Archive snapshot

Wed, Sep 30 · 12:00 PM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Wed, Sep 30 · 12:00 PM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

1

NVD vulnerabilities

25

Top stories

Wed, 30 Sep 2026 17:00:00 +0530

AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub

9.8/10 · Must read/watch

The Hacker Newssupply-chainai

Summary
AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow said. Its researchers found more than 13,000 internal images from developers at over 300 organizations,

Open article ↗

Wed, Sep 30 · 12:00 PM CDT

Apple Patches CoreGraphics Zero Day Exploited in Attacks

9.4/10 · Must read/watch

Infosecurity Magazinevuln

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, Sep 30 · 12:00 PM CDT

Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware

9.3/10 · Must read/watch

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, 30 Sep 2026 20:54:54 +0530

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

9.3/10 · Must read/watch

The Hacker Newsvulnaiidentity

Summary
Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker

Open article ↗

Wed, Sep 30 · 12:00 PM CDT

AI-Found Vulnerabilities More Likely to Enable RCE, Google Says

8.7/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Worth skimming

Wed, Sep 30 · 12:00 PM CDT

Trump, Six AI Giants Sign 'Super Intelligence' Safety Accord

8.7/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, Sep 30 · 12:00 PM CDT

AI Boosts SOC Analyst Capacity but Limits Skill Development

8.7/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, 30 Sep 2026 20:30:15 +0530

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

8.1/10 · Worth your time

The Hacker Newsmalwareai

Summary
Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said

Open article ↗

Wed, 30 Sep 2026 17:28:00 +0530

Know Your Enemy: Browser-Based Attack Techniques in 2026

8.1/10 · Worth your time

The Hacker Newsai

Summary
Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltrati

Open article ↗

Wed, Sep 30 · 11:00 AM CDT

The AI Race Just Got Awkward

8.1/10 · Worth your time

Hacker Newsai

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 1 hour ago.

Open article ↗

Videos worth watching

Wed, Sep 30 · 08:00 AM CDT

Google built PageBreak and it found 500 XSS on Google’s own application. That kinda hurts 😭

8.0/10 · Worth your time

YouTube / NahamSecgeneral

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NVD vulnerabilities

Thu, Jul 23 · 10:16 PM CDT

CVE-2025-71389

10.0/10 · Must read/watch

NVDvuln

Summary
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be

CVECVE-2025-71389

SeverityCRITICAL

TypeUPDATED

PublishedThu, Jul 23 · 10:16 PM CDT

ModifiedTue, Sep 29 · 02:10 PM CDT

Open article ↗

Tue, Jul 07 · 05:16 PM CDT

CVE-2026-13019

9.8/10 · Must read/watch

NVDvuln

Summary
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupport

CVECVE-2026-13019

SeverityCRITICAL

TypeUPDATED

PublishedTue, Jul 07 · 05:16 PM CDT

ModifiedTue, Sep 29 · 08:17 PM CDT

Open article ↗

Wed, Jan 21 · 07:16 AM CST

CVE-2026-24061

9.8/10 · Must read/watch

NVDvuln

Summary
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

CVECVE-2026-24061

SeverityCRITICAL

TypeUPDATED

PublishedWed, Jan 21 · 07:16 AM CST

ModifiedTue, Sep 29 · 08:17 PM CDT

Open article ↗

Fri, Jun 26 · 04:16 PM CDT

CVE-2025-11919

9.6/10 · Must read/watch

NVDvuln

Summary
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shar

CVECVE-2025-11919

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jun 26 · 04:16 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Wed, Jun 17 · 03:17 PM CDT

CVE-2026-54812

9.3/10 · Must read/watch

NVDvuln

Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.

CVECVE-2026-54812

SeverityCRITICAL

TypeUPDATED

PublishedWed, Jun 17 · 03:17 PM CDT

ModifiedWed, Sep 30 · 06:17 AM CDT

Open article ↗

Fri, Jun 26 · 01:16 PM CDT

CVE-2025-55017

9.1/10 · Must read/watch

NVDvuln

Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

CVECVE-2025-55017

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jun 26 · 01:16 PM CDT

ModifiedTue, Sep 29 · 08:10 PM CDT

Open article ↗

Fri, Jun 26 · 01:16 PM CDT

CVE-2025-64152

9.1/10 · Must read/watch

NVDvuln

Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.

CVECVE-2025-64152

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jun 26 · 01:16 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Fri, Jul 10 · 07:17 PM CDT

CVE-2025-30007

8.8/10 · Worth your time

NVDvuln

Summary
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_vali

CVECVE-2025-30007

SeverityHIGH

TypeUPDATED

PublishedFri, Jul 10 · 07:17 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Sat, Jul 11 · 07:16 AM CDT

CVE-2025-6784

8.8/10 · Worth your time

NVDvuln

Summary
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributo

CVECVE-2025-6784

SeverityHIGH

TypeUPDATED

PublishedSat, Jul 11 · 07:16 AM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Fri, Jun 26 · 03:16 PM CDT

CVE-2025-68052

8.8/10 · Worth your time

NVDvuln

Summary
Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.

CVECVE-2025-68052

SeverityHIGH

TypeUPDATED

PublishedFri, Jun 26 · 03:16 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Sat, Jul 18 · 02:17 PM CDT

CVE-2025-71390

8.8/10 · Worth your time

NVDvuln

Summary
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http:: ( ) with a hostname that resolves to a denied IP address, causing the server to issue the req

CVECVE-2025-71390

SeverityHIGH

TypeUPDATED

PublishedSat, Jul 18 · 02:17 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Thu, Jul 02 · 12:17 PM CDT

CVE-2026-57759

8.8/10 · Worth your time

NVDvuln

Summary
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.

CVECVE-2026-57759

SeverityHIGH

TypeUPDATED

PublishedThu, Jul 02 · 12:17 PM CDT

ModifiedWed, Sep 30 · 08:16 AM CDT

Open article ↗

Mon, Jul 27 · 07:16 AM CDT

CVE-2025-15662

8.6/10 · Worth your time

NVDvuln

Summary
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing data

CVECVE-2025-15662

SeverityHIGH

TypeUPDATED

PublishedMon, Jul 27 · 07:16 AM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Fri, Jun 19 · 06:16 AM CDT

CVE-2025-7737

8.6/10 · Worth your time

NVDvuln

Summary
DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-07-01-80/00-07, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-82-80/00-06,

CVECVE-2025-7737

SeverityHIGH

TypeUPDATED

PublishedFri, Jun 19 · 06:16 AM CDT

ModifiedTue, Sep 29 · 08:10 PM CDT

Open article ↗

Fri, Jul 24 · 07:16 PM CDT

CVE-2026-17107

8.5/10 · Worth your time

NVDvuln

Summary
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unre

CVECVE-2026-17107

SeverityHIGH

TypeUPDATED

PublishedFri, Jul 24 · 07:16 PM CDT

ModifiedTue, Sep 29 · 07:17 PM CDT

Open article ↗

Mon, Jul 06 · 05:16 PM CDT

CVE-2025-53831

8.2/10 · Worth your time

NVDvuln

Summary
DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization

CVECVE-2025-53831

SeverityHIGH

TypeUPDATED

PublishedMon, Jul 06 · 05:16 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Fri, Jun 10 · 08:15 PM CDT

CVE-2022-25863

8.1/10 · Worth your time

NVDvuln

Summary
The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both

CVECVE-2022-25863

SeverityHIGH

TypeUPDATED

PublishedFri, Jun 10 · 08:15 PM CDT

ModifiedTue, Sep 29 · 03:50 PM CDT

Open article ↗

Fri, Jan 13 · 07:15 PM CST

CVE-2023-22491

8.1/10 · Worth your time

NVDvuln

Summary
Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless input i

CVECVE-2023-22491

SeverityHIGH

TypeUPDATED

PublishedFri, Jan 13 · 07:15 PM CST

ModifiedTue, Sep 29 · 03:06 PM CDT

Open article ↗

Wed, Sep 04 · 08:15 PM CDT

CVE-2024-44986

8.1/10 · Worth your time

NVDvuln

Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive.

CVECVE-2024-44986

SeverityHIGH

TypeUPDATED

PublishedWed, Sep 04 · 08:15 PM CDT

ModifiedTue, Sep 29 · 01:17 PM CDT

Open article ↗

Sat, Jul 18 · 02:17 PM CDT

CVE-2025-71392

8.0/10 · Worth your time

NVDvuln

Summary
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently

CVECVE-2025-71392

SeverityHIGH

TypeUPDATED

PublishedSat, Jul 18 · 02:17 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Tue, Jun 30 · 10:16 AM CDT

CVE-2025-24815

7.8/10 · Worth your time

NVDvuln

Summary
Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.

CVECVE-2025-24815

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 30 · 10:16 AM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Fri, Jul 24 · 10:16 PM CDT

CVE-2025-71408

7.8/10 · Worth your time

NVDvuln

Summary
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly

CVECVE-2025-71408

SeverityHIGH

TypeUPDATED

PublishedFri, Jul 24 · 10:16 PM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Tue, Jun 30 · 10:16 AM CDT

CVE-2025-7406

7.8/10 · Worth your time

NVDvuln

Summary
Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The

CVECVE-2025-7406

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 30 · 10:16 AM CDT

ModifiedTue, Sep 29 · 07:10 PM CDT

Open article ↗

Wed, Jun 17 · 01:19 PM CDT

CVE-2026-0019

7.8/10 · Worth your time

NVDvuln

Summary
In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVECVE-2026-0019

SeverityHIGH

TypeUPDATED

PublishedWed, Jun 17 · 01:19 PM CDT

ModifiedTue, Sep 29 · 12:17 PM CDT

Open article ↗

Mon, Mar 02 · 07:16 PM CST

CVE-2026-0017

7.7/10 · Worth your time

NVDvuln

Summary
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVECVE-2026-0017

SeverityHIGH

TypeUPDATED

PublishedMon, Mar 02 · 07:16 PM CST

ModifiedTue, Sep 29 · 12:17 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.