Loading story…
Two high-severity vulnerabilities were disclosed in Gotenberg, the document-conversion API, affecting separate parts of the product’s request-handling logic. CVE-2026-27018 allows a deny-list bypass in Chromium-based processing because protections added for CVE-2024-21527 can be evaded with mixed-case or uppercase URL schemes, creating exposure associated with CWE-22 and CWE-918. The flaw is remotely reachable with low attack complexity and requires no privileges or user interaction, according to the published CVSS v4 metadata.
A second issue, CVE-2026-35458, affects Gotenberg 8.29.1 and earlier and can be exploited for regular expression denial of service through the extraHttpHeaders scope feature. User-supplied scope patterns are compiled with dlclark/regexp2 without an adequate timeout, allowing authorized users of the affected feature to hang workers indefinitely and degrade service availability. The SSRF-related bypass was patched in Gotenberg 8.29.0, while the ReDoS issue highlights an additional availability risk for deployments that expose header-scoping functionality.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A new vulnerability, CVE-2026-35458, was recorded for Gotenberg affecting version 8.29.1 and earlier. The flaw stems from compiling user-supplied scope patterns with dlclark/regexp2 without a proper timeout, allowing workers to be hung indefinitely and causing availability impact.
The CVE-2026-27018 advisory for Gotenberg was received by security-advisories@github.com. The issue was classified under CWE-22 and CWE-918 and described as network exploitable with low attack complexity.
Gotenberg fixed a vulnerability later assigned CVE-2026-27018 in version 8.29.0. The flaw allowed bypass of the prior CVE-2024-21527 fix by using mixed-case or uppercase URL schemes, enabling deny-list evasion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-4750** and **CVE-2026-4753**, were disclosed for the open-source projects **fabiangreffrath woof** and **slajerek RetroDebugger**. Both issues are classified as **CWE-125 out-of-bounds read** flaws and carry the same **CVSS v3.1** score vector, `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`, indicating low-complexity, no-authentication exploitation with high impact on confidentiality and availability. The Woof flaw affects versions before **`woof_15.3.0`**, while the RetroDebugger issue affects versions before **`v0.64.72`**. Each CVE entry also points to a related GitHub pull request tied to remediation or discussion, including **PR #97** for RetroDebugger, signaling that fixes or code changes have been tracked publicly. Organizations using either project should identify exposed deployments and prioritize upgrades to patched versions.
Jun 29, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026