InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified six security vulnerabilities that are being actively exploited. These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
CVE-2023-27524 is a high-severity vulnerability in Apache Superset. It has a CVSS score of 8.9 and could allow remote code execution. The issue was resolved in version 2.1.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
In April 2023, Horizon3.ai’s Naveen Sunkavally revealed a problem with Apache Superset. The issue allows unauthorized attackers to remotely execute code, steal credentials, and compromise data.
It is currently unknown how the vulnerability is being exploited. CISA has also included five other flaws.
CVE-2023-38203 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
CVE-2023-29300 (CVSS score: 9.8) – Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
CVE-2023-41990 (CVSS score: 7.8) – Apple Multiple Products Code Execution Vulnerability
CVE-2016-20017 (CVSS score: 9.8) – D-Link DSL-2750B Devices Command Injection Vulnerability
CVE-2023-23752 (CVSS score: 5.3) – CVE-2023-41990, fixed in iOS 15.7.8 and iOS 16.3, was exploited by unknown actors in Operation Triangulation spyware attacks to execute code remotely via a specially crafted iMessage PDF attachment.
Federal agencies need to fix the mentioned bugs by January 29, 2024, to protect their networks from threats.
