1,167 articles
Threat IntelA path traversal vulnerability in the Office-PowerPoint Model Context Protocol server allows AI agents to be manipulated via prompt injection into overwriting host files.
Agentic AIA critical flaw in Mooncake distributed KVCache transfer engine allows unauthenticated TCP attackers to read and write arbitrary process memory, exposing LLM prompt caches.
LinuxA flaw in 389 Directory Server fails to discard buffered plaintext bytes during StartTLS negotiation, enabling on-path attackers to forge successful LDAP authentications.
FortinetA critical zero-day flaw in Fortinet FortiMail secure email gateways allows unauthenticated remote attackers to write arbitrary files and execute code as root.
LinuxA critical vulnerability in Foreman allows authenticated users to escape the safemode Ruby templating sandbox via delegated method manipulation, executing commands as root.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
Threat IntelCISA advisory ICSA-26-274-06 details critical Broken Object Level Authorization in Meari IoT Cloud OpenAPI, exposing millions of surveillance devices worldwide.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.
Threat IntelA critical security flaw in yii2-starter-kit exposes the Gii code generator and debug modules to all remote IP addresses by default, allowing unauthenticated RCE.
DevSecOpsA critical command injection flaw in GitLab AI Gateway allows remote attackers to break LLM agent sandboxes and execute code across enterprise cloud runners.
Threat IntelA critical HTTP header smuggling and cache poisoning vulnerability in Apache Traffic Server allows attackers to bypass ACLs and serve poisoned content globally.
AppleAn authentication bypass in Fleet device APIs allows unauthenticated remote attackers to impersonate enrolled Apple devices and trigger MDM actions.
Threat IntelA privilege escalation vulnerability in Internet2 Grouper before v7.5.1 allows authenticated users with rule editing rights to elevate to full system administrator.
Cyber AttackAn authentication bypass in SOGo groupware allows remote attackers to impersonate any user without credentials by supplying an unsanitized x-webobjects-remote-user header.
Threat IntelA critical URL validation defect in LiteSpeed Web Server before v6.3.7 build 1 permits remote actors to bypass rewrite rules and access internal handlers.
FortinetFortinet resolves a high-severity improper access control flaw in FortiSandbox (CVE-2026-26084) allowing unauthenticated attackers to expose forensic analysis data.
Threat IntelA critical use-after-free flaw in Python's ssl module allows remote unauthenticated clients to crash TLS servers or hijack function pointers via SNI callbacks.
Threat IntelAn authentication bypass in Zammad helpdesk versions 6.3.0–6.5.4 allows remote attackers to hijack administrative sessions and achieve remote code execution.
Threat IntelA pre-authentication heap buffer overflow in ESnet iperf3 v3.20–3.21 allows unauthenticated remote attackers to corrupt heap memory via oversized RSA tokens.
Threat IntelAn unauthenticated RPyC service in LightLLM visual_only deployments enables remote attackers to execute arbitrary code on GPU clusters via pickle deserialization.
Threat IntelA critical heap use-after-free vulnerability in ESnet iperf3 v3.21 allows unauthenticated remote attackers to crash network test daemons or execute code.
Threat IntelA race condition in OpenBSD ldapd delegated authentication allows remote attackers to hijack directory sessions and impersonate arbitrary user identities.
MicrosoftA critical flaw in Deno on Windows allows attackers to inject OS commands via improperly escaped shell arguments in node:child_process APIs.
VulnerabilityA technical engineering roadmap for complying with EU AI Act General-Purpose AI (GPAI) model mandates, systemic risk audits, and Article 50 synthetic content watermarking.