Vulnerability intelligence

CVE-2025-62593 describes a remote code execution (RCE) vulnerability affecting Ray, an AI compute engine, in versions prior to 2.52.0. The flaw lies in Ray's HTTP API endpoint handling, where an insufficient defense mechanism relies solely on the User-Agent header starting with "Mozilla". This defense is inadequate because the fetch specification allows for the manipulation of the User-Agent header. This vulnerability can be exploited when a developer running Ray visits a malicious website in a vulnerable browser, such as Firefox or Safari. The attack combines the User-Agent bypass with a DNS rebinding attack, tricking the browser into treating a remote attacker-controlled server and the local Ray instance as the same origin. This allows an attacker to trigger arbitrary code execution on the developer's system. The issue has been addressed in Ray version 2.52.0.

CVE-2026-41452 is a missing authentication vulnerability found in Krayin CRM version 2.2.4. This flaw resides within the installer middleware, allowing unauthenticated remote attackers to overwrite the primary administrator account. Attackers can exploit this by sending a specially crafted HTTP POST request that includes the `X-Requested-With: XMLHttpRequest` header. This bypasses the `CanInstall` middleware redirect check, enabling them to supply arbitrary name, email, and password values to the `admin-config-setup` endpoint. This endpoint then performs an unauthenticated `updateOrInsert` operation targeting the hardcoded administrator user ID, effectively granting the attacker full administrative access to the CRM.

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

CVE-2026-59310 is identified as a directory traversal vulnerability present in the VMware vCenter Syslog server. This flaw enables a remote, unauthenticated attacker with network access to a susceptible vCenter instance to manipulate file and directory paths beyond their intended boundaries. Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected vCenter system. The issue impacts VMware vCenter and other VMware platforms that incorporate the vulnerable vCenter component.

CVE-2026-55040 is an authentication bypass vulnerability affecting Microsoft SharePoint Server. This flaw stems from issues within the JSON Web Token (JWT) validation pipeline, allowing a remote, unauthenticated attacker to bypass the authentication process. By exploiting this vulnerability, an attacker can assume the identity of any SharePoint site user, provided they know the target user's Active Directory Security ID (SID) or User Principal Name (UPN). This authentication bypass can be chained with other vulnerabilities to achieve further compromise, such as unauthenticated remote code execution. The vulnerability was discovered by Rapid7 Labs during a zero-day research project.