VulnHub

A serious vulnerability has been found in Gogs, a widely used open-source Git service that allows users to host their own repositories. This flaw, which has a CVSS score of 9.4, enables any authenticated user to execute arbitrary code, potentially giving them full control over the server. This means that individuals with valid access can exploit this weakness to run malicious commands, posing a significant risk to the integrity and security of the affected systems. Currently, there is no CVE identifier linked to this vulnerability, which may complicate tracking and response efforts. Users of Gogs should be particularly vigilant and consider implementing immediate security measures to mitigate potential exploitation.

Microsoft has raised concerns about the recent disclosure of several unpatched security vulnerabilities without prior notice. The company stated that these uncoordinated disclosures could put customers at significant risk by exposing them to potential attacks. This situation affects users of Microsoft's products, as they may not be aware of the vulnerabilities or have the necessary patches to protect their systems. The lack of coordinated communication from researchers or security firms can lead to confusion and increased vulnerability. Microsoft urges that such disclosures be handled responsibly to ensure that users are adequately protected and informed.

A recent study by Cisco has revealed that multi-turn prompt injection attacks pose a significant risk to major AI models. These attacks are not effectively measured by success rates from single-turn interactions, which may mislead developers about the safety of their systems. The findings suggest that attackers can manipulate conversations with AI models over multiple exchanges, potentially leading to unintended responses or actions. This vulnerability impacts various AI systems that rely on conversational capabilities, raising concerns about the security of user data and the integrity of AI-generated content. Developers and organizations using these models need to reassess their security measures to protect against these sophisticated attack methods.

A recently discovered security vulnerability in Gitea, a popular self-hosted Git service, has put around 30,000 deployments at risk. The flaw allows attackers to access private container images, which can lead to the exposure of sensitive information such as source code and user credentials. This vulnerability affects organizations that rely on Gitea for their development workflows, making it crucial for them to act swiftly to secure their systems. The situation raises concerns about the security of self-hosted services and the potential for misuse of exposed data. Companies using Gitea should prioritize patching their installations to mitigate this risk.

Researchers from Novee have identified a serious vulnerability in Pretalx, an open-source tool widely used for managing conference talks. This flaw allows attackers to take over accounts, effectively granting them a 100% acceptance rate for talk submissions. This means that malicious users could manipulate the platform to ensure their presentations are accepted without proper vetting. The implications are significant for conference organizers who rely on Pretalx for managing submissions, as it undermines the integrity of the selection process. Users and event organizers are urged to review their security practices and stay alert for updates from Pretalx to protect against potential exploitation.

Researchers have discovered that all major large language models (LLMs) are vulnerable to a type of manipulation called multi-turn manipulation. This means that attackers could exploit these models to generate misleading or harmful content over multiple interactions, potentially affecting how users perceive information. The models at risk include those from leading companies in the AI space, which could have serious implications for users relying on these technologies for accurate information. The research highlights the need for developers to implement stronger safeguards against such manipulations, as the integrity of AI-generated content is essential for trust and safety in various applications. This vulnerability raises concerns about the reliability of AI systems, especially when used in sensitive areas like healthcare, finance, and education.

Researchers have identified a serious vulnerability in Gitea, an open-source platform used for version control, that allows unauthorized users to access private container images. This flaw, labeled CVE-2026-27771, impacts all versions of Gitea prior to 1.26.2. Attackers can exploit this weakness without needing any credentials, which could lead to unauthorized access to sensitive data stored in container images. Given the nature of Gitea as a self-hosted solution, organizations using outdated versions are particularly at risk. It’s crucial for users to update their installations to the latest version to safeguard their private resources.

Microsoft has identified a serious vulnerability in SharePoint, labeled CVE-2026-45659, which has a CVSS score of 8.8. This flaw allows attackers to execute remote code with minimal effort, posing a significant risk to organizations using the platform. The vulnerability does not require complicated conditions for exploitation, which increases its potential impact. Microsoft has released security updates to address this issue, and users are strongly advised to apply these patches as soon as possible to protect their systems. Ignoring this vulnerability could lead to unauthorized access and control over affected SharePoint environments.