Threat Library

A maximum-severity vulnerability (CVSS 10.0) in Ruflo, an open-source meta-harness used to orchestrate Claude Code and OpenAI Codex agents via MCP, allows unauthenticated attackers to remotely execute arbitrary commands and poison the agent's persistent memory. This flaw, dubbed RufRoot, affects all versions prior to 3.16.3 and poses severe risk to any deployment exposing the Ruflo MCP interface without proper authentication controls.

A critical vulnerability in Ruby on Rails' Active Storage component (CVE-2026-66066, CVSS 9.5) allows unauthenticated attackers to read arbitrary files from application servers by uploading crafted images. Exposed data can include environment variables and secrets such as secret_key_base, the Rails master key, database passwords, and cloud storage credentials, potentially enabling full application compromise.

CISA has added CVE-2026-20316, a newly disclosed vulnerability in Cisco Secure Firewall Management Center (FMC) Software, to its Known Exploited Vulnerabilities catalog following confirmed zero-day exploitation. The flaw involves static credentials that could allow an unauthenticated remote attacker to log in and access sensitive data on affected devices.

Cisco disclosed a high-severity static credential vulnerability in Secure Firewall Management Center (FMC), tracked as CVE-2026-20316, that has been actively exploited in the wild as a zero-day. Attackers leveraged the hardcoded/static credentials to gain unauthorized access to vulnerable FMC devices, potentially enabling control over managed firewalls and network security policy.

Anthropic experienced a worldwide service disruption affecting Claude and its underlying API, causing requests to fail with '529 Overloaded' errors. This is an availability incident rather than a malicious attack, but it disrupts any downstream applications, agents, or tools that depend on Claude's API for inference.

Russian state-sponsored group Laundry Bear (aka Void Blizzard) is exploiting an unpatched zero-day in Microsoft Exchange Outlook Web Access to gain long-term access to victim mailboxes. The attackers deploy a custom backdoor called OWAReaper to maintain persistent, covert access for intelligence collection and espionage purposes.

Siemens SIMATIC S7-PLCSIM Advanced is affected by a denial-of-service vulnerability (CVE-2026-54429) caused by improper handling of high-volume multicast network traffic, which can exhaust memory resources and crash the application. An unauthenticated attacker on the local network segment can trigger this condition when a specific project configuration is active, requiring manual restart to recover.

CISA added CVE-2026-20316, a hard-coded password vulnerability in Cisco Secure Firewall Management Center, to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. Federal agencies are required under BOD 26-04 to remediate this vulnerability on publicly exposed assets, and all organizations are urged to prioritize patching given the risk of full device compromise.

CISA, NSA, FBI, and international partners published updated 2026 guidance defining the minimum elements for a Software Bill of Materials, replacing the 2021 NTIA baseline. This is a policy/standards update rather than an active threat, intended to strengthen software supply chain transparency and risk management across industries.

The Admin and Site Enhancements (ASE) Pro plugin for WordPress, versions up to 8.9.0, contains a critical unauthenticated remote code execution vulnerability. Attackers can exploit weak nonce/CAPTCHA enforcement and unsanitized repeater row keys spliced into an eval() call to execute arbitrary code on the server, provided the site uses the [post_cf_form] shortcode on a public page.

Care Everywhere Gateway 14.3.10 ships with a bundled WildFly 8.2.0.Final management console that uses hard-coded, identical credentials across all installations, exposing an administrative interface on port 20990 to unauthenticated attackers. Successful exploitation allows deployment of a malicious WAR file, resulting in remote code execution as the Windows machine account. The affected 14.x.x branch has been end-of-life since 2017 and no patch exists for this version line.

AMMOS Instrument Toolkit (AIT) Deep Space Network Interface versions before 2.2.2 contain a critical missing authentication vulnerability in the Space Link Extension (SLE) interface manager. Unauthenticated attackers with network access can directly invoke seven exposed API routes to start/stop DSN sessions, exfiltrate telemetry, and inject arbitrary frames into active spacecraft communication links, posing a severe risk to mission integrity and safety.

Cisco Secure Firewall Management Center (FMC) contains a hard-coded password vulnerability that allows unauthenticated remote attackers to log in with a low-privileged account and access sensitive data. The flaw has been added to CISA's Known Exploited Vulnerabilities catalog with a short remediation window, indicating active or imminent exploitation. Organizations using FMC to manage firewall infrastructure should treat this as an urgent patching priority.

This is a benign 'Today I Learned' post by Simon Willison describing how to connect a custom MCP server to Claude and ChatGPT chat interfaces. It contains no vulnerability disclosure, exploit, or threat details, and simply documents a configuration process.

Pydantic AI's UI adapters (e.g., the Vercel AI adapter) accept client-submitted message history containing 'UploadedFile' references, such as S3/GCS URIs or provider file IDs, without validating that the requesting client should have access to them. Because the server resolves these references using its own privileged credentials (IAM role, service account, or API key), an attacker who can guess or obtain a valid file identifier can trick the server into reading files it should not have access to on the attacker's behalf, including data belonging to other tenants. This is a classic confused-deputy vulnerability affecting a widely used Python agent framework, fixed in versions 1.106.0 and 2.0.0b6.

Pydantic AI's protection against SSRF to cloud metadata endpoints can be bypassed when an application allows local/private URL downloads, because the IP blocklist fails to recognize IPv6-encoded forms (IPv4-mapped, 6to4, NAT64) of metadata service addresses. On dual-stack or NAT64-translated networks, this lets an attacker-controlled URL reach the cloud metadata service and potentially steal short-lived IAM credentials. This only affects apps that explicitly opt into 'force_download=allow-local' on URLs influenced by untrusted input; the issue has been patched in version 1.99.0.

Flyto2 Core, an execution kernel for AI-agent workflows, contains a widespread SSRF vulnerability where numerous HTTP-emitting modules (HTTP requests, GraphQL, notifications, monitoring, vision analysis, browser proxying, and LLM/agent base_url handling) fail to validate caller-supplied URLs. This allows an attacker who can influence tool input or agent-generated parameters to force the agent to make requests to internal services or cloud metadata endpoints, potentially leaking credentials or pivoting into internal networks. The issue is fixed in version 2.26.7.

The official MCP Ruby SDK contained a flaw where its HTTP transport read entire JSON-RPC request bodies into memory without any size limit. An unauthenticated remote attacker could send oversized POST requests to exhaust server memory and crash the MCP server, disrupting all agents relying on it. This is fixed in version 0.23.0.

The MCP Ruby SDK's StreamableHTTP transport failed to bind session IDs to the client/owner that created them, so anyone who obtains a valid session ID (via theft, leakage in logs/URLs, or interception) could issue tools/call requests that execute with the victim's authenticated session context. This allows an attacker to impersonate a legitimate user or agent and trigger tool actions on their behalf without needing credentials.

The official MCP Ruby SDK fails to expire sessions in its StreamableHTTPTransport, allowing an attacker to repeatedly send initialize requests and accumulate ServerSession objects indefinitely. This can exhaust server memory and cause a denial of service against any MCP server built on this SDK. The issue is fixed in version 0.23.0.