jfrog
The latest security issues and vulnerabilities discovered by the JFrog security research team! CVE's, malicious packages and more
research.jfrog.comCYBERSECURITY AND THREAT INTELLIGENCE
GemStuffer: OpenAI's Massive 3,000+ Packages Campaign on RubyGems
The JFrog Security Research team investigated the GemStuffer campaign done by rogue OpenAI agents - we found more than 3000 RubyGems packages associated with the coordinated attacks.
IDENTITY AND ACCESS MANAGEMENT
Bifrost is vulnerable to Unauthenticated Remote Code Execution via MCP Stdio Client Registration
CVE-2026-90898, CRITICAL, Bifrost is vulnerable to Unauthenticated Remote Code Execution via MCP Stdio Client Registration
DIVERSITY EQUITY AND INCLUSION
Parallels Desktop is vulnerable to a Local Privilege Escalation via Appliance Extract Argument Injection
CVE-2026-90894, HIGH, Parallels Desktop is vulnerable to a Local Privilege Escalation via Appliance Extract Argument Injection
DIGITAL COMMUNITIES AND ONLINE PLATFORMS
Bifrost is vulnerable to Unauthenticated Remote Code Execution via a Custom Plugin HTTP Path on Dynamically Linked Builds
CVE-2026-86242, HIGH, Bifrost is vulnerable to Unauthenticated Remote Code Execution via a Custom Plugin HTTP Path on Dynamically Linked Builds
CYBERSECURITY AND THREAT INTELLIGENCE
When "Critical" Loses Context: The Reality of Spring CVEs
On August 20, 2026, Spring published 91 CVEs in a single day. CISA's ADP rated six of them Critical. When we checked those scores against Spring's own advisories, they didn't hold up.
