VulnHub

The National Institute of Standards and Technology (NIST) is narrowing its focus on analyzing Common Vulnerabilities and Exposures (CVE) due to the increasing number of vulnerabilities reported. Moving forward, NIST will concentrate its efforts on vulnerabilities found in critical software, systems utilized by the federal government, and those that are currently being exploited. This shift aims to streamline the analysis process and ensure that resources are allocated to the most pressing security issues. As the volume of vulnerabilities continues to rise, this change reflects a need for more targeted and efficient management of cybersecurity threats. It’s important for organizations and government entities to stay informed about these critical vulnerabilities to protect their systems effectively.

A severe vulnerability in nginx-ui, identified as CVE-2026-33032, is currently being exploited by attackers. This flaw allows unauthorized users to bypass authentication and gain complete control of Nginx servers, posing a significant risk to organizations using this web server technology. The vulnerability is linked to inadequate protection of the /mcp_message endpoint, which can be exploited without any prior authentication. With a CVSS score of 9.8, it is crucial for users to take immediate action to secure their systems. Organizations should prioritize patching their Nginx installations to mitigate this serious threat.

A serious security flaw has been identified in the nginx-ui MCP, specifically an authentication bypass vulnerability tracked as CVE-2026-33032. This vulnerability has a high severity score of 9.8 on the CVSS scale and is currently being exploited in the wild, making it a pressing concern for users and organizations running affected versions. Attackers could potentially gain unauthorized access to systems using this flaw, which poses significant risks to data integrity and confidentiality. It's crucial for system administrators to take immediate action to protect their environments from these attacks. Timely updates and security patches are essential to mitigate the risks associated with this vulnerability.

A serious vulnerability, identified as CVE-2026-33032, has been discovered in nginx-ui, a management tool for Nginx servers. This flaw allows attackers to bypass authentication, potentially giving them full control of the Nginx service. Dubbed MCPwn by Pluto Security, the vulnerability has a CVSS score of 9.8, indicating its critical nature. Users of nginx-ui are at risk, as the flaw is currently being actively exploited in the wild. It's crucial for affected organizations to take immediate action to secure their systems and prevent unauthorized access.

A serious vulnerability has been discovered in ShowDoc, an online tool used by IT teams for document sharing and collaboration. This flaw, identified as CVE-2025-0520, allows attackers to execute remote code on unpatched servers, posing a significant risk to organizations that have not updated their systems. With a CVSS score of 9.4, this remote code execution vulnerability is currently being exploited in the wild, meaning that attackers are actively taking advantage of it. Companies using ShowDoc need to prioritize patching their servers to protect against potential breaches and unauthorized access to sensitive information. Failing to address this issue could lead to severe consequences for affected organizations.

A serious vulnerability, known as CVE-2026-39987, has been discovered in all versions of Marimo prior to 0.23.0, earning a high CVSS score of 9.3. This flaw allows attackers to potentially exploit systems running affected versions of the software, raising significant security concerns for users. Researchers noted that the vulnerability was actively exploited within hours of its disclosure, indicating a swift response from malicious actors. Users of Marimo are urged to update to version 0.23.0 or later to protect their systems from potential attacks. This incident emphasizes the critical need for timely software updates in response to newly identified vulnerabilities.

A serious vulnerability in the open-source Python notebook tool Marimo, identified as CVE-2026-39987, has been exploited within just 10 hours of its disclosure on April 8, 2026. This flaw has a CVSS score of 9.3, indicating its severity and potential impact. Researchers from the Sysdig Threat Research Team reported that attackers began exploiting this vulnerability almost immediately, raising alarms about the security of systems using Marimo. This incident underscores the urgency for users and organizations relying on this tool to take immediate action to protect their systems from potential breaches. Quick exploitation of such vulnerabilities demonstrates the need for timely patching and awareness in the cybersecurity community.

A serious vulnerability in Marimo, an open-source Python notebook designed for data science, has been exploited within just 10 hours of being made public. The flaw, identified as CVE-2026-39987, allows attackers to execute remote code without needing authentication, affecting all versions of Marimo up to and including the latest release. Researchers from Sysdig reported this rapid exploitation, underscoring the urgency for users to address this security gap. Organizations using Marimo need to prioritize patching their installations to avoid potential breaches, as the high CVSS score of 9.3 indicates a significant risk. The swift exploitation of this vulnerability serves as a reminder of the importance of timely updates and security practices in software development.

A recent cybersecurity campaign attributed to APT28, also known as Fancy Bear, has been uncovered by Trend Micro. The attackers are using a new malware called PRISMEX to target Ukraine and its allies. They exploit recently disclosed vulnerabilities, specifically CVE-2026-21509 and CVE-2026-21513, to bypass security measures and gain unauthorized access. This type of espionage can significantly affect national security and the stability of the region, as sensitive information could be compromised. The targeting of Ukraine, in particular, raises alarms given the ongoing conflict in the area, indicating that the stakes are high for both military and political intelligence.

A serious vulnerability in Flowise, identified as CVE-2025-59528, is currently being exploited by attackers to execute malicious code remotely. This flaw, which has a CVSS score of 10, arises from insufficient validation of user-supplied JavaScript, allowing unauthorized access to systems and file systems. Organizations using Flowise are at risk, as this vulnerability can lead to significant security breaches. The exploitation of such vulnerabilities can result in data theft, system compromise, and other malicious activities. It's essential for users and administrators to be aware of this issue and take appropriate action to protect their systems.

A serious vulnerability in Docker Engine, identified as CVE-2026-34040, has been reported that allows attackers to bypass authorization plugins under certain conditions. This flaw has a high severity rating, with a CVSS score of 8.8, and it is rooted in an incomplete fix for a previous vulnerability, CVE-2024-41110, which was disclosed in July 2024. This means that systems relying on Docker for container management could be at risk, potentially allowing unauthorized access to the host system. Organizations using Docker should take immediate action to assess their exposure and implement necessary security measures. The implications of this vulnerability are significant, as it could lead to unauthorized actions on affected systems, compromising sensitive data and operations.

Researchers from VulnCheck have discovered that attackers are actively exploiting a severe vulnerability in Flowise, an open-source AI platform. The flaw, identified as CVE-2025-59528, has a maximum CVSS score of 10.0 and allows for remote code execution through a code injection vulnerability in the CustomMCP node. This means that unauthorized users could potentially execute commands on affected systems. Over 12,000 instances of Flowise are exposed, raising significant concerns for users and organizations relying on this platform. It's crucial for those affected to take immediate action to secure their systems against this vulnerability.