VulnHub

Metabase has issued a warning about a serious security vulnerability in its data visualization software, which is currently being exploited by attackers. This zero-day flaw, rated with a CVSS score of 10.0, allows unauthorized individuals to execute arbitrary SQL commands in the Metabase application database without needing to log in. As a result, attackers can gain administrative access to sensitive data. Since this vulnerability does not have a CVE identifier, it adds another layer of urgency for users to secure their systems. Organizations using Metabase should take immediate action to protect their data, as the exploit is actively being used in the wild.

A vishing group identified as UNC6671 has shifted its focus to targeting mergers and acquisitions (M&A) firms with extortion schemes. This group, known for using voice phishing tactics, aims to exploit sensitive financial data and negotiations occurring in these high-stakes environments. Experts are advising firms to implement managed-device logins and closely monitor audit logs to combat the rising threat of phishing-led data theft. The implications of this shift are significant, as M&A firms often handle large sums of money and confidential information, making them prime targets for attackers seeking to leverage that data for financial gain.

A recent hacking campaign has targeted over 200 firms, including prominent financial institutions like Blackstone and Bridgewater Associates, by impersonating IT support through fake help desks. The attackers, associated with various names like Redact and Falcon, set up credential-stealing websites aimed at employees to capture multi-factor authentication (MFA) credentials. This tactic raises significant concerns as it not only compromises sensitive financial data but also undermines trust in internal IT support systems. The scale of this operation suggests a well-organized effort to exploit vulnerabilities in corporate security practices, emphasizing the need for enhanced training and awareness among employees about potential phishing attempts. Companies must remain vigilant and adopt stricter security measures to protect against such impersonation schemes.

Researchers have discovered a new attack method called the TONTOU CPU attack, which can bypass the recent fixes for the Spectre v2 vulnerabilities. This exploit allows attackers to leak sensitive information, including password hashes from Linux systems. The implications are significant, as many users and organizations rely on Linux for their operations, and this vulnerability can compromise the security of their systems. Users and administrators are urged to be vigilant and consider implementing additional security measures to protect against potential exploitation. The findings emphasize the ongoing challenges in securing speculative execution vulnerabilities in modern processors.

A vulnerability has been discovered in Medixant's RadiAnt DICOM software that could allow attackers to exploit specially crafted DICOM files. Versions 2025.2 and earlier of the software are affected, which could lead to application crashes or even remote code execution due to an out-of-bounds write triggered by malicious JPEG-compressed pixel data. Users are advised to upgrade to version 2026.1 to mitigate this risk. The vulnerability is particularly concerning for healthcare and public health sectors worldwide, as it could compromise patient data and system integrity. While there are currently no reports of this vulnerability being actively exploited, users should remain cautious and only open DICOM files from trusted sources.

A new cybersecurity concern has emerged involving a type of prompt injection that exploits the 'Ask AI' buttons found on many commercial websites. Researchers discovered that these buttons can contain hidden payloads that manipulate AI models without needing any malware or stolen credentials. This method takes advantage of pre-filled deep links, allowing attackers to alter the memory of large language models (LLMs) when users interact with these buttons. The implications are significant, as this could lead to misinformation or biased outputs from AI systems, affecting both users and the companies that rely on these AI assistants for customer interaction. Organizations should be aware of this risk and consider implementing safeguards to prevent such exploitations.

Researchers have identified a serious vulnerability affecting AI browsers that allows attackers to hijack agents through embedded malicious instructions. This type of attack is categorized as a 'zero-click' exploit, meaning users don't need to interact with the content for their systems to be compromised. The implications of this vulnerability are significant, as it could lead to unauthorized access and control over users' browsing activities without their knowledge. Currently, there are no straightforward fixes available, leaving users and developers in a challenging position. This situation calls for increased vigilance and proactive measures from both users and developers to safeguard their systems against potential exploitation.

Researchers from Cisco Talos have discovered that hackers are exploiting simple authorization claims to circumvent security measures in artificial intelligence systems. This vulnerability allows them to create tools for Distributed Denial of Service (DDoS) attacks, steal user credentials, and gain access to live camera feeds. The implications are significant, as it poses a risk to various platforms that utilize AI to manage security protocols. Companies that rely on AI for protection need to be vigilant and assess their defenses to prevent unauthorized access and potential data breaches. This incident serves as a reminder of the evolving tactics used by cybercriminals to exploit weaknesses in technology.

The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability, identified as CVE-2026-63077, related to JetBrains TeamCity to its Known Exploited Vulnerabilities Catalog. This vulnerability involves the deserialization of untrusted data, which has been a common method for cybercriminals to exploit systems. The risk is particularly significant for federal agencies, as CISA's guidance emphasizes the need for rapid remediation of such vulnerabilities. While this directive primarily targets Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based strategies for managing vulnerabilities. The agency will continue to update the catalog with new vulnerabilities that show evidence of active exploitation, and organizations are invited to report any known exploited vulnerabilities that are not yet listed.

A newly discovered vulnerability in the Linux kernel's Open vSwitch datapath allows local users to gain root access on several default-configured distributions. This memory corruption flaw, identified as CVE-2026-64531 and given the codename OVSwrap, has a CVSS score of 7.8, indicating a high severity. Security researcher Asim disclosed this issue, which comes with a public exploit that has pre-built records for about 800 different kernel builds. This broad impact means that many users could be affected if they have systems running these vulnerable kernel versions. Companies and system administrators should take immediate action to assess their environments and apply necessary patches to mitigate this risk.

A serious vulnerability has been discovered in Gitea, the self-hosted Git service, that allows unauthenticated attackers to read any file that the service account can access. This flaw affects versions 1.22.1 through 1.27.0, requiring only a public repository and some specially crafted Org-mode markup to exploit. The vulnerability, tracked as CVE-2026-59774, has been rated Critical with a CVSS score of 9.8, indicating a severe risk. Users of affected Gitea versions should update to version 1.27.1 or later to secure their systems against this issue, as the flaw poses a significant risk of data exposure without needing any login credentials.