VulnHub

A newly discovered vulnerability in the LiteLLM Python package, identified as CVE-2026-42208, has been exploited by attackers just 36 hours after its disclosure. This flaw allows for SQL injection through the proxy API key verification process, enabling unauthorized access and modification of sensitive database information. The rapid exploitation of this vulnerability raises concerns for developers and organizations using LiteLLM, as it could lead to significant data breaches and compromise of user data. Users and organizations need to take immediate action to secure their systems against this threat, as the vulnerability is already being actively targeted in the wild.

CISA and Microsoft have issued a warning about the exploitation of a Windows Shell vulnerability identified as CVE-2026-32202. This zero-click vulnerability allows attackers to trick victims' systems into authenticating with the attacker's server, potentially exposing sensitive information. CVE-2026-32202 is linked to an incomplete fix for a previous vulnerability (CVE-2026-21510), which was targeted by the APT28 group using malicious LNK files. Microsoft had released patches for these vulnerabilities in February 2026, but the new exploit indicates that attackers have found ways to bypass these security measures. Users and organizations running affected systems need to be vigilant and apply available updates to safeguard against these kinds of attacks.

A significant vulnerability, identified as CVE-2026-3854, has been discovered in GitHub.com and GitHub Enterprise Server, potentially allowing remote code execution. This flaw poses a risk to millions of repositories hosted on these platforms, which are widely used by developers and organizations for version control and collaboration. If exploited, attackers could execute arbitrary code, leading to unauthorized access and manipulation of sensitive codebases. The discovery emphasizes the need for users to remain vigilant and update their systems promptly to mitigate potential risks. GitHub has urged users to apply the latest patches to safeguard their repositories against this vulnerability.

A serious SQL injection vulnerability, identified as CVE-2026-42208, has been discovered in BerriAI's LiteLLM Python package, with a high CVSS score of 9.3. Remarkably, this flaw has already been actively exploited within just 36 hours of its public disclosure. Attackers can use this vulnerability to modify the database underlying the application, posing significant risks to any systems using LiteLLM. Organizations that rely on this package need to act quickly to protect their data and systems from potential breaches. Users should remain vigilant and apply necessary updates or patches as soon as they are available to mitigate these risks.

Hackers are actively exploiting a serious SQL injection vulnerability, identified as CVE-2026-42208, in the LiteLLM open-source large-language model gateway. This flaw allows attackers to access sensitive information stored within the system, which could lead to unauthorized data exposure. Users of LiteLLM, particularly those managing sensitive datasets, should be aware that their systems may be at risk. The vulnerability is already being targeted in the wild, making immediate action crucial for those using the affected software. As the situation develops, it is vital for organizations to stay informed about potential exploits and take necessary precautions to protect their data.

Researchers have discovered a serious vulnerability in GitHub, identified as CVE-2026-3854, which allows attackers to execute arbitrary code by simply pushing a git command. This flaw affects several GitHub products, including GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, and GitHub Enterprise Cloud with Enterprise. The ability to run code remotely poses significant risks, as it could lead to unauthorized access or manipulation of repositories. Companies using these GitHub services should be vigilant and take immediate action to address this vulnerability, as it could potentially compromise their code and data integrity. Ensuring that all systems are updated and secure is essential to mitigate the risks associated with this exploit.

Researchers have identified a serious security flaw in GitHub.com and GitHub Enterprise Server, designated CVE-2026-3854, which could enable an authenticated user to execute arbitrary code remotely with just a single 'git push' command. This command injection vulnerability has a CVSS score of 8.7, indicating its severity. If exploited, it could allow attackers with repository push access to take control over affected systems. This issue affects both individual developers and organizations using GitHub for version control, highlighting the need for immediate awareness and action. Users are advised to monitor their repositories closely and apply any recommended patches as they become available.

A serious security flaw has been identified in LeRobot, Hugging Face's open-source robotics platform, which has garnered nearly 24,000 stars on GitHub. The vulnerability, designated as CVE-2026-25874, has a high severity score of 9.3 and allows attackers to exploit untrusted data deserialization, potentially leading to remote code execution without authentication. This flaw poses a significant risk to developers and organizations using LeRobot, as it could allow unauthorized access and control over their systems. Researchers are urging users to take immediate action to safeguard their implementations, given the potential for widespread exploitation. The details of the flaw emphasize the importance of security diligence in open-source projects.

A serious security vulnerability in LMDeploy, a toolkit for managing large language models, has been actively exploited less than 13 hours after being made public. This flaw, designated as CVE-2026-33626, has a CVSS score of 7.5 and involves a Server-Side Request Forgery (SSRF) issue, which attackers can use to gain access to sensitive data. This incident poses significant risks for users and organizations that rely on LMDeploy for deploying and serving machine learning models. Given the rapid exploitation of this vulnerability, companies using LMDeploy should take immediate action to safeguard their systems. The swift response from attackers emphasizes the need for stringent monitoring and prompt patching of critical vulnerabilities.

A critical vulnerability in Microsoft SharePoint, identified as CVE-2026-32201, is currently being exploited by attackers. Over 1,300 SharePoint servers exposed to the internet remain at risk, with fewer than 200 instances patched since the last Patch Tuesday. This zero-day spoofing flaw allows unauthorized access, which could lead to significant data breaches or further intrusions. Organizations using SharePoint should prioritize applying available updates to mitigate the risk and secure their systems against ongoing attacks. The situation underscores the urgency for users to remain vigilant and proactive in patch management.

A severe vulnerability in Apache ActiveMQ, identified as CVE-2026-34197, has put over 6,400 servers at risk of exploitation. This widely used open-source message broker is utilized globally, with 6,476 instances exposed to the internet. Attackers could potentially execute code remotely, which could lead to significant security breaches. Organizations using ActiveMQ should take immediate action to assess their systems and implement protective measures. The urgency of this situation highlights the need for timely updates and monitoring of server configurations to prevent unauthorized access.