Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,123 stories synthesized.
Researchers have detailed a new class of HTTP desynchronization attacks, dubbed 'CRLF-Powered Desync Worms,' that leverage header injection flaws to hijack user sessions and bypass security measures.
Key findings • Three high-severity vulnerabilities disclosed in PraisonAI on August 5, 2026. • Two SSRF flaws in the web_crawl tool allow connections to internal destinations. • One code …
An Ontario man has pleaded guilty to charges related to the 2024 attacks on cloud data platform Snowflake, which resulted in approximately 165 data breaches.
Researchers warn that Cascading Style Sheets (CSS) are being weaponized to steal sensitive data from webmail clients, with some vendors unprepared for the emerging threat.
Researchers demonstrated an exploit chain using Samsung Members and Samsung Account apps to gain system-level control of Galaxy devices via the Bixby virtual assistant.
Researchers have developed an AI system, HTTP Terminator, capable of autonomously discovering and exploiting new HTTP desync attack techniques against live websites.
Key findings • 24 vulnerabilities disclosed simultaneously for Langflow OSS, affecting versions 1.0.0 through 1.10.3. • Multiple High-severity flaws enable arbitrary code execution, authentic…
Key findings • 23 vulnerabilities disclosed simultaneously for IBM Langflow OSS, affecting versions 1.0.0 through 1.10.3. • Multiple High-severity flaws enable arbitrary code execution, authe…
Key findings • 16 vulnerabilities disclosed for Electron framework on August 5, 2026, ranging from Medium to High severity. • Issues include bypasses of sandbox restrictions for external URLs…
Researchers have uncovered 15 critical vulnerabilities in TP-Link devices that undermine secure zero-trust network provisioning, potentially allowing attackers to compromise devices during setup.
Pre-authentication remote code execution vulnerabilities, including CVE-2026-31986, have been discovered in widely used enterprise Java applications Bonita BPM and Apache OFBiz, posing a significant risk to organizations.
A sophisticated supply-chain attack on the keyv and cacheable npm packages uses a worm-like mechanism and a novel dead-man's switch that punishes token revocation.
Google Blogger's automated systems mistakenly flagged thousands of legitimate websites as malicious, locking them and causing widespread user frustration.
Cybercriminals exploited Microsoft logins, Zoom events, and government websites in July 2026 to conduct sophisticated phishing and malware campaigns.
Microsoft's Defender for Cloud has been named a leader in KuppingerCole's Leadership Compass for Cloud Native Application Protection Platforms (CNAPP), highlighting its unified approach to cloud and AI security.
Key findings • Three High severity vulnerabilities disclosed together for Keycloak on August 5, 2026. • CVE-2026-16442: SAML broker flaw allows potential bypass of account linking restriction…
A sophisticated macOS ClickFix campaign is now using server-side browser fingerprinting to hide its malicious lures, serving them only to visitors who appear to be genuine macOS users.
A gray market service named Poison Claude is selling heavily discounted access to Anthropic's AI models by exploiting fraudulently created cloud accounts and free credits from providers like AWS and Google Cloud.
Dutch luxury retailer De Bijenkorf has reported a cyber incident affecting its logistics provider, potentially exposing customer data and causing delays in orders and refunds.
Uppsala Security, a leader in blockchain intelligence, has become the first firm of its kind to join the Cyber Threat Alliance, aiming to integrate on-chain threat data with traditional cyber intelligence.
Three critical vulnerabilities in the Paperclip AI agent orchestration platform enable unauthenticated attackers to execute arbitrary commands and expose sensitive data.
Malicious npm packages 'bianira-ui' and 'fluid-type-ui' have been found using a novel technique to hide command-and-control server IP addresses within fabricated Ethereum transaction recipient addresses.
New Phishing-as-a-Service kits are targeting US organizations, stealing Microsoft 365 credentials and session tokens by tricking users into completing legitimate MFA challenges.
The UK's data protection watchdog has reprimanded London's Metropolitan Police Service for two significant data handling failures in 2024, including one where a stalking victim's new contact details were given to her abuser.