PT-2026-121536

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description When renewing a token issued by the Kubernetes Auth method, the system fails to verify if the service account token used for the initial authentication remains...

Exploit for CVE-2026-109618

php2shell-watch A small cron-driven watchdog for PHP-FPM serv...

Malicious code in pafex (PyPI)

Source: kam193 8ad1f51a6f081ac9e46b3d3ffa2d0b9b150b1600caf826d940f4e3d1992cda16 In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle. During unpickling, malicious code embeded in the pickle file is...

Malicious code in resion (PyPI)

Source: kam193 2e9e3ce373adb26e45616eec47d727e557f5a696737cb2fbcaa66fb7dc7b7c3e Description: In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle. During unpickling, malicious code embeded in the pickle...

MAL-2026-18094 Malicious code in pafex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f048e6c59bed3c95094e9baaf28b7234a917300b81a4c81db0eb0a3f859ff4e3 No install-time or import-time network I/O, credential access, subprocess execution, or other installer-harm behavior was observed in this package...

Malicious code in pafex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f048e6c59bed3c95094e9baaf28b7234a917300b81a4c81db0eb0a3f859ff4e3 No install-time or import-time network I/O, credential access, subprocess execution, or other installer-harm behavior was observed in this package...

MAL-2026-18095 Malicious code in resion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b4088658d04bc0725d06a035fa9d83254699e6c26ce3653433199de9b10821 No a static rule matches were produced for this package version, and no concrete behavioral evidence of credential access, install-time code executio...

Malicious code in resion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b4088658d04bc0725d06a035fa9d83254699e6c26ce3653433199de9b10821 No a static rule matches were produced for this package version, and no concrete behavioral evidence of credential access, install-time code executio...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Arm Bifrost_Gpu_Kernel_Driver

Sony XBR-65X850D — Root & Persistence Local privilege es...

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support formerly Bomgar versions 26.2.3 and earlier. Patches are available for supported versions 24.3.1 and later; organizations using older versions must upgrade first. Cyber threat actor...

EUVD-2026-102522

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-96806

The Apache Airflow Keycloak auth manager is vulnerable to a session management flaw where the logout route fails to terminate the user session. Although the logout route revokes the presented token, the KeycloakJWTMiddleware component issues a new, unrevoked token within the same response, effect...

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-96806

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but "KeycloakJWTMiddleware" then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected:...

Malicious code in py-wormgpt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6f7fef8f962798019886211ac43e0e0660feae94e4396fc7969643400b2fa139 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOU...

MAL-2026-17886 Malicious code in py-wormgpt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6f7fef8f962798019886211ac43e0e0660feae94e4396fc7969643400b2fa139 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOU...

Malicious code in py-worm (PyPI)

Source: kam193 d4c5838f30da7c1f684305ec0704ef37e963793449390f5b13a4e06212ccbd9d The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in py-sock2 (PyPI)

Source: kam193 317abc5a9c1b535f3db6fd260a2f77eaaceb45745cd93deea7e9b3dd1d0cb933 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...