CVE-2026-60004 is a remote code execution vulnerability patched by Gitea developers in late July with the release of version 1.27.1. The post CISA Warns of Exploited Gitea Vulnerability appeared first on SecurityWeek.
Gartner's survey of 316 companies ranked AI-driven vulnerability discovery as the highest-impact emerging cybersecurity risk, a significant shift from the previous quarter when information integrity risk topped the list. The change reflects growing concern among risk managers and executives about AI systems' capability to identify previously unknown flaws at scale. This marks a notable reassessment of threat priorities as organizations grapple with the dual-edged nature of AI in both attack and defense scenarios.
Attackers can exploit a networking vulnerability in NVIDIA's OpenClaw tool to gain unauthenticated access to the local model server via the Ollama API, enabling persistent corruption of AI agents. The flaw allows threat actors to conduct LLM poisoning attacks by manipulating the underlying model through this unprotected interface. This attack vector poses significant risks to organizations deploying NVIDIA's AI tools in production environments.
Two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981), both rated CVSS 9.8, in the miniOrange SAML 2.0 Single Sign On WordPress plugin are being actively exploited in the wild. Notably, the paid editions of the plugin were never listed as vulnerable in any CVE database despite being affected, and affected organizations require manual patching to remediate these flaws.