Supply Chain · Watch Wednesday · 29 July 2026 End-of-day synthesis 4 watches · 24 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — swagger-typescript-api became today's spec-to-RCE story: six advisories show a hostile OpenAPI document can inject code into its own generated client, echoing yesterday's datamodel-code-generator pile-up almost exactly one day later.

swagger-typescript-api shipped six advisories today showing a hostile OpenAPI document can inject code into the generated client through path strings, enum values, or the servers[0].url template, exfiltrate auth tokens via a crafted $ref, or reach internal hosts through the same $ref during generation. It's the same bug class that dominated yesterday's watch — datamodel-code-generator's eleven-advisory pile-up — recurring in a different language and ecosystem within twenty-four hours.

Elsewhere, veraPDF logged a five-advisory batch of parser DoS and XXE bugs against malformed PostScript fonts and XFA forms, prebid-server disclosed a CVSS 10 SSRF reachable through any bidder adapter, and Kubernetes Logging operator's Fluentd config-injection bug lets any tenant who can create a Flow resource get remote code execution on the shared log aggregator. CISA also added a hardcoded-password bug in Cisco Secure Firewall Management Center to the KEV catalog, confirmed under active exploitation with an August 1 deadline — the one item today known to be exploited rather than just disclosed; Socket, Phylum, and Aikido otherwise stayed quiet, so this was a disclosure-heavy day, not an active-campaign one.

→ Operational priority for the night patch Cisco Secure FMC before the KEV deadline, then audit any pipeline — TypeScript or Python — that generates code from a spec you don't fully control; that's two proven spec-to-RCE vectors in two days.

21:00 ET · Last Watch

Context · BleepingComputer ·added 21:00 ET

Russian APT Laundry Bear exploits an Exchange OWA zero-day to drop a persistent mailbox backdoor

Russian state-sponsored group Laundry Bear (aka Void Blizzard) is exploiting an unpatched Outlook Web Access zero-day to deploy a custom backdoor, OWAReaper, for long-term mailbox access. It's an on-prem Exchange compromise rather than a dependency-supply-chain attack, but it's the same pattern as this week's other stories: trusted internet-facing infrastructure turned into a persistent foothold. No public patch yet — if you run on-prem Exchange OWA, watch for a Microsoft advisory and check OWA session logs for anomalous long-lived sessions in the meantime.

18:00 ET · First Watch

Critical · CISA KEV · added 2026-07-29 · Cisco Secure Firewall Management Center ·added 18:00 ET

CISA adds a Cisco Secure FMC hardcoded-password bug to the KEV catalog, due date August 1

CVE-2026-20316 ships a hardcoded low-privileged account in Cisco Secure Firewall Management Center that lets an unauthenticated remote attacker log in and reach sensitive data — CWE-259, and CISA's KEV listing means it's confirmed under active exploitation. Agencies have until August 1 under BOD 26-04; if you run FMC anywhere, especially internet-facing management interfaces, patch or pull it off the internet today rather than waiting for the deadline.

Critical · GHSA · critical · CVSS 9.9 · go · Logging operator Fluentd config injection ·added 18:00 ET

Kubernetes Logging operator lets any tenant with Flow-creation rights get RCE on the shared Fluentd aggregator

Logging operator writes CRD-supplied strings straight into fluent.conf without escaping, so a crafted record_transformer.records value with embedded newlines can close the current filter block and inject a new <match **> block running Fluentd's core @type exec plugin — CVSS 9.9, with a confirmed PoC against EKS 1.35 including IMDS reachability from the compromised aggregator. Any multi-tenant cluster where non-admin users can create Flow/Output resources is exposed to command execution on the shared log pipeline; patch past the fixed commit and audit who holds Flow-creation RBAC in the meantime.

High · GHSA · high · CVSS 8.2 · pip · proot-distro container isolation bypass ·added 18:00 ET

proot-distro's restore/install flow lets a malicious archive escape the sandbox and write to the host

Two advisories against proot-distro both boil down to the same shape: a crafted restore archive can break container isolation (GHSA-7h3g, CVSS 8.2), and a malicious tar during install can symlink-escape to write arbitrary files on the real host (GHSA-9xq3, CVSS 8.2) — proot-distro trusts archive contents more than it should. If you restore or install distro images from anywhere you don't fully control — shared backup stores, community rootfs mirrors — treat the archive as untrusted input and upgrade before extracting.

High · GHSA · high · CVSS 9.0 · npm · AWS AgentCore CLI code injection ·added 18:00 ET

AWS AgentCore CLI's agent-import command can be tricked into writing malicious Python into your own generated agent code

@aws/agentcore's `agentcore add agent --type import` interpolates a Bedrock supervisor agent's collaborationInstruction metadata straight into a triple-quoted Python string in the generated main.py; a collaborator agent carrying a crafted instruction (attacker just needs bedrock:AssociateAgentCollaborator in the same account) can break out of the string and inject code that runs locally under `agentcore dev` and in the AgentCore Runtime under the agent's execution role — CVSS 9.0. Upgrading the CLI alone doesn't remediate an already-generated agent: if you've imported a supervisor agent with multi-agent collaboration on a pre-0.14.2 CLI, remove it, re-import on the patched version, and redeploy to replace whatever's already running.

High · GHSA · high · go · ZITADEL self-verification bypass ·added 18:00 ET

ZITADEL lets users self-verify their own email or phone through an API path that skips the actual verification challenge

A ZITADEL user can call an API endpoint to mark their own email or phone as verified without completing the verification challenge, undermining any downstream logic — account recovery, MFA re-enrollment — that trusts verified-contact status as a signal. If you gate sensitive actions on verified-contact state, audit whether this path was reachable in your deployment before assuming that gate held, and patch to the fixed release.

Medium · GHSA · high · CVSS 7.1 · composer · Easy!Appointments six-advisory batch ·added 18:00 ET

Easy!Appointments ships a six-advisory batch, headlined by an account takeover via excessive API data exposure

The self-hosted booking app Easy!Appointments had six advisories filed today: an account-takeover bug via excessive API data exposure (GHSA-4vmm, CVSS 7.1, the standout), unauthenticated customer PII disclosure on the reschedule page, cross-provider appointment injection, a CalDAV-test SSRF that exposes internal network reachability, an OAuth-provider rebinding auth bypass, and a stored XSS in the booking-cancellation message. None are wormable individually, but together they're a reminder that self-hosted scheduling tools accumulate IDOR-shaped bugs fast when every endpoint trusts a caller-supplied id; if you self-host, patch the whole batch rather than cherry-picking the highest-severity one.

12:00 ET · Forenoon Watch

Critical · GHSA · critical · CVSS 10.0 · go · prebid-server SSRF ·added 12:00 ET

prebid-server SSRF lets a crafted bid request reach internal network services (CVSS 10)

Certain bidder adapters interpolate user-supplied parameters straight into outbound request URLs, so a malicious bid request can redirect prebid-server's outbound HTTP calls to internal-only endpoints — classic CWE-918 SSRF, rated CVSS 10 because there's no auth or user interaction required and the blast radius is whatever the ad-serving host can reach. If you run prebid-server anywhere near internal services (metadata endpoints, admin APIs, internal DBs), treat it like an edge proxy with an open redirect: patch to v4.4.0 today or disable the affected bidder adapters until you can.

High · GHSA · high · CVSS 7.5 · maven · Quarkus path-normalization auth bypass ·added 12:00 ET

Quarkus vertx-http auth bypass via advanced path normalization

quarkus-vertx-http fails to normalize certain crafted paths before running them through authorization checks, so a request built with the right traversal/encoding tricks can reach routes that should sit behind auth — CVSS 7.5, CWE-287/863 territory. This is the same shape as prior Spring/Tomcat path-normalization bypasses: any custom auth interceptor sitting in front of Vert.x routes is suspect. Upgrade to 3.20.6.2 / 3.27.4.1 / 3.33.2.1 depending on your branch, and audit any routes you fronted with your own path-based access rules.

High · GHSA · high · erlang · Req decompression-bomb DoS ·added 12:00 ET

Req vulnerable to decompression-bomb DoS via response content-type-triggered extraction

Req auto-decompresses response bodies based on content-type without a size cap, so a malicious or compromised server can return a small compressed payload that expands to exhaust memory — a classic zip/gzip bomb, just server-to-client instead of the usual upload direction. Anything that fetches URLs with Req and doesn't sandbox the process is exposed via a malicious redirect target; upgrade past 0.6.1 and cap response size regardless.

High · GHSA · high · maven · veraPDF Validation XXE via Rich Text ·added 12:00 ET

veraPDF Validation XXE via Rich Text form fields

One of two concrete exploitation paths into the DocumentBuilderFactory XXE above — a PDF form's Rich Text field content gets parsed as XML without XXE protection, so a crafted form can read local files or reach internal URLs from whatever host runs veraPDF. High severity because it's a directly reachable sink, not just the shared parsing bug; patch veraPDF and treat any PDF/A validation service as internet-facing for logging purposes until you do.

High · GHSA · high · maven · veraPDF Validation XXE via XFA ·added 12:00 ET

veraPDF Validation XXE via XFA forms

The second concrete XXE sink off the same DocumentBuilderFactory bug — XFA (XML Forms Architecture) content in a PDF gets parsed without external-entity protection. Same blast radius and fix as the Rich Text variant above; if you patch one veraPDF advisory today, patch all five, since they share root causes and callers alike.

High · GHSA · high · CVSS 8.3 · npm · swagger-typescript-api code injection via path strings ·added 12:00 ET

swagger-typescript-api code injection via unescaped OpenAPI path strings

swagger-typescript-api generates TypeScript client code directly from an OpenAPI spec, and path strings from that spec get interpolated into generated method bodies without escaping — so a malicious or compromised spec (from a third-party API you're generating a client for) can inject code that runs when you build or run the generated client. CVSS 8.3, and it's the first of six advisories filed against this package today, all variations on 'untrusted spec content becomes executed code.' Don't codegen against specs you don't control without pinning to a patched release; treat OpenAPI specs as untrusted input, not config.

High · GHSA · high · CVSS 8.3 · npm · swagger-typescript-api code injection via enum values ·added 12:00 ET

swagger-typescript-api code injection via unescaped enum string values

Same family as the path-string injection above — enum values from the OpenAPI spec are interpolated into generated code unescaped, giving a second injection point for the same attack: a hostile spec producing a client that runs attacker code at build time. CVSS 8.3; fix and mitigation are identical to the rest of today's batch — upgrade past 13.12.1 and don't codegen from untrusted specs in the meantime.

High · GHSA · high · CVSS 8.3 · npm · swagger-typescript-api code injection via axios template ·added 12:00 ET

swagger-typescript-api code injection via servers[0].url in axios client template

Third variant: the spec's servers[0].url value lands unescaped in the generated axios HTTP-client template, so a crafted server URL in the spec becomes executable code in your client. Same root cause, same fix as the rest of the batch — if you're auditing generated clients for injected code, check anywhere the spec's server URL, enum, or path strings show up verbatim in the output.

High · GHSA · high · CVSS 8.3 · npm · swagger-typescript-api code injection via fetch template ·added 12:00 ET

swagger-typescript-api code injection via servers[0].url in fetch client template

The fetch-client-template twin of the axios advisory above — same servers[0].url injection, different generated HTTP client. If you generate both client flavors from the same spec, both are exposed; the fix is the same package upgrade.

High · GHSA · high · CVSS 7.4 · npm · swagger-typescript-api auth-token exfiltration via $ref ·added 12:00 ET

swagger-typescript-api authorization-token exfiltration via spec $ref

The sixth and last advisory in today's swagger-typescript-api batch: a crafted $ref in the spec can cause the generated client to leak authorization headers to a server the spec author controls, rather than the intended API host — CWE-522/918 territory. Combined with the SSRF and code-injection siblings above, the guidance is the same: pin to a patched swagger-typescript-api release and stop feeding it specs from sources you don't control.

Medium · GHSA · medium · CVSS 5.9 · pip · Penelope tar extraction file write ·added 12:00 ET

Penelope shell handler's tar extraction allows arbitrary local file write

Penelope extracts session archives without validating entry paths, so a crafted tar — e.g. a malicious reverse-shell session capture — can write files outside the intended extraction directory: CWE-22 path traversal, the zip-slip pattern's older cousin. If you accept session archives from untrusted operators or shared red-team tooling, upgrade past 0.20.0 before extracting anything you didn't generate yourself.

Medium · GHSA · medium · erlang · Req multipart header injection ·added 12:00 ET

Elixir Req HTTP client vulnerable to multipart header injection via unescaped filename/content-type

Req builds multipart form-data bodies by interpolating name/filename/content_type values without escaping, so attacker-controlled strings in any of those fields can inject extra headers or break out of the intended MIME part — CWE-93, CRLF-style injection. Anywhere you build multipart uploads from user input (filenames especially) is exposed; upgrade past 0.6.0 and audit for user-supplied filenames going straight into multipart requests in the meantime.

Medium · GHSA · medium · maven · veraPDF DoS via PostScript Type 1 fonts ·added 12:00 ET

veraPDF parser DoS via malformed PostScript Type 1 font programs

veraPDF's PostScript interpreter doesn't bound resource consumption when parsing embedded Type 1 font programs, so a crafted PDF can hang or exhaust memory in the validator — CWE-1325, part of a five-advisory batch filed against veraPDF today. If you run veraPDF as an automated ingestion gate (PDF/A compliance checks on user uploads), a single hostile file can DoS the pipeline; patch, and wrap validation in a timeout regardless.

Medium · GHSA · medium · maven · veraPDF DoS via PostScript CMap streams ·added 12:00 ET

veraPDF parser DoS via malformed PostScript CMap streams

Same root cause as the sibling Type 1 font advisory published minutes earlier — veraPDF's PostScript parser doesn't bound work done on a crafted CMap stream, so a hostile PDF can hang the validator. Same fix, same advice: patch, and don't let PDF validation run unsandboxed against untrusted uploads.

Medium · GHSA · medium · CVSS 6.5 · maven · veraPDF XXE via default DocumentBuilderFactory ·added 12:00 ET

veraPDF validation-model XXE via default DocumentBuilderFactory

veraPDF's validation-model module parses PDF-embedded XML with a DocumentBuilderFactory that hasn't disabled external entity resolution, so a crafted PDF containing malicious XML can trigger classic XXE — SSRF, local file read, or entity-expansion DoS. This is the shared root cause behind the two Rich Text / XFA advisories below; if you're patching veraPDF today, prioritize this one since it's the common library code.

Medium · GHSA · medium · CVSS 6.1 · npm · swagger-typescript-api SSRF via $ref ·added 12:00 ET

swagger-typescript-api SSRF via spec $ref resolution

Separate from the code-injection cluster in this batch — swagger-typescript-api resolves $ref pointers in the OpenAPI spec without validating the target host, so a spec pointing $ref at an internal URL makes the codegen tool itself issue requests wherever you point it. Medium severity (CVSS 6.1) since it's SSRF from the build machine, not RCE in the generated client, but still worth fixing if CI resolves specs from URLs you don't fully trust.

Context · GHSA · low · CVSS 3.7 · npm · Dynatrace MCP server missing approval gate ·added 12:00 ET

Dynatrace MCP server's notebook-creation tool ships without its human-approval gate

@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook tool can be invoked without the human-in-the-loop confirmation the rest of the server enforces, letting a compromised or over-eager agent create notebooks unattended. Low severity on its own, but it's the same failure mode as every other 'guardrail wired on some code paths, not all' MCP bug this year — worth auditing any MCP servers you run for consistent approval-gating across every tool, not just the obvious ones. Upgrade to 1.8.7.