0dayNews — Vulnerability & Exploit News
Known Exploited Vulnerabilities
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Kestra OSS OS Command Injection Vulnerability
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
BerriAI LiteLLM Improper Authentication Vulnerability
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Sangoma Switchvox SQL Injection Vulnerability
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Pre-auth SSRF in SonicWall SMA1000 Workplace Interface
Unauthenticated SSRF in the SMA1000 Workplace interface allows remote attackers to reach internal functionality via an unintended access path. Exploited in the wild; chains with CVE-2026-83549 for RCE.
OS Command Injection in SonicWall SMA1000 AMC
Post-auth OS command injection in the SonicWall SMA1000 AMC allows an authenticated administrator to execute arbitrary OS commands. CVSS 7.8 HIGH. Chains with CVE-2026-83548 for unauthenticated RCE.
From the desk
Attackers Exploit Langflow to Steal OpenAI, AWS Keys
CVE-2026-0768, a critical unauthenticated RCE in Langflow, is being actively exploited to drain AI API keys and cloud credentials from exposed instances.
JFrog Artifactory CVE-2026-82329 Now Exploited
Active exploitation of the critical Artifactory authentication bypass has started, just days after public disclosure. If your instance is unpatched, that ends now.
FulcrumSec Claims 80GB Manchester Airports Hack
FulcrumSec claims 80 GB of Manchester Airports Group data and threatens public release. No extortion group had claimed the breach when MAG disclosed it on August 28.
McKesson Breach: ShinyHunters Deadline Now Active
McKesson confirmed the data breach. ShinyHunters has set a payment deadline covering 284 million claimed records. Developing situation as of September 1, 2026.
Aurora Ransomware Uses AI Coding Tools in Attacks
CloudSEK and Gambit Security find Aurora operators used Cursor AI to plan Russian-language attacks on 20-plus organizations in nine countries.
PaperCut Active Intrusions: CISA Adds Flaws to KEV
CISA added CVE-2026-81578 and CVE-2026-82078 to KEV on Aug 31. Active intrusions now confirmed. Federal deadline: Sep 14. Emergency Patch Release 2 required.