LIVE · cybersecurity feed
Live wire
Malware Hijacks Android Car Head UnitsCritical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command ExecutionCVE-2026-73570 · U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalogCVE-2024-3094 · Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2Hundreds of leaked AWS keys give full control over corporate accountsAndroid Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy BotnetMalware injected into popular Rust packages to steal developer credentialsSix Maximum-Severity Flaws Found in Cisco ProductsCritical Isolated-vm Vulnerability Leads to RCE on Host

mlflow

CVE-2026-64849critical

U.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalog

CISA has added a critical server-side request forgery (SSRF) vulnerability in MLflow to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-64849 with a CVSS score of 9.3, the flaw allows unauthenticated attackers to make requests from exposed MLflow servers to internal services, potentially stealing cloud credentials. Exploitation has been observed in the wild, with active scanning for vulnerable instances occurring shortly after the CVE was assigned.