Threat Library

A critical insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows an authenticated domain account with admin privileges and home directory write access to achieve remote code execution as root. Impact is reduced on Windows deployments but severe on Linux/Unix hosts running Serv-U with elevated service permissions.

SolarWinds Serv-U contains an insecure direct object reference (IDOR) vulnerability that allows a group administrator to escalate privileges and achieve remote code execution as root, primarily on Linux/Unix deployments. Windows deployments are less impacted due to lower default privilege exposure. Given the high CVSS score of 9.1, exploitation could grant an attacker full control of the host system.

Grav CMS 2.0.4 contains a critical RCE vulnerability in its Blueprint::dynamicData() function, which passes attacker-controlled callable strings directly to call_user_func_array() without an allowlist. An authenticated user with page-write permissions can plant a malicious callable in page frontmatter that executes as the web-server user whenever any visitor loads the page, effectively converting low-privilege access into full server compromise.

The Grav api plugin prior to version 1.0.8 improperly authorizes API key generation and revocation actions, checking only for the baseline admin.login permission instead of proper account-management privileges. This flaw allows any authenticated low-privilege panel user to mint a persistent, valid API key bound to any other account, including administrators, resulting in impersonation and full account takeover.

DD-WRT firmware contains a stack-based buffer overflow in its UPnP handling that allows unauthenticated remote attackers to execute arbitrary code. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Organizations running DD-WRT on routers or edge devices should patch immediately given the short remediation window.

Langflow, a widely used visual builder for LLM/agent workflows, contains a vulnerability allowing remote attackers to execute arbitrary code by including functionality from an untrusted control sphere. This has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a very short remediation window (3 days from add date to due date). Because Langflow is often used to orchestrate AI agents and connect them to tools and data sources, compromise of the platform can lead to full takeover of downstream agent pipelines and connected systems.

WordPress Core contains a SQL injection flaw triggered when plugins or themes pass untrusted input to an affected parameter, and this has been added to CISA's Known Exploited Vulnerabilities catalog indicating active exploitation. When chained with CVE-2026-63030, it enables unauthenticated remote code execution on default WordPress installations, posing a severe risk to any internet-facing WordPress site.

MCP-for-Stata, an MCP server that lets AI agents drive Stata, fails to sanitize the log_file_name parameter before interpolating it into a Stata command string. An attacker (or a compromised upstream agent) can craft a malicious log_file_name to inject arbitrary Stata commands such as shell, python, or erase, achieving code execution on the host running the MCP server. The issue is patched in version 1.17.3.

The mcp-webresearch MCP server's visit_page tool fails to filter private, loopback, or cloud metadata IP ranges before directing its Playwright browser to fetch a URL. An attacker who can influence the LLM's tool arguments (e.g., via prompt injection from a webpage the agent reads) can redirect the server to internal endpoints like cloud metadata services, leaking sensitive internal data or credentials into the model's context.

This raw data is a blog post transcript from Simon Willison covering a fireside chat with Anthropic's Claude Code team about product development, dogfooding practices, and system prompt design philosophy. It contains no indicators of prompt injection, tool poisoning, agent impersonation, or any other security threat to AI agents. This should be treated as informational content, not a security incident.

This is an academic survey paper (arXiv cs.CR) analyzing how 21 proposals and 5 commercial AI agent products handle user-level permissions, rather than a report of an active vulnerability or exploit. It highlights that most agentic systems apply uniform, product-level security policies instead of customizable per-user permissions, and identifies gaps in interface design, policy derivation, and runtime enforcement. No specific exploit, CVE, or actively exploited flaw is described; this is foundational research useful for informing future defenses.

This is an academic research paper (not an active exploit) demonstrating a novel attack against multi-hop RAG agents called 'Salience Induction,' which manipulates fact position, emphasis, and framing in retrieved documents to redirect an agent's reasoning without injecting false facts or instructions. The authors also propose a defense, Salience Normalization, that substantially reduces attack success. This is a legitimate, disclosed research contribution rather than an in-the-wild threat, but it identifies a real and previously underexplored weakness in agentic RAG reasoning pipelines.

This is an academic research paper introducing a benchmark for testing how well LLM agent defenders resist adaptive, multi-round prompt injection attacks driven by other LLMs. It is not a report of an active exploit or vulnerability in a deployed system, but a methodology and dataset release showing that adaptive multi-turn attackers achieve modestly higher success rates than single-turn attacks against frontier models. Severity is low as a threat item since it describes research tooling and findings rather than a concrete exploitable weakness in a specific product.

Group-IB has identified an espionage implant dubbed HollowGraph that abuses Microsoft 365 calendar events, dated far in the future (2050), to relay operator instructions and exfiltrate stolen files as event attachments. By routing tasking and data theft through legitimate Microsoft Graph API traffic, the malware blends into normal enterprise activity and evades traditional network-based detection.

Rapid7 researchers discovered an exposed, misconfigured delivery server belonging to a malware operator, revealing over 1,000 files including phishing lure templates, filename-spoofing tests, droppers, and builder notes. The toolkit was actively used in a campaign targeting Windows users in Mexico via a fake government ID-lookup site, delivering an infostealer through WebDAV. The exposure suggests use of AI-generated content in crafting lures, lowering the barrier for producing convincing localized phishing pages.

Researchers identified roughly 7,600 malicious GitHub repositories, with over 800 masquerading as AI 'skills' or Model Context Protocol (MCP) servers, used to distribute the SmartLoader malware family in a campaign dubbed FakeGit. The attackers use copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP downloads to trick developers into executing malware, exploiting growing trust in AI/MCP tooling as a lure.

Attackers stole approximately $23.75 million from the Ostium decentralized trading platform's liquidity provider vault by compromising off-chain infrastructure responsible for feeding price data into the protocol. Rather than exploiting on-chain smart contract logic, the attackers targeted the trust boundary between off-chain price oracles and the on-chain settlement layer, enabling manipulated or falsified price feeds to drain vault funds.

Threat actors exploited two previously undisclosed vulnerabilities in SonicWall SMA1000 series VPN appliances as zero-days for several weeks before public disclosure, deploying custom malware on compromised devices. The attacks targeted internet-facing remote access infrastructure, giving attackers a persistent foothold into victim networks.

Estée Lauder disclosed a data breach after threat actors exploited a vulnerability in Oracle E-Business Suite, the platform used for the company's HR operations. The breach exposed employee data and is part of a broader pattern of attacks targeting Oracle E-Business Suite deployments across multiple organizations.

A NULL pointer dereference vulnerability (CVE-2026-15352) in NASA's Core Flight System (cFS) Health & Safety (HS) Application allows a remote, unauthenticated attacker to crash the application via a crafted Housekeeping Telemetry request, causing a denial-of-service condition. The flaw affects versions prior to v7.0.1 and has been patched by NASA; no known public exploitation has been reported.