{"vulnerability": "CVE-2026-64849", "sightings": [{"uuid": "9caf4e78-1f45-41ce-85eb-838f7596cb38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mte7yorr6q2u", "content": "A public PoC for CVE-2026-64849, an unauthenticated MLflow SSRF (CVSS 9.3), is now live. watchTowr reports exploitation attempts. Patch to 3.15.0.\n\n#MLflow #CVE202664849 #SSRF #watchTowr #AISecurity #InfoSec", "creation_timestamp": "2026-08-18T12:33:10.966268Z"}, {"uuid": "3a8046f7-b330-4865-acf1-64ae4f4d2e94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mtiioj6ohg2m", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30921\u4ef6\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds One Known Exploited Vulnerability to Catalog  #CISA (Aug 19)\n\nCVE-2026-64849 MLflow\u30b5\u30fc\u30d0\u30fc\u30b5\u30a4\u30c9\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-08-20T05:19:11.898507Z"}, {"uuid": "518fa0dc-791e-42b4-b19c-a151138bdd62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mtecwjbhrg2w", "content": "An unauthenticated SSRF vulnerability in MLflow, CVE-2026-64849, is already being exploited in the wild. \n\nWithin hours of CVE assignment, watchTowr Intel via Attacker Eye, our global honeypot network, observed attac\u2026\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2089685887420440637)", "creation_timestamp": "2026-08-18T13:25:38.929750Z"}, {"uuid": "abdeafa9-c753-4cc8-b1a0-9911b680928b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mtnanrolbg2r", "content": "Top 3 CVE for last 7 days:\nCVE-2026-65400: 27 interactions\nCVE-2026-69836: 27 interactions\nCVE-2026-64849: 14 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-69836: 27 interactions\nCVE-2026-19490: 3 interactions\nCVE-2026-74866: 3 interactions\n", "creation_timestamp": "2026-08-22T02:38:55.888371Z"}, {"uuid": "8815ce99-2acf-41c8-85e9-f1db2c130007", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f87cac0a-5a98-4700-aa40-a3228e809c87", "content": "", "creation_timestamp": "2026-08-18T14:00:28.751972Z"}, {"uuid": "fd85d1ed-bff2-434f-ba7b-6e9c0db4aaf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtkkp23hsc2r", "content": "\ud83d\udea8 CVE-2026-64849 \u2014 Critical MLflow SSRF\n\nCVSS 9.3 \u2022 No authentication required \u2022 Public PoC available \u2022 Nuclei template released \u2022 Active exploitation confirmed \u2022 Added to CISA KEV.\n\nstemshop.top/blog/cve-202...\n\n#CVE #CVE202664849 #MLflow #AI #SSRF #CyberSecurity #InfoSec #Exploit #PoC #CISA", "creation_timestamp": "2026-08-21T01:00:42.674569Z"}, {"uuid": "6780c62d-7787-4666-9f47-248936dc1cac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/hackread.bsky.social/post/3mto7xcg36k2z", "content": "Attackers are exploiting a critical MLflow bug to reach internal systems and cloud metadata, putting cloud secrets at risk. CISA has added CVE-2026-64849 to its KEV catalog.\n\nListen/Read: hackread.com/attackers-ex...\n\n#CyberSecurity #MLflow #AI #Vulnerability #CISA", "creation_timestamp": "2026-08-22T11:59:07.305909Z"}, {"uuid": "c58b3e24-5996-4b7c-9a94-02f679433493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://mstdn.social/users/Hackread/statuses/117139044135086822", "content": "Attackers are exploiting a critical MLflow bug to reach internal systems and cloud metadata, putting cloud secrets at risk. CISA has added CVE-2026-64849 to its KEV catalog.\nListen/Read: https://hackread.com/attackers-exploit-critical-mlflow-ai-platform-flaw/\n#CyberSecurity #MLflow #AI #Vulnerability #CISA", "creation_timestamp": "2026-08-22T11:59:26.357465Z"}, {"uuid": "318813ad-6322-4804-ad7e-b8108c8329d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64849", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mtiqo4iya42p", "content": "Your MLflow test endpoint doesn't ask for a login. Neither will the attacker.\n\nCVE-2026-64849.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-64849-mlflow-ssrf-leaks-cloud-metadata/\n\nby Yazoul AI #CyberSecurity #PatchNow", "creation_timestamp": "2026-08-20T07:42:08.792779Z"}, {"uuid": "a96db69a-5b5e-43f5-bec4-14de5799de16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-18T15:00:02.953728Z"}, {"uuid": "f67dcccd-eca9-496c-8444-d14d7c4e2f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mtepb45z4h2z", "content": "Critical SSRF vulnerability in MLflow (CVE-2026-64849) actively exploited; upgrade to 3.15.0 immediately to prevent unauthorized access. #MLflow #SSRF #CyberSecurity #MachineLearning #DataSecurity thedailytechfeed.com/critical-mlf...", "creation_timestamp": "2026-08-18T17:06:19.867587Z"}, {"uuid": "20540d3d-2975-4cd3-b3ff-0f7bb9bae9ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mtjbmdtena2n", "content": "CISA says attackers are actively exploiting CVE-2026-64849 in MLflow, using a DNS-rebinding SSRF bypass to reach internal services and cloud metadata, risking AWS IAM credential theft on unpatched systems. #MLflow #CISA #AWS", "creation_timestamp": "2026-08-20T12:45:23.150254Z"}, {"uuid": "164232a2-5645-4bbc-b241-d5f074d31089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64849", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mtezagljq22f", "content": "MLflow SSRF (CVE-2026-64849): exploited for cloud metadata credential theft hours after disclosure. Patch ML infra like production. #ThreatIntel #AIsecurity #CriticalInfrastructure https://threat-intelligence.redeyesecurity.com/blog/mlflow-ssrf-cve-2026-64849-cloud-credential-theft-2026", "creation_timestamp": "2026-08-18T20:04:54.484618Z"}, {"uuid": "b9328d6c-75c1-405a-8625-f04fe3991b51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mthc5vwzr72p", "content": "\ud83d\uded1 CVE-2026-64849\nMLflow MLflow\nCVSS 9.3 / EPSS 1% / KEV \u2705\nTL;DR: MLflow is an open source AI engineering platform for agents, large language models, and machine\u2026\nhttps://cvesentinel.com/report/CVE-2026-64849?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-19T17:49:52.553129Z"}, {"uuid": "806e7724-54e4-465f-9fd7-b2c31783b86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mtf2kobzid25", "content": "\ud83e\udd16 CVE-2026-64849 (CVSS 9.3): unauthenticated SSRF in MLflow (<3.15.0) exploited in the wild to exfiltrate cloud credentials. CVE-2026-25895 (CVSS 9.5): path traversal to RCE in FUXA SCADA/HMI, mass scanning.\nhttps://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html", "creation_timestamp": "2026-08-18T20:28:31.184194Z"}, {"uuid": "695fca4c-eeff-42da-9a5a-0ed73bf1af14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mtnt2mwhlh2l", "content": "COGNOSCERE Tech Brief \u2014 2026-08-22\n\nCVE-2026-64849, a CVSS 9.3 unauthenticated SSRF in MLflow's webhook API, is unde\n\nhttps://www.cognoscerellc.com/news", "creation_timestamp": "2026-08-22T08:08:17.871354Z"}, {"uuid": "70a63028-e6ef-43d0-8fe4-1ef8fe813364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtji4yxyoj2w", "content": "\ud83d\udea8 CVE-2026-64849 is a critical unauthenticated SSRF discovered in MLflow.\n\nIt lets attackers reach internal services and potentially steal sensitive data.\n\nUpgrade to version 3.15.0 as it also fixes two additional flaws affecting MLflow, CVE-2026-69148 and CVE-2026-69146. \n\nDetails: buff.ly/Gjg9jor", "creation_timestamp": "2026-08-20T14:42:04.607365Z"}, {"uuid": "61c179b0-f702-4c66-9de1-176c99c79cd1", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9fc3fe97-7585-44d9-af56-6bae58615f6f", "content": "", "creation_timestamp": "2026-08-19T18:00:01.540208Z"}, {"uuid": "b2ab106b-4ca7-4a6d-8eb5-2df087fca179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mtf4kbvv5w2m", "content": "MLflow SSRF (CVE-2026-64849) exploit for cloud creds in hours, bypassing prior fixes. You gotta hand it to 'em, the attackers don't waste time. Relentless", "creation_timestamp": "2026-08-18T21:04:07.220630Z"}, {"uuid": "7f944814-a947-43f4-afc6-0033a327b3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mtf7vxl4xx2k", "content": "Two critical vulnerabilities in MLflow (CVE-2026-64849, CVSS 9.3) and FUXA (CVE-2026-25895, CVSS 9.5) are under active exploitation. Attackers are exploiting [\u2026]", "creation_timestamp": "2026-08-18T22:04:24.202016Z"}, {"uuid": "84c1e646-b63b-4880-88b1-446946befeca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64849", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mtjk5qzybl2l", "content": "\ud83d\udcf0 CISA Peringatkan Eksploitasi Aktif Celah Kritis MLflow yang Bisa Curi Kredensial Cloud\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/08/20/celah-kritis-mlflow-cve-2026-64849/\n\n#ai #cybersecurity #keamananSiber #vulnerability", "creation_timestamp": "2026-08-20T15:18:17.023965Z"}, {"uuid": "ebf29768-e71d-4e88-ab4d-cab82cfc1b1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/intelnightowl.bsky.social/post/3mtjk5rajo52n", "content": "CISA adds critical MLflow SSRF vulnerability (CVE-2026-64849) to its Known Exploited Vulnerabilities catalog, prompting patch urgency. #CISA #MLflow #SSRF #CVE202664849 #KnownEx https://securityaffairs.com/197558/hacking/u-s-cisa-adds-a-mlflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html", "creation_timestamp": "2026-08-20T15:18:17.616487Z"}, {"uuid": "0acacb4f-e52d-4ede-9618-a00ba08d7a01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-22T00:00:09.037659Z"}, {"uuid": "ee37b479-5aed-4372-aa45-104d6389b1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mthg3qes4x2p", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0819)\n\n\u26a0\ufe0f CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-08-19T19:00:14.420853Z"}, {"uuid": "861013ea-3c65-4312-914f-7d9f7b11d941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mtjoyp55xl2h", "content": "CVE-2026-64849 exposes unauthenticated MLflow tracking servers to critical server-side request forgery (SSRF) threats via redirect bypasses. Discover immediate mitigation strategies, CISA KEV compliance guidelines, and SOC detection playbooks to secure your AI infrastructure.\u2026", "creation_timestamp": "2026-08-20T16:44:56.167937Z"}, {"uuid": "5a36664e-1d7c-493f-ae6f-b7ac6e2f652d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mthil7nmgd2u", "content": "MLflow has an unauthenticated SSRF (CVE-2026-64849, CVSS 9.3) that reaches cloud metadata and returns the response, so it reads your instance credentials.\n\nEvery version before 3.15.0 is affected. Now on CISA's KEV list.\n\nPatch to 3.15.0 and enforce IMDSv2.", "creation_timestamp": "2026-08-19T19:44:41.593709Z"}, {"uuid": "5e7eccd5-f375-44b6-9fb5-d7d6b66894b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mthjrajchz2n", "content": "~Cisa~\nCISA added CVE-2026-64849, an actively exploited MLflow SSRF vulnerability, to its KEV Catalog.\n-\nIOCs: CVE-2026-64849\n-\n#CVE202664849 #MLflow #ThreatIntel", "creation_timestamp": "2026-08-19T20:05:58.189099Z"}, {"uuid": "9d711055-105f-4d83-b07f-61e59b5e931a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/mlflow-security-advisory-av26-832", "content": "", "creation_timestamp": "2026-08-19T20:15:03.874725Z"}, {"uuid": "263917b5-ef45-4d09-bbe3-3204e204e813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mtfeorh3bu2r", "content": "\ud83d\udea8 CRITICAL & ACTIVELY EXPLOITED: A severe SSRF flaw (CVE-2026-64849) in the MLflow AI platform allows attackers to steal cloud credentials. Upgrade to version 3.15.0 immediately and ensure your servers are not public-facing. #MLflow #SSRF #CyberSecu...\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-08-18T23:29:46.405667Z"}, {"uuid": "441adf1d-11ae-4fcd-bae4-ff59d76e12db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mthm5lluu52s", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-64849", "creation_timestamp": "2026-08-19T20:48:39.200773Z"}, {"uuid": "7527cf66-3ca4-4e1b-9229-848fe926558e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-19T00:00:03.269533Z"}, {"uuid": "fb5da128-3416-493a-b983-d41db094bfd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64849", "type": "published-proof-of-concept", "source": "https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j", "content": "", "creation_timestamp": "2026-08-17T22:35:08.105247Z"}, {"uuid": "84f19cba-7023-4721-b81a-d11f61e56d65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtcsnmaylb27", "content": "\ud83d\udd34 CVE-2026-64849 - Critical (9.3)\n\nMLflow is an open source AI engineering platform for agents, large language models, and machine l...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-64849/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-17T23:01:41.179609Z"}, {"uuid": "13cecc3f-a9b9-4315-bdb9-cb5666ab4862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtcve7jajr25", "content": "CVE-2026-64849 - mlflow\nThe MLflow Tracking Server's default setup exposes an unauthenticated model-registry webhooks API. An attacker can use this to read sensitive information without authentication by hosting\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#mlflow #pip #CVE #infosec", "creation_timestamp": "2026-08-17T23:50:06.343888Z"}, {"uuid": "8d53d775-a68d-42c6-a56a-4d462e6e727a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtcwe7dhu723", "content": "\ud83d\udea8 CVE-2026-64849 \u2014 CVSS 9.3 CRITICAL\n\nMLflow is an open source AI engineering platform for agents, large language models, and machine learning mo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-64849\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T00:08:01.089970Z"}, {"uuid": "284e16f3-f63c-443a-82c5-c5532db8df86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://gist.github.com/alon710/9d43dd3bb8cad3aff005a6b8be53e64d", "content": "# CVE-2026-64849: CVE-2026-64849: Server-Side Request Forgery (SSRF) in MLflow Webhooks via DNS Rebinding\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-64849\n\n## Summary\nCVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting MLflow tracking servers prior to version 3.15.0. It allows unauthenticated remote attackers to bypass outbound request destination filters using DNS rebinding or HTTP redirects. This exposure risks compromising sensitive cloud infrastructure metadata and internal microservices.\n\n## TL;DR\nA Time-of-Check to Time-of-Use (TOCTOU) vulnerability in MLflow webhooks allows unauthenticated remote attackers to bypass IP constraints and extract sensitive local or cloud metadata credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.3\n- **Vulnerability Type**: Server-Side Request Forgery (SSRF)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- MLflow Tracking Server\n- **MLflow**: < 3.15.0 (Fixed in: `3.15.0`)\n\n## Mitigation\n\n- Upgrade MLflow to version 3.15.0 or later to enable socket-level validation.\n- Implement host-level firewall configurations to restrict outbound network requests to internal spaces.\n- Place MLflow behind an authentication gateway or configure local authentication to restrict access.\n\n**Remediation Steps:**\n1. Identify current MLflow running instances and check their versions using Python command.\n2. If the version is prior to 3.15.0, schedule an immediate package upgrade.\n3. Apply firewalls limiting egress to private and link-local IP addresses as a temporary workaround if an upgrade cannot be executed.\n4. Ensure environment configurations do not expose local proxies to the MLflow execution environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-7gwp-5pfp-969j](https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j)\n- [GitHub Issue Discussion #24179](https://github.com/mlflow/mlflow/issues/24179)\n- [GitHub Fixing Pull Request #24258](https://github.com/mlflow/mlflow/pull/24258)\n- [GitHub Security Patch Commit](https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939)\n- [MLflow v3.15.0 Release Notes](https://github.com/mlflow/mlflow/releases/tag/v3.15.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-64849) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T00:32:32.384543Z"}, {"uuid": "601906c6-868d-4da2-bda1-a735c74c72e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtd2q5fa7e2z", "content": "Critical MLflow Hole, Because Modern AI Loves Falling Through Floors\nPANIC 84% | Lag 0.0h | CVE-2026-64849 is a critical 9.3 vulnerability affecting MLflow, an AI engineering platform used for\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-18T01:26:15.779024Z"}, {"uuid": "8789b471-50e8-473f-8b20-e2c793d428ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/endoflife.ai/post/3mtm3gvsqv42e", "content": "\ud83d\udcd6 New from endoflife.ai:\n\nMLflow 2.x: Actively Exploited (CVE-2026-64849), Fixed Only in 3.15 \u2014 and Never Declared End of Life\n\nhttps://endoflife.ai/article-mlflow-2-eol", "creation_timestamp": "2026-08-21T15:32:56.556023Z"}, {"uuid": "2120cc82-8117-4f8a-ac24-e1daf56f30c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-20T00:00:08.243666Z"}, {"uuid": "6dc61ca4-ba17-422d-8767-a4c111baead2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://t.me/true_secator/8535", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0438 \u0437\u043d\u0430\u0447\u0438\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u0433\u043e\u0434\u0430 Cloudflare \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Spectre \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445. \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0430 \u0441\u0432\u043e\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0435 \u043c\u0435\u0440\u044b, \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u043e\u0432\u044b\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0430\u0442\u0430\u043a Spectre.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f Dynamic Process Isolation, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b. \u0422\u0435\u043f\u0435\u0440\u044c \u043e\u043d\u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u0435\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0435\u043c\u043a\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0432\u0432\u043e\u0434\u0430-\u0432\u044b\u0432\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u043c\u0438 \u0430\u0442\u0430\u043a\u0438 Spectre.\n\n2. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CVE-2026-19478 \u0432 GitLab \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0441\u0435\u0442\u0438 PoC-\u043a\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u043f\u0440\u043e\u0435\u043a\u0442\u044b GitLab \u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435. \n\n3. \u0422\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SSRF (CVE-2026-64849, CVSS 9.3) \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 MLflow AI, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 TrueConf, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0432\u0438\u0434\u0435\u043e\u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0439, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\n\n4. \u0423\u0447\u0451\u043d\u044b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 DDoS, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0443\u044e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0430\u0439\u0442\u044b \u0438 \u0440\u0435\u0441\u0443\u0440\u0441\u044b, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 CDN. \u0412 \u043d\u0435\u0439 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CDN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 HTTP/3-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043e\u0442 \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430, \u043d\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0441\u0442\u0430\u0440\u044b\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b HTTP/1.\n\nCDN Tsunami attack \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c: \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0431\u044a\u0451\u043c HTTP/3-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 CDN, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0435\u043c \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u043e\u0433\u0440\u043e\u043c\u043d\u044b\u0439 \u043e\u0431\u044a\u0451\u043c HTTP/1-\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0441\u0430\u0439\u0442\u044b \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432. \u041e\u0434\u043d\u0430\u043a\u043e \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u0432\u0435 CDN \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u043c\u0435\u0440\u044b \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f.\n\n5. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Elementor Pro \u0434\u043b\u044f WordPress \u0441 10 \u043c\u043b\u043d. \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0434\u043b\u044f RCE \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u043d\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e.\n\nCVE-2026-32475 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Elementor Pro \u0434\u043e 4.2.2 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u043e\u0434\u0443\u043b\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0446\u0438\u043a\u043b\u044b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u043e-\u0440\u0430\u0437\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043f\u0443\u0441\u0442\u044b\u043c\u0438 \u0438\u043c\u0435\u043d\u0430\u043c\u0438.\n\n6. \u041e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 Citrix NetScaler. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435, \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0431\u0435\u0437 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044e Citrix, CVE-2026-19490 (CVSS 9.3) \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u043a \u0448\u043b\u044e\u0437 (SSL VPN, ICA Proxy, CVPN, RDP Proxy) \u0438\u043b\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 AAA.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c\u00a0Rapid7, \u043d\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043e\u0434\u043d\u0430\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u0430\u044f \u0440\u043e\u043b\u044c NetScaler \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0434\u0435\u043b\u0430\u0435\u0442 \u0435\u0433\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u0434\u043b\u044f \u0445\u0430\u043a\u0435\u0440\u043e\u0432.\n\n7. \u041d\u0430 \u044d\u0442\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u0440\u044f\u0434 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0443\u0442\u0440\u0430\u0442\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 OpenAI Trusted Access for Cyber (TAC) \u0438\u0437-\u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438. \u041e\u043d\u0430 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u043c \u043a\u0438\u0431\u0435\u0440\u043c\u043e\u0434\u0435\u043b\u044f\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0446\u0435\u043b\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f ChatGPT Cyber. OpenAI \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u0432\u044b\u0437\u0432\u0430\u043b\u043e \u043e\u0448\u0438\u0431\u043a\u0443, \u043d\u043e \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u043f\u043e\u0434\u0430\u0442\u044c \u0437\u0430\u044f\u0432\u043a\u0443 \u0438 \u043f\u0440\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n8. Cisco \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 Crosswork \u0438 Secure Workload.\n\n\u0422\u0440\u0438 \u0438\u0437 \u043d\u0438\u0445, CVE-2026-20030, CVE-2026-20357 \u0438 CVE-2026-20358, \u0438\u043c\u0435\u044e\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVSS 10/10), \u0430 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u0430\u044f, CVE-2026-20359 - CVSS 9,9/10. Cisco \u043d\u0435 \u0440\u0430\u0441\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u043c \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0438\u0437 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445.\n\n9. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Microsoft Entra ID (CVSS 10.0) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445. CVE-2026-69836\u00a0(CVSS: 10.0) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 RCE, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0433\u0438\u0433\u0430\u043d\u0442\u0430. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442.\n\n10. Adversa AI \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u043f\u043e \u0435\u0435 \u0441\u043b\u043e\u0432\u0430\u043c, \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c\u00a0\u0447\u0430\u0442-\u0431\u043e\u0442 Grok \u043e\u0442 xAI\u00a0\u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043f\u0440\u0438\u0431\u043b\u0438\u0437\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0438 \u0438 \u043f\u043e\u0434\u0441\u043a\u0430\u0437\u043a\u0438 \u0438\u0437 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u0430 \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440.", "creation_timestamp": "2026-08-22T01:00:03.069483Z"}, {"uuid": "02921238-e6f2-4942-a74b-50b4ffd9786f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mti5wzv6lq24", "content": "\ud83d\udccc CVE-2026-64849 - MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated ... https://www.cyberhub.blog/cves/CVE-2026-64849", "creation_timestamp": "2026-08-20T02:07:06.397975Z"}, {"uuid": "bf8b3d54-5dc3-4fce-8420-0bba4b59333e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64849.yaml", "content": "", "creation_timestamp": "2026-08-21T00:00:06.681599Z"}, {"uuid": "d4da6b15-f758-4659-ba68-7661641e3715", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "published-proof-of-concept", "source": "Telegram/VqkK0eXOWhmRJZ90Bh3PqTJte1bxm7THA5YDoOUEdQFD0DQ", "content": "", "creation_timestamp": "2026-08-20T03:00:03.528761Z"}, {"uuid": "c2197c94-a6f0-4862-868b-945073c38d5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "published-proof-of-concept", "source": "Telegram/OE_j0lkcu_hy0tneu4LVEJjjSEMhrw6Me4lFPRcw_L7UUOA", "content": "", "creation_timestamp": "2026-08-20T03:00:04.686126Z"}, {"uuid": "e5aa2664-a9cc-4440-929a-5475fd9c6fa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "published-proof-of-concept", "source": "Telegram/VqkK0eXOWhmRJZ90Bh3PqTJte1bxm7THA5YDoOUEdQFD0DQ", "content": "", "creation_timestamp": "2026-08-21T00:00:11.691001Z"}, {"uuid": "2bc5ba40-c58a-47ca-8fde-7b2a4a6c9602", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "published-proof-of-concept", "source": "Telegram/OE_j0lkcu_hy0tneu4LVEJjjSEMhrw6Me4lFPRcw_L7UUOA", "content": "", "creation_timestamp": "2026-08-21T00:00:12.578641Z"}, {"uuid": "047c09e8-3af2-41d9-b2eb-35485bc680f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://t.me/GithubRedTeam/98700", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64849\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiuTrap\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-19 01:25:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64849 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:06.102204Z"}, {"uuid": "76e4c0cc-f7e1-446f-b0eb-0c069a4e32f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://t.me/GithubRedTeam/98680", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64849-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a codeb0ssx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-18 22:24:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:06.625465Z"}, {"uuid": "7b993295-dfc2-46ea-b449-99a0987dde8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98680", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64849-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a codeb0ssx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-18 22:24:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:11.150568Z"}, {"uuid": "1feb02d3-a2de-4c8c-88c1-ad27666ef303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98700", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64849\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiuTrap\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-19 01:25:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64849 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:11.843595Z"}, {"uuid": "4511e6ff-b998-4fb3-9d26-185d54d69a14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://t.me/true_secator/8535", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0438 \u0437\u043d\u0430\u0447\u0438\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u0433\u043e\u0434\u0430 Cloudflare \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Spectre \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445. \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0430 \u0441\u0432\u043e\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0435 \u043c\u0435\u0440\u044b, \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u043e\u0432\u044b\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0430\u0442\u0430\u043a Spectre.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f Dynamic Process Isolation, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b. \u0422\u0435\u043f\u0435\u0440\u044c \u043e\u043d\u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u0435\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0435\u043c\u043a\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0432\u0432\u043e\u0434\u0430-\u0432\u044b\u0432\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u043c\u0438 \u0430\u0442\u0430\u043a\u0438 Spectre.\n\n2. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CVE-2026-19478 \u0432 GitLab \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0441\u0435\u0442\u0438 PoC-\u043a\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u043f\u0440\u043e\u0435\u043a\u0442\u044b GitLab \u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435. \n\n3. \u0422\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SSRF (CVE-2026-64849, CVSS 9.3) \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 MLflow AI, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 TrueConf, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0432\u0438\u0434\u0435\u043e\u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0439, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\n\n4. \u0423\u0447\u0451\u043d\u044b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 DDoS, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0443\u044e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0430\u0439\u0442\u044b \u0438 \u0440\u0435\u0441\u0443\u0440\u0441\u044b, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 CDN. \u0412 \u043d\u0435\u0439 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CDN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 HTTP/3-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043e\u0442 \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430, \u043d\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0441\u0442\u0430\u0440\u044b\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b HTTP/1.\n\nCDN Tsunami attack \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c: \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0431\u044a\u0451\u043c HTTP/3-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 CDN, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0435\u043c \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u043e\u0433\u0440\u043e\u043c\u043d\u044b\u0439 \u043e\u0431\u044a\u0451\u043c HTTP/1-\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0441\u0430\u0439\u0442\u044b \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432. \u041e\u0434\u043d\u0430\u043a\u043e \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u0432\u0435 CDN \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u043c\u0435\u0440\u044b \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f.\n\n5. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Elementor Pro \u0434\u043b\u044f WordPress \u0441 10 \u043c\u043b\u043d. \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0434\u043b\u044f RCE \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u043d\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e.\n\nCVE-2026-32475 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Elementor Pro \u0434\u043e 4.2.2 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u043e\u0434\u0443\u043b\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0446\u0438\u043a\u043b\u044b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u043e-\u0440\u0430\u0437\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043f\u0443\u0441\u0442\u044b\u043c\u0438 \u0438\u043c\u0435\u043d\u0430\u043c\u0438.\n\n6. \u041e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 Citrix NetScaler. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435, \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0431\u0435\u0437 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044e Citrix, CVE-2026-19490 (CVSS 9.3) \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u043a \u0448\u043b\u044e\u0437 (SSL VPN, ICA Proxy, CVPN, RDP Proxy) \u0438\u043b\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 AAA.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c\u00a0Rapid7, \u043d\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043e\u0434\u043d\u0430\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u0430\u044f \u0440\u043e\u043b\u044c NetScaler \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0434\u0435\u043b\u0430\u0435\u0442 \u0435\u0433\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u0434\u043b\u044f \u0445\u0430\u043a\u0435\u0440\u043e\u0432.\n\n7. \u041d\u0430 \u044d\u0442\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u0440\u044f\u0434 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0443\u0442\u0440\u0430\u0442\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 OpenAI Trusted Access for Cyber (TAC) \u0438\u0437-\u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438. \u041e\u043d\u0430 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u043c \u043a\u0438\u0431\u0435\u0440\u043c\u043e\u0434\u0435\u043b\u044f\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0446\u0435\u043b\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f ChatGPT Cyber. OpenAI \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u0432\u044b\u0437\u0432\u0430\u043b\u043e \u043e\u0448\u0438\u0431\u043a\u0443, \u043d\u043e \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u043f\u043e\u0434\u0430\u0442\u044c \u0437\u0430\u044f\u0432\u043a\u0443 \u0438 \u043f\u0440\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n8. Cisco \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 Crosswork \u0438 Secure Workload.\n\n\u0422\u0440\u0438 \u0438\u0437 \u043d\u0438\u0445, CVE-2026-20030, CVE-2026-20357 \u0438 CVE-2026-20358, \u0438\u043c\u0435\u044e\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVSS 10/10), \u0430 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u0430\u044f, CVE-2026-20359 - CVSS 9,9/10. Cisco \u043d\u0435 \u0440\u0430\u0441\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u043c \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0438\u0437 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445.\n\n9. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Microsoft Entra ID (CVSS 10.0) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445. CVE-2026-69836\u00a0(CVSS: 10.0) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 RCE, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0433\u0438\u0433\u0430\u043d\u0442\u0430. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442.\n\n10. Adversa AI \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u043f\u043e \u0435\u0435 \u0441\u043b\u043e\u0432\u0430\u043c, \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c\u00a0\u0447\u0430\u0442-\u0431\u043e\u0442 Grok \u043e\u0442 xAI\u00a0\u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043f\u0440\u0438\u0431\u043b\u0438\u0437\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0438 \u0438 \u043f\u043e\u0434\u0441\u043a\u0430\u0437\u043a\u0438 \u0438\u0437 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u0430 \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440.", "creation_timestamp": "2026-08-23T00:00:46.515805Z"}, {"uuid": "09e6f8c5-9d1b-4868-a753-bd670694e605", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mtprnacyxk23", "content": "Top 3 CVE for last 7 days:\nCVE-2026-69836: 34 interactions\nCVE-2026-65400: 24 interactions\nCVE-2026-64849: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-16232: 7 interactions\nCVE-2026-69836: 7 interactions\nCVE-2026-50522: 3 interactions\n", "creation_timestamp": "2026-08-23T02:48:10.767926Z"}, {"uuid": "6e7c5ada-e9c7-4aa4-a3bb-102f99ee92aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://t.me/thehackernews/9834", "content": "\ud83d\udea8 Attackers are exploiting an MLflow flaw to steal cloud credentials.\n\nCVE-2026-64849 lets them reach internal cloud metadata services and extract secrets. Researchers detected scanning within hours of the CVE assignment.\n\nRead: https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html", "creation_timestamp": "2026-08-23T20:00:06.316339Z"}, {"uuid": "7cad0bcb-c481-4094-8de5-3d20af5ad4b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "exploited", "source": "https://t.me/thehackernews/9834", "content": "\ud83d\udea8 Attackers are exploiting an MLflow flaw to steal cloud credentials.\n\nCVE-2026-64849 lets them reach internal cloud metadata services and extract secrets. Researchers detected scanning within hours of the CVE assignment.\n\nRead: https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html", "creation_timestamp": "2026-08-24T00:00:04.952152Z"}, {"uuid": "7e742a7b-cc78-43b4-b429-84403fd917bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/thedroptimes.bsky.social/post/3mukldgddom2d", "content": "CISA lists CVE-2026-64849 as actively exploited. MLflow versions before 3.15.0 can expose internal services or cloud metadata through an SSRF flaw.\n\nhttps://bit.ly/4h6jpwT \n\n#Drupal #MLflow #CyberSecurity", "creation_timestamp": "2026-09-02T18:37:12.824529Z"}]}