Researchers found that abandoned GitHub repository names allowed attackers to hijack publishing rights for over 1,500 npm packages, a flaw now patched.
Read more
Broadcom introduces a new tool to help organizations handle the surge of monthly patches driven by AI vulnerability discovery.
Read more
The controversial surveillance vendor gained authority to assign vulnerability IDs to its own cameras and license plate readers, sparking trust concerns.
Read more
A critical remote code execution vulnerability in NetEase Cloud Music for Windows allows attackers to run arbitrary code via manipulated URLs.
Read more
A critical flaw in Quarkus allows attackers to bypass endpoint security controls when developers use specific annotations without re-declaring roles.
Read more
A race condition in Discourse’s image processing allows low-privilege users to read and write server files, requiring immediate attention for self-hosted deployments.
Read more
Threat actors are exploiting two unpatched flaws in Ahsay Cloud Backup Server to gain SYSTEM-level control without credentials, deploying miners and web shells.
Read more
PortSwigger researchers demonstrate how overlapping CSS fragments bypass token limits to exfiltrate data via CSS injection attacks, a significant risk for web applications.
Read more
A critical flaw in BotSharp 5.2.0 allows attackers to forge tokens using a hardcoded secret, granting full administrative control without credentials.
Read more
A critical object injection vulnerability in the VillaTheme AFFI plugin allows remote code execution on WooCommerce sites running versions up to 1.0.10.
Read more
CVE-2026-97670 allows unauthenticated users to execute arbitrary WordPress action hooks via form submissions, potentially destroying site content permanently.
Read more
The UK intends to restrict non-compete agreements that delay employee job moves, addressing startup concerns about hiring barriers.
Read more
A critical vulnerability in Astron Agent allows authenticated users to execute arbitrary code as root, bypassing tenant isolation and accessing shared credentials.
Read more
A high-severity flaw in Apache Camel Karavan permits authenticated users to apply unrestricted Kubernetes resources, risking cluster compromise.
Read more
Google deploys security updates for Chrome 155 on Windows, Mac, and Linux, addressing 24 flaws including four critical memory safety issues.
Read more
A high-severity flaw in the popular Node.js library allows attackers to skip expiry, issuer, and audience validation by submitting tokens with array payloads.
Read more
A critical flaw in PHPNuxBill’s FreeRADIUS endpoint enables attackers to steal customer records without credentials using blind SQL injection techniques.
Read more
An incomplete patch in Nginx UI allows attackers with valid tokens to manage cluster nodes and restart services without re-authenticating via second factor.
Read more
A critical buffer overflow flaw in IBM DataPower Gateway allows remote exploitation, affecting multiple versions of the integration appliance.
Read more
A flaw in the AWS Toolkit allows local attackers to steal cached bearer tokens due to insecure file permissions on shared systems.
Read more