TrueConf, MLflow, Cisco Vulnerabilities Highlight Daily Threats
CISA adds exploited TrueConf flaws to KEV; MLflow, Cisco, Joomla, IBM, and Rust crates also see critical vulnerabilities disclosed.
Two critical vulnerabilities in TrueConf, a video conferencing platform, have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-72529 allows for arbitrary script execution by exploiting an undocumented function, while CVE-2026-72530 enables a breakout from isolated environments using specially crafted scripts. Both vulnerabilities affect TrueConf server versions 5.3.X through 5.5.5 and earlier, and are accessible via port 4307/TCP. Immediate patching is advised by CISA and other security advisories.
A critical Server-Side Request Forgery (SSRF) vulnerability in MLflow, an open-source platform for managing the machine learning lifecycle, is being actively exploited. CVE-2026-64849, affecting versions prior to 3.15.0, allows unauthenticated attackers to exploit the POST /api/2.0/mlflow/webhooks/{id}/test endpoint to steal cloud credentials and secrets. SecurityWeek and The Hacker News reported on the exploitation, with CISA also adding it to their KEV catalog.
Cisco has released a software hardening release addressing multiple vulnerabilities across its Crosswork and Secure Workload products. Among these, CVE-2026-20315 stands out with a CVSS score of 10.0, potentially allowing for remote code execution. The Hacker News and The Register highlighted the severity of these Cisco disclosures, with multiple advisories noting the critical nature of several flaws.
A critical pre-authentication PHP code injection vulnerability (CVE-2026-67364) has been disclosed in the Balbooa Forms Joomla extension, specifically in versions prior to 2.4.3.2. This flaw, rated with a CVSS 3.1 score of 9.8, allows unauthenticated attackers to execute arbitrary code by manipulating the optional custom-PHP post-submission handler. Vypr Intelligence noted this as one of 17 vulnerabilities disclosed for Joomla.
Multiple critical vulnerabilities have been identified in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. These include buffer overflows (CVE-2026-17152, CVE-2026-17141, CVE-2026-17122), improper privilege management (CVE-2026-17145), improper authentication (CVE-2026-17142), a format string vulnerability (CVE-2026-17136), and a use-after-free vulnerability (CVE-2026-17118). All these flaws could allow remote attackers to execute arbitrary code or commands.
Several critical vulnerabilities have been disclosed in Rust crates, impacting projects that use them during compilation. CVE-2026-77651 (arrayref crate 0.3.10), CVE-2026-77650 (append-only-vec crate 0.1.9), and CVE-2026-77649 (internment crate 0.8.7) all involve rogue dependencies that register with command-and-control servers, enabling arbitrary code execution. These supply-chain risks highlight the importance of secure development practices.