UniFi Connect Critical Command Injection Patch
UniFi Connect Critical Command Injection Patch Ubiquiti patched CVE-2026-50746, a critical UniFi Connect flaw that could let a network-access attacker run...
Gitea Docker Auth Bypass Probed
Gitea Docker Auth Bypass Probed Threat actors are probing Gitea Docker CVE-2026-20896, a critical reverse-proxy auth trust flaw that can let reachable...
Opera GX Mod Bug Leaked Data With CSS
Opera GX Mod Bug Leaked Data With CSS Opera patched an Opera GX mods flaw with no CVE that could let a malicious site silently install a GX Mod and use CSS...
npm Lookalike Packages Target Developer Secrets
npm Lookalike Packages Target Developer Secrets North Korea-linked malicious npm packages mimicked Rollup polyfill tooling to steal developer secrets and...
AI Agent Turns Langflow RCE Into Database Extortion
AI Agent Turns Langflow RCE Into Database Extortion Sysdig says JADEPUFFER used Langflow CVE-2025-3248 to drive an AI-agent ransomware chain against database...
Cursor DuneSlide Sandbox Escape
Cursor DuneSlide Sandbox Escape Two critical Cursor flaws, CVE-2026-50548 and CVE-2026-50549, could let hidden prompt injections escape the AI editor sandbox...
iOS AI Apps Leak Paid AI Access
iOS AI Apps Leak Paid AI Access Researchers found 282 iOS AI apps exposing paid LLM access through plaintext keys, replayable tokens, or open relays....
libssh2 Client-Side SSH Flaw Gets Public PoC
libssh2 Client-Side SSH Flaw Gets Public PoC A public PoC for CVE-2026-55200 highlights a critical libssh2 client-side flaw where a malicious SSH server...
PTC Windchill Web Shells Hit KEV
PTC Windchill Web Shells Hit KEV CISA added exploited PTC Windchill and FlexPLM CVE-2026-12569 to KEV after reports of JSP web shells on vulnerable systems....
Chrome Ad Blocker’s Hidden Permission Risk
Chrome Ad Blocker’s Hidden Permission Risk Researchers found the Chrome extension Adblock for YouTube, with 10M+ installs, had dormant script-injection...
Cordyceps CI/CD Bugs Expose Build Pipelines
Cordyceps CI/CD Bugs Expose Build Pipelines Researchers reported Cordyceps, a CI/CD workflow weakness that could let untrusted GitHub pull requests hijack...
GitHub Actions Adds a Checkout Guardrail
GitHub Actions Adds a Checkout Guardrail GitHub actions/checkout v7 now blocks common pwn-request checkouts that could let unreviewed fork PR code run with...
Squidbleed Leaks Proxy Requests
Squidbleed Leaks Proxy Requests Squidbleed (CVE-2026-47729) is a 29-year-old Squid Proxy heap over-read that can leak cleartext HTTP requests in shared proxy...
Salesforce Klue OAuth Token Abuse Exposes CRM Data
Salesforce Klue OAuth Token Abuse Exposes CRM Data Salesforce disabled Klue’s app integration after stolen access tokens were used to reach connected CRM...
Windows USB Clipper Worm Targets Crypto Wallets
Windows USB Clipper Worm Targets Crypto Wallets Microsoft detailed a Windows malware campaign that spreads through USB LNK shortcuts, swaps copied crypto...
Mastra npm packages hit by supply-chain compromise
Mastra npm packages hit by supply-chain compromise More than 140 Mastra npm packages were compromised through a hijacked contributor account and a malicious...
FortiSandbox Flaws Exploited in the Wild
FortiSandbox Flaws Exploited in the Wild Attackers are exploiting three Fortinet FortiSandbox flaws, including command-injection and path-traversal issues....
Microsoft 365 Copilot SearchLeak Patched
Microsoft 365 Copilot SearchLeak Patched CVE-2026-42824 in M365 Copilot could have exposed emails, files, calendars, and MFA codes through a trusted link....
PeopleSoft Zero-Day Hits University Systems
PeopleSoft Zero-Day Hits University Systems Attackers exploited Oracle PeopleSoft CVE-2026-35273, a remotely exploitable flaw that can expose reachable...
npm v12 Locks Down Install Scripts
npm v12 Locks Down Install Scripts GitHub says npm v12 will stop dependency install scripts from running by default, reducing a major supply-chain code-...