[Verse 1] Zotero's open, PapersGPT running smooth Version zero-point-six-one, sliding through your groove But the LLM endpoint whispers something rotten back Unsanitized JavaScript — silent heart attack CVE-2026-73032, score nine-point-six Arbitrary code slips through like contraband bricks The model returns malicious, no filter in between Remote execution hiding underneath the screen [Chorus] Kritische Schwachstellen, August sechzehn Die Angreifer kommen, sie müssen nicht flehn Critical scores, nine-point-nine on the wall Remote execution — patch before they crawl Uncontrolled paths and authority misplaced Cluster jobs injected — nothing left to waste [Verse 2] IBM i — seven-six, seven-five, seven-four, seven-three Uncontrolled search path hands the attacker a skeleton key CVE-2026-16860, nine-point-nine — that's the ceiling Remote authenticated code execution, gut-wrenching feeling Same platform, different wound — seventeen-two-seventy-six Improper authorization where the high-authority threads mix Privilege escalation dressed in corporate clothes Nine-point-six and climbing, everybody already knows [Chorus] Kritische Schwachstellen, August sechzehn Die Angreifer kommen, sie müssen nicht flehn Critical scores, nine-point-nine on the wall Remote execution — patch before they crawl Uncontrolled paths and authority misplaced Cluster jobs injected — nothing left to waste [Bridge] Multicluster engine, MCE — the cluster-curator bends A tenant with create-or-update access, that's where trust ends Inject a job specification, arbitrary payload rides CVE-2026-73268, nine-point-nine — nowhere to hide Das ist kein Spiel — this is the real machine breaking wide The flaw lives in the orchestration, nested deep inside the tide [Verse 3] Four CVEs, four weapons — all rated critical grade PapersGPT to IBM i, the full parade LLM poisoning, path confusion, thread authority gaps Curator injection — four separate traps Each one a nine-point-six or higher on the CVSS gauge Beginner, intermediate, expert — all should read this page Patch your Zotero plugin, lock your IBM stack Audit MCE permissions — don't give attackers slack [Chorus] Kritische Schwachstellen, August sechzehn Die Angreifer kommen, sie müssen nicht flehn Critical scores, nine-point-nine on the wall Remote execution — patch before they crawl Uncontrolled paths and authority misplaced Cluster jobs injected — nothing left to waste [Outro] August sechzehn, twenty-twenty-six — the date to carve in stone Four critical CVEs, none of them benign, none of them alone Remote code, privilege lift, job injection through the seam Check the NVD, apply the fix — this is not a fire drill dream
← Critical CVEs (2 of 3) — August 16, 2026 | IT Security News — August 16, 2026 →