Gov Alerts / ISAC

VU#280377: Dokploy is vulnerable to OS command injection

Overview Dokploy versions 0.29.8 and 0.29.11, as well as commit 24b02f5 on the canary branch, are vulnerable to OS command injecti…

ISC Stormcast For Thursday, September 17th, 2026 https://isc.sans.edu/podcastdetail/10098, (Thu, Sep 17th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Earlier today, I noted an odd request showing up in our "First Seen" report:

VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control

Overview A vulnerability in MLflow’s dspy and statsmodels model flavors allows unauthorized pickle deserialization executions desp…

VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

Overview A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for re…

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitat…

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitatio…

New CISA Guidance Helps Critical Infrastructure Detect, Observe and Impede Malicious Cyber Activity

ISC Stormcast For Wednesday, September 16th, 2026 https://isc.sans.edu/podcastdetail/10096, (Wed, Sep 16th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

MacOS 27 - First Boot, (Tue, Sep 15th)

I have not done this type of diary in a while: What traffic will you see from a system on boot, before a user logs in? I just took…

Multiple Vulnerabilities in Cisco Secure Email Products Could Allow for Remote Code Execution

Multiple vulnerabilities have been discovered in Cisco Secure Email products, the most severe of which could allow for remote code…

CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse

ISC Stormcast For Tuesday, September 15th, 2026 https://isc.sans.edu/podcastdetail/10094, (Tue, Sep 15th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Multiple Vulnerabilities in Mikrotik Routers Could Allow for Admin Hijacking

Multiple vulnerabilities have been discovered in MikroTik Routers, the most severe of which could allow for admin hijacking. Mikro…

Apple Updates Everything, (Mon, Sep 14th)

Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also…

A Vulnerability in GitLab Could Allow for Disclosure of Sensitive Data

A vulnerability has been discovered in GitLab, which could allow disclosure of sensitive data. GitLab GitLab is a DevOps platform…

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitatio…

ISC Stormcast For Monday, September 14th, 2026 https://isc.sans.edu/podcastdetail/10092, (Mon, Sep 14th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

Overview An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav…

The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

I identified an attacker using a semi-autonomous coding agent to run an offensive operation: finding poorly secured LLM resale gat…

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploit…

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitatio…

ISC Stormcast For Friday, September 11th, 2026 https://isc.sans.edu/podcastdetail/10090, (Fri, Sep 11th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

Overview An incorrect permissions assignment vulnerability in the amwrtdrv.sys kernel driver, included with AOMEI Backupper 8.4.0,…

Multiple Vulnerabilities in Ivanti Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Ivanti products, the most severe of which could allow for arbitrary code executio…

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

[This is a Guest Diary by Aaron Ng, an ISC intern as part of the SANS.edu BACS program]

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitat…

ISC Stormcast For Thursday, September 10th, 2026 https://isc.sans.edu/podcastdetail/10088, (Thu, Sep 10th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

A Vulnerability in SAP Extended Passport (EPP) Processing Could Allow for Remote Code Execution

A vulnerability has been discovered in SAP Extended Passport (EPP) Processing that could allow for remote code execution. SAP Exte…

Scans for Proxmox Servers, (Wed, Sep 9th)

About a week ago, Proxmox published an advisory revealing a vulnerability in older versions of Proxmox VE, its flagship Virtual En…