Gitea patched a critical flaw in the self-hosted Git platform that lets an unauthenticated attacker read any file the service account can access, needing only a public repository and crafted Org-mode markup. Tracked as CVE-2026-59774 and scored 9.8, it stems from the markup-rendering endpoint: Gitea initializes its Org-mode library without restricting file access, so the include directive accepts absolute paths and returns their contents. No login or write access is required. Gitea warns it can chain to command execution: read the configuration file, extract the internal token, inject a Git hook, and trigger it during an anonymous clone. It affects versions 1.22.1 through 1.27.0, fixed in 1.27.1.
VulnCheck reports active exploitation of a path traversal flaw in Windmill, an open source platform for building internal tools, jobs, and workflows. CVE-2026-29059 lets an unauthenticated attacker read arbitrary files through the log file endpoint, and while observed attempts included reading the password file, the higher value target is the superadmin secret. Where that is configured, an attacker can authenticate as a super administrator and run arbitrary code through the job preview API. VulnCheck counted roughly 170 exposed instances across 24 countries, including deployments reachable through a proxy path rather than directly.
One of the critical ColdFusion vulnerabilities Adobe patched last week is now being exploited in the wild. The flaw, CVE-2026-48282, is a path-traversal issue rated 10.0 that lets an attacker run arbitrary code on a ColdFusion server, and it was among seven top-severity bugs Adobe fixed in ColdFusion 2025 and 2023. Adobe had flagged the update as high priority given ColdFusion's history as an attacker and ransomware target, and exploitation has followed quickly. Organizations that had not yet applied the update are now in an active-threat window, especially any ColdFusion servers reachable from the internet, which are the most exposed to opportunistic attacks.
VulnCheck reports that attackers are actively exploiting an unpatched flaw in Langflow, a popular open-source platform for building AI applications. The bug (CVE-2026-5027, rated 8.8) is a path-traversal weakness: the file-upload endpoint does not clean the supplied filename, so an attacker can use directory-climbing sequences to write files anywhere on the server, a foothold that leads to remote code execution. Tenable, which found it, says the maintainers did not respond after three contact attempts in early 2026, and there is still no official fix. Early exploitation appears to be probing, with attackers writing harmless test files, but that usually precedes heavier attacks.
CrowdStrike disclosed CVE-2026-40050 on April 21, a critical unauthenticated path traversal in a specific cluster API endpoint of self-hosted LogScale (formerly Humio). CVSS 9.8. A remote attacker who can reach the endpoint can read arbitrary files from disk - including config files, certificates, embedded credentials, and the very logs the platform was deployed to protect. CrowdStrike found the bug through internal product testing and applied network-layer blocks across all SaaS clusters on April 7. Self-hosted customers must patch themselves. There is no evidence of in-the-wild exploitation yet.
TrustStrike Labs