Supply Chain · Watch Monday · 24 August 2026 End-of-day synthesis 4 watches · 14 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — CISA's KEV add for an actively-exploited Oracle proxy flaw anchored a day otherwise defined by broken authorization logic — cached-state bypasses, missing ownership checks, and unconfined admin inputs — across CMS, LMS, and proxy-panel software.

CISA added CVE-2026-21962 — an improper access-control flaw in Oracle HTTP Server and the WebLogic Proxy Plug-in — to the KEV catalog today with confirmed active exploitation and a due date of 2026-08-27.

Everything else on the board traces the same shape: authorization logic that trusts something it already checked once. Sakai shipped a stored-XSS in Conversations and a profile-image IDOR in the same batch; 3X-UI's database-import flow lets a trusted admin action smuggle an arbitrary file write into the Xray process; Cloudreve's cached context-hint skips share revalidation for up to five minutes after a share is revoked; and django CMS took two hits in one release — a cyclic-reparenting DoS and a cache key that ignores plugin-declared Vary headers. Two more server-triggered panics in the Rust postgres client family and a predictable-PRNG fix in gorilla/websocket round out the day, with no active package-registry campaign surfacing in the RSS sweep.

→ Operational priority for the night patch the Oracle proxy plug-in wherever it fronts a WebLogic deployment ahead of the 08-27 KEV deadline, then take the django CMS 5.0.8 upgrade since it closes two separate bugs in one release.

21:00 ET · Last Watch

Medium · GHSA · medium · Rust · vibeio-http ·added 21:00 ET

vibeio-http: chunked-encoding parser panics on a crafted near-usize::MAX chunk length (DoS)

vibeio-http's HTTP/1.x chunked-encoding parser does unchecked arithmetic on the client-supplied chunk length, so a request with a length near usize::MAX panics the server — an integer-overflow panic in debug builds, an out-of-bounds split_to panic in release. Any service built on the crate that terminates chunked request bodies from untrusted clients is a one-request DoS. Upgrade past 0.3.2, which now checked-adds the length against a bound before parsing.

Medium · GHSA · medium · Go · Cloudreve ·added 21:00 ET

Cloudreve: remote-download file paths can escape the selected destination directory

Cloudreve trusts the file path a configured remote downloader (aria2, etc.) reports back and joins it against the user's chosen destination without stripping `..` segments, so a malicious or compromised downloader backend can land the completed file outside the selected folder — Cloudreve's second broken-access-control disclosure today, alongside the context-hint share-revalidation bypass from the First Watch batch. It needs remote-download permission plus a downloader that returns attacker-controlled paths, not a bare unauth vector. No workaround short of upgrading past the fixed commit; audit any self-hosted downloader backend in the meantime.

18:00 ET · First Watch

Critical · CISA KEV · added 2026-08-24 ·added 18:00 ET

CISA KEV adds Oracle HTTP Server / WebLogic Proxy Plug-in access-control flaw (CVE-2026-21962) — confirmed exploitation

CISA added CVE-2026-21962 (improper access control in Oracle HTTP Server and the WebLogic Proxy Plug-in) to the KEV catalog today with a due date of 2026-08-27 — active exploitation is confirmed, not theoretical. The plug-in sits in front of WebLogic deployments as a reverse proxy, so a compromised instance is a foothold into whatever application server sits behind it. Patch per Oracle's advisory now; federal BOD 26-04 gives agencies until the 27th, but anything internet-facing shouldn't wait that long.

High · GHSA · high · Maven · Sakai Conversations (CVSS 8.7) ·added 18:00 ET

Sakai Conversations: stored XSS via unsanitized message rendering with unsafeHTML()

Sakai's Conversations tool stores topic, post, and comment messages with zero HTML sanitization and renders them with LitElement's unsafeHTML(), so any authenticated student-level user can stored-XSS every other viewer of a topic, instructors and admins included (CVSS 8.7). In a university deployment with hundreds of students per course, one malicious post compromises the whole class's sessions on view. Patch the sakai-conversations-impl / sakai-kernel-impl / rubrics-impl modules to the fixed release and treat any Conversations content posted before the patch as suspect.

High · GHSA · high · Go · 3X-UI (CVSS 7.2) ·added 18:00 ET

3X-UI: authenticated arbitrary file write via database import and Xray log-path manipulation

3X-UI's database-import feature lets an authenticated panel admin repoint Xray's access-log path anywhere on the filesystem, then inject attacker-controlled content — an SSH key, for instance — through a client's email field so it gets written there: arbitrary file write escalating to persistent root if Xray runs as root. It's admin-gated, but 3X-UI panels commonly run under less-trusted operators managing proxy/VPN infrastructure. Upgrade to v3.3.1, which confines log paths to the panel's own log folder.

High · GHSA · high · pip · django-cms (CVSS 7.1) ·added 18:00 ET

django CMS: plugin move endpoint allows cyclic reparenting, stalling request workers (DoS)

django CMS's move_plugin endpoint lets a staff user reparent a plugin under its own descendant with no cycle check, and the resulting cyclic tree sends the recursive descendant/ancestor CTE queries into an infinite loop that stalls request workers (CVSS 7.1). Any placeholder-edit permission is enough to trigger it and leave the tree corrupted for everyone. Upgrade to 5.0.8, which now rejects the reparenting move outright.

High · GHSA · high · Rust · postgres-protocol ·added 18:00 ET

postgres-protocol: unbounded SCRAM iteration count allows CPU-exhaustion DoS from a malicious server

The Rust postgres-protocol crate runs a server-supplied SCRAM-SHA-256 PBKDF2 iteration count inline with no upper bound, so a malicious or MITM'd Postgres server can pin a tokio worker thread for minutes per connection and stall the whole async runtime. Only clients that connect to untrusted or interceptable database servers are exposed — apps that only ever talk to a trusted DB are fine. Upgrade past 0.6.12 if your service ever connects to a Postgres endpoint you don't fully control.

Medium · GHSA · medium · Maven · Sakai profile2 (CVSS 6.5) ·added 18:00 ET

Sakai: profile-image deletion IDOR lets any user delete any other user's profile photo

Sakai's profile-image DELETE endpoint checks that a caller is authenticated but never that they own the target userId, so any student can delete any other user's — including an admin's — profile photo, and the companion pronunciation-delete endpoint skips authentication entirely (CVSS 6.5). Trivially scriptable against every user on an instance. The fix is committed upstream; track the profile2 release that ships it.

Medium · GHSA · medium · pip · django-cms (CVSS 4.8) ·added 18:00 ET

django CMS: page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS's page cache key ignores the request headers plugins declare via get_vary_cache_on(), so the first visitor's header-dependent variant gets served to everyone else until the entry expires — an unauthenticated attacker can prime the cache with a chosen variant to poison it, or leak one visitor's personalized content to another. Only bites when CMS_PAGE_CACHE is on and a plugin varies its render on a request header. Upgrade to 5.0.8, the same release as today's cyclic-reparenting fix.

Medium · GHSA · medium · Go · Cloudreve (CVSS 5.3) ·added 18:00 ET

Cloudreve: cached context-hint lets revoked share access keep minting signed file URLs

Cloudreve caches a share's authorization state under a client-supplied context-hint header, and a restored cache hit skips revalidation entirely — so a recipient who pre-warms the hint while a share is valid can keep minting signed download URLs for up to 300 seconds after the owner deletes the share or it expires (CVSS 5.3). It requires prior legitimate access to the share; this is a revocation-bypass, not a discovery bug. No workaround short of upgrading past the fixed commit.

Medium · GHSA · medium · Go · gorilla/websocket ·added 18:00 ET

gorilla/websocket: cryptographically weak PRNG for WebSocket mask key

gorilla/websocket generated WebSocket frame mask keys with math/rand instead of crypto/rand prior to v1.5.3, making mask keys predictable enough that an attacker could potentially recover them and inject content into a connection. It's a defensive-hygiene fix rather than a demonstrated live exploit. Bump to 1.5.3+ on your next dependency pass — it's a drop-in fix.

Medium · GHSA · medium · Rust · tokio-postgres + postgres-protocol (2-advisory batch) ·added 18:00 ET

tokio-postgres and postgres-protocol: two more server-triggered panics (short DataRow, malformed hstore)

Two more panics landed in the Rust postgres client family alongside the SCRAM DoS above: tokio-postgres panics on a DataRow with fewer fields than its declared columns, and postgres-protocol panics decoding a malformed hstore value — both server-triggered denial-of-service, not memory corruption. Same caveat as the SCRAM issue: only exposed if you connect to untrusted or MITM-able Postgres servers. Upgrade tokio-postgres past 0.7.18 and postgres-protocol past 0.6.12 together.

12:00 ET · Forenoon Watch

Context · The Hacker News · Gen Digital ·added 12:00 ET

WordlistLoader and SynkLoader deliver Amatera Stealer via ClickFix, phish Windows credentials

Gen Digital is tracking two new loader families: WordlistLoader, which drops Amatera Stealer (aka ACR/AcridRain) through ClearFake's ClickFix fake-CAPTCHA lure, and SynkLoader, which phishes Windows credentials directly. Neither is a package or dependency compromise — it's browser-based social engineering — but the loader/stealer pairing reads as access-broker tooling likely feeding ransomware crews downstream. If you run EDR or browser telemetry, add both loader names to your watchlist and flag any "paste this to verify you're human" clipboard prompts as the same TTP.

Context · The Hacker News · Seqrite Labs ·added 12:00 ET

Operation QUICSILVER: China-nexus actor drops QUICAgent Go backdoor on Myanmar government/IT targets

Seqrite Labs attributes Operation QUICSILVER — graduation-ceremony invitation lures dropping a new Go-based backdoor called QUICAgent — to a China-nexus actor targeting Myanmar government and IT-sector networks with moderate confidence. Not a supply-chain compromise, but the same lure-document-to-staged-payload shape that recurs across commodity loader campaigns; worth filing the QUICAgent indicators if you have any Myanmar-adjacent infrastructure or partners.