...

org.apache.opennlp:opennlp-brat-annotator (1.7.0), org.apache.opennlp:opennlp-distr (1.7.0) +2 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.7.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - org.apache.opennlp:opennlp-brat-annotator 1.7.0 - org.apache.opennlp:opennlp-distr 1.7.0 -...

fr.vsct.tock:tock-bot-admin-server (>=0.2.0, <=0.2.9), fr.vsct.tock:tock-nlp-admin-server (>=0.1, <=0.2.9) +8 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.7.1)

org.apache.opennlp:opennlp-tools MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - fr.vsct.tock:tock-bot-admin-server =0.2.0, =0.1, =0.1, =0.1, =0.1, =0.1, =0.2.9 -...

com.nikialeksey:arspell-langtool (3.1.0), com.rabidgremlin:mutters (1.3.0) +55 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.7.2)

org.apache.opennlp:opennlp-tools MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.nikialeksey:arspell-langtool 3.1.0 - com.rabidgremlin:mutters 1.3.0 -...

com.rabidgremlin:mutters-opennlp-intent (>=4.0.0, <=5.0.4), com.rabidgremlin:mutters-opennlp-ner (>=4.0.0, <=5.0.4) +19 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.rabidgremlin:mutters-opennlp-intent =4.0.0, =4.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0,...

com.blazemeter:jmeter-bzm-commons (>=0.1, <=0.2.4), com.blazemeter:jmeter-bzm-correlation-recorder (>=1.2.3, <=2.2) +72 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.3)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.blazemeter:jmeter-bzm-commons =0.1, =1.2.3, =2.3.18, =0.3.4, =0.3.4, =0.5.2, =0.7.0, =0.7.0...

com.centit.support:centit-es-client (>=0.1.1808, <=0.1.1901), com.epam.reportportal:service-authorization (4.2.0) +130 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.4)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.centit.support:centit-es-client =0.1.1808, =0.1, =1.10.0, =2.9.0, =2.9.0, =2.10.0, =2.0.1,...