Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

Sandbox Escape

Everything RedTeam Tribune has reported about Sandbox Escape: 2 stories, newest first. Part of our Vulnerabilities coverage.

16 Oct
Vulnerabilities

SGLang Arbitrary Code Execution Vulnerability in Unauthenticated Dumper Endpoint Affects 0.5.10-0.5.22

Attackers can run arbitrary Python code in the scheduler by exploiting a code injection flaw in unauthenticated SGLang endpoints.

14 Oct
Vulnerabilities

Chrome Sandbox Escape: AI-Assisted Chain of Three Zero-Days Impacts Windows Users

Xbow researchers used an AI model to chain three Chrome flaws, escaping the Windows sandbox in six days and earning a $250,000 bounty from Google.