LiteLLM Flaw Exploited in Wild, Enables Unauthenticated RCE
A high-severity flaw in BerriAI's LiteLLM, known as CVE-2026-42271, has been actively exploited, allowing unauthenticated users to execute commands remotely. This critical vulnerability affects LiteLLM versions 1.74.2 to 1.83.7 and has been deemed a major security risk.
#CommandInjection #Litellm #Cve202642271 #RemoteCodeExecution #UnauthenticatedAttacks
Gitea Flaw Exposes Private Container Images to Unauthenticated Attacks
A newly disclosed vulnerability in Gitea, tracked as CVE-2026-27771, allows unauthenticated attackers to access private container images, potentially exposing tens of thousands of deployments worldwide. This flaw lets anyone on the internet pull private images without needing an account, password, or credentials.
#Gitea #Cve202627771 #ContainerSecurity #VulnerabilityExploit #UnauthenticatedAttacks
NGINX Flaw Enables Unauthenticated Remote Code Execution
A critical 18-year-old vulnerability, known as NGINX Rift, has been discovered in NGINX Plus and NGINX Open Source, allowing unauthenticated attackers to remotely execute code with a single crafted HTTP request. This high-severity flaw, rated 9.2 on the CVSS v4 scale, poses a significant threat to vulnerable servers.
#Nginx #RemoteCodeExecution #Cve202642945 #UnauthenticatedAttacks #HeapBufferOverflow
Hackers Exploit Weaver E-cology Bug in Targeted Attacks
Hackers are taking advantage of a critical bug in Weaver E-cology, using an exposed debug API endpoint to execute system commands on vulnerable servers without needing login credentials. This security flaw, tracked as CVE-2026-22679, affects Weaver E-cology 10.0 builds prior to March 12.
#Cve202622679 #WeaverEcology #RemoteCodeExecution #UnauthenticatedAttacks #EmergingThreats
Analyst207
