Source intelligence
425 collected source records. Original advisories and security research.
300 matching sources · Newest published first
Open CVE tracker →Original publisher records, awaiting Egret editorial review. Headlines open the original source; CVE identifiers open the tracker.
Scroll across the table to see all columns.
| Published | Finding / research | Publisher | Identifiers |
|---|---|---|---|
| Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch) GHSA: GHSA-7rgq-gccq-qphx Reported severity: medium Advisory package entry 1: Affected package: @modelcontextprotocol/server-filesystem (npm) Affected versions: >= 2025.8.21, <= 2026.8.31 Patched version: Not specified b… |
MCP server advisories | GHSA-7RGQ-GCCQ-QPHX |
|
| Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem GHSA: GHSA-4gxg-m5jx-9j57 Reported severity: medium Advisory package entry 1: Affected package: @modelcontextprotocol/server-filesystem (npm) Affected versions: = 2026.8.31 Patched version: Not specified by advisory Advi… |
MCP server advisories | ||
| robots.txt enforcement bypass via HTTP redirects in mcp-server-fetch GHSA: GHSA-3jqg-r5pp-rmp2 Reported severity: low Advisory package entry 1: Affected package: mcp-server-fetch (pip) Affected versions: >= 0.6.1, <= 2026.10.19 Patched version: 2026.10.24 Advisory description: Summary mcp… |
MCP server advisories | GHSA-3JQG-R5PP-RMP2 |
|
| Japanese Game Maker Capcom Has Confirmed - 11,774,247 Customer Records Exposed Capcom has announced plans to notify customers after unauthorized access to its CAPCOM ID service affected 11,774,247 records worldwide. The Japanese game publisher disclosed the incident on October 22, 2026, saying the … |
Cyber Security News | None reported |
|
| Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CVE-2026-110447 — Collabora / Collabora Online – Built-in CODE Server. Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows … |
CISA KEV | ||
| Arista VeloCloud Orchestrator SQL Injection Vulnerability CVE-2026-114625 — Arista / VeloCloud Orchestrator. Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the … |
CISA KEV | ||
| VU#763488: Memory corruption vulnerabilities in PHP Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these v… |
CERT/CC | ||
| Inside SiriusQT: A Seriously Skilled RAT Introduction SiriusQT is advertised as a Windows RAT, but the analyzed sample in this article shows something more complex than a remote administration tool. Under the name, it offers several capabilities in a single imp… |
Group-IB | None reported |
|
| Group-IB supports INTERPOL's Operation Serengeti III, leading to 1,462 arrests across Africa and over USD 105 million recovered Group-IB, a leading creator of predictive cybersecurity technologies to investigate, prevent, and fight digital crime, announced today that it supported INTERPOL’s Operation Serengeti III, a multinational law-enforcement… |
Group-IB | None reported |
|
| PHP2Shell by Calif Research PHP >= 5.4.0 RCE PHP can leave dangling pointers/state when an allocation would exceed memory_limit, or another fatal error interrupts native code before its normal cleanup completes. Request shutdown may then free memor… |
Calif | None reported |
|
| Stray Cat, Open Doors: How k0t Wanders Through the Network Edge Introduction Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed … |
Group-IB | ||
| PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take contr… |
Wiz Research | ||
| Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress Acknowledgments: Special thanks to Lindsey Welch and Ben Nahorney for their contributions to this investigation and writeup. Update 10/21/26 @ 4:40pm ET Since PHP released its security advisory this morning to address th… |
Huntress | ||
| VU#645818: Xerj Console API authentication bypass leads to unauthorized credential minting Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can c… |
CERT/CC | ||
| Using Claude to reduce the attack surface of code Chris Rohlf Over the past year, we’ve published lots of data that shows that frontier AI models are more than capable of discovering and exploiting security vulnerabilities. Showing how previously unknown vulnerabilities… |
Anthropic | None reported |
|
| The Checker You Pay For Introduction Fraud against spend-management platforms is usually pictured as theft from the platform itself: a stolen card is spent, a false reimbursement is paid, a chargeback is booked. This blog documents a quieter pa… |
Group-IB | None reported |
|
| Siemens Software Center Uncontrolled Search Path Element Vulnerability CVE-2026-110936 — Siemens / Software Center. Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a direc… |
CISA KEV | ||
| Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96652 — Plex / Media Server. Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' param… |
CISA KEV | ||
| Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96654 — Plex / Media Server. Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply thei… |
CISA KEV | ||
| Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96655 — Plex / Media Server. Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/vid… |
CISA KEV | ||
| Plex Media Server External Control of File Name or Path Vulnerability CVE-2026-96656 — Plex / Media Server. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerabil… |
CISA KEV | ||
| EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CVE-2026-106931 — EG Secure Solutions / SiteGuard Server Edition. EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands w… |
CISA KEV | ||
| Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware Hackers are exploiting flaws in Plex Media Server to install cryptocurrency mining malware, with a researcher recording successful attacks against a honeypot on October 17, 2026. The activity follows the release of Plex2… |
Cyber Security News | ||
| Group-IB Named Visionary Leader | Frost Radar ERMM 2026 Frost & Sullivan recognized Group-IB for innovation leadership in ERMM, highlighting three areas: Intelligence from original research and investigations. Frost identifies Group-IB’s proprietary intelligence origination a… |
Group-IB | None reported |