Attackers Target CI/CD Pipelines in SDLC Supply Chains

🕵️ RESEARCH & DEEP DIVES

• Attackers Target CI/CD Pipelines and Developer Tools in SDLC Supply Chains
  Attackers are targeting CI/CD pipelines and developer tools in software supply chains.
  • Software development teams using modern SDLCs and CI/CD pipelines are affected.
  • The targeted attack surface includes developer tools, build systems, and software dependencies.
  • Attackers focus on overlooked SDLC components instead of directly compromising application code.
    📄 Source: linuxfoundation.org · 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Palo Alto Unit 42

🔓 CVEs & KEV

• CVE-2026-53528 — CVSS 8.8 — FileWiki has path traversal in RenameAsset via unsanitized oldFilename parame...

• CVE-2026-53527 — CVSS 8.8 — LeafWiki Vulnerable to Privilege Escalation via User Self-Service UpdateLeafW...

• CVE-2026-33240 — CVSS 8.8 — Combodo iTop: Reflected XSS in foreign key search criteriaCombodo iTop is a w...

• CVE-2026-31936 — CVSS 8.8 — Combodo iTop: Unauthorized access to object information via search operationC...

• CVE-2026-34741 — CVSS 8.6 — Combodo iTop: Authentication bypass in exec.php allows PHP file executionComb...

• CVE-2026-34836 — CVSS 6.5 — Combodo iTop: Improper access control in ajax.render.php and ajax.document.ph...

• CVE-2026-77811 — CVSS 6.2 — OpenSearch Dashboards Plugin XSS (CVE-2026-77811)