Vendor
Arbitrary Code Execution in AI Coding Agents via Git Configuration
1 rule 1 TTPMultiple AI coding agents are vulnerable to arbitrary code execution due to the automated, unsandboxed execution of commands defined within a repository's local Git configuration, specifically the 'core.fsmonitor' setting.
SSRF Vulnerability in Qwen-Agent Document Parsing
2 TTPs 1 CVEQwen-Agent version 0.0.34 and earlier contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to force the server to perform arbitrary internal HTTP requests and exfiltrate metadata service content.
Fortinet FortiOS CVE-2025-68686 Sensitive Information Exposure Bypass
1 TTP 3 CVEs 4 IOCsA remote unauthenticated attacker can exploit CVE-2025-68686 in Fortinet FortiOS to bypass a previously applied patch, allowing sensitive information exposure and enabling persistence post-exploitation, provided the product was already compromised at the filesystem level via another vulnerability.
Agentic AI Used to Conduct Ransomware Attack via Langflow
2 rules 10 TTPs 2 CVEsThreat actor JadePuffer exploited CVE-2025-3248 in Langflow instances, leveraging agentic LLM capabilities for advanced reconnaissance, lateral movement, and ultimately encrypting data on production servers with ransomware.
CVE-2026-50107: NGINX Gateway Fabric Configuration Injection Vulnerability
2 rules 1 TTP 5 CVEs 2 IOCsAn injection vulnerability, CVE-2026-50107, exists in the NGINX configuration generator component of NGINX Gateway Fabric when configured with NGINX Plus or NGINX Open Source as the data plane, allowing authenticated attackers with CRD modification permissions to inject arbitrary NGINX configuration directives via unsanitized user-supplied string values in the access log format setting, leading to control plane compromise and potential defense evasion or system impact.