Vulnerability intelligence

CVE-2026-59309 is an authentication bypass vulnerability found within the VMware Directory Service component of VMware vCenter Server. This flaw allows a malicious actor with network access to vCenter to bypass authentication mechanisms and gain unauthorized access to the system. Broadcom, the vendor, disclosed this vulnerability on July 29, 2026, as part of a broader security advisory. While the vulnerability enables unauthorized access, Broadcom has not publicly detailed the precise bypass mechanism or the specific privilege level an attacker might achieve after successful exploitation.

CVE-2026-50656, publicly known as "RoguePlanet," is an elevation of privilege vulnerability found within the Microsoft Malware Protection Engine (MMPE), which serves as the core scanning component for Microsoft Defender. This flaw allows a local authenticated attacker to gain elevated privileges, specifically SYSTEM-level access, on a Windows machine by exploiting improper link resolution behavior during scanning and quarantine operations. The vulnerability is classified under CWE-59, indicating an issue with "Improper Link Resolution Before File Access (Link Following)," and involves a race condition that an attacker can leverage. Security researcher Nightmare Eclipse (also referred to as Chaotic Eclipse) discovered this vulnerability. Microsoft has acknowledged the issue and has since released a security update to address it. This update is automatically delivered through Defender platform updates, Windows Update, and WSUS to affected systems, which include Microsoft Defender Antivirus deployments utilizing MMPE on Windows endpoints and servers.

CVE-2025-34291 is a chained vulnerability affecting Langflow versions up to and including 1.6.9, which can lead to account takeover and remote code execution (RCE). This flaw stems from an overly permissive Cross-Origin Resource Sharing (CORS) configuration, where `allow_origins='*'` is combined with `allow_credentials=True`. This misconfiguration, coupled with a refresh token cookie set to `SameSite=None`, allows a malicious webpage to make cross-origin requests that include user credentials. By successfully calling the refresh endpoint, an attacker can obtain valid access and refresh token pairs for a victim's session. These acquired tokens can then be used to access authenticated endpoints, including those designed for code execution, ultimately enabling the attacker to achieve remote code execution. The vulnerability also involves a lack of CSRF protection on the token refresh endpoint and a code validation endpoint that permits code execution by design. Active exploitation of this vulnerability has been observed.

CVE-2026-72898 describes a SQL Injection vulnerability found in Metabase, an open-source business intelligence platform. This flaw allows an unauthenticated remote attacker to inject arbitrary SQL commands into the Metabase application database. The vulnerability is specifically exploitable via the `/reset_password` database endpoint. Successful exploitation of this vulnerability can grant an attacker administrator access to the Metabase instance. With this elevated access, an attacker could potentially alter application configurations, exfiltrate stored credentials for any connected databases, read data accessible through those connections, and export data.

CVE-2026-68820 is identified as a "Use after free" vulnerability found within the Windows Ancillary Function Driver for WinSock. This flaw enables an authorized attacker to achieve local privilege escalation. The vulnerability was recognized as a zero-day exploit and was actively leveraged in attacks. Microsoft addressed CVE-2026-68820 as part of its August 2026 Patch Tuesday release.

CVE-2026-20349 is a vulnerability affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw stems from insufficient error checking during the processing of HTTP requests. An unauthenticated, remote attacker can exploit this by sending a specially crafted HTTP request to the Remote Access SSL VPN service on an affected device. Successful exploitation of CVE-2026-20349 can cause the targeted appliance to reload, leading to a denial-of-service (DoS) condition. Cisco has released hotfixes to address this issue, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.