Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,965 stories synthesized.
Key findings • 35 of 40 malicious packages belong to the @antv/ npm scope, a popular visualization toolkit • All 40 advisories were published simultaneously on 2026-05-19, indicating a coordi…
Twelve malicious npm packages were disclosed within the same minute on May 18, 2026, all registered that day and impersonating utility names like safe-env-reader and validate-api-key in a coordinated supply-chain attack.
Security researchers disclosed 14 malicious npm packages impersonating the Zentra Finance DeFi protocol, all published within the same minute on May 18, 2026, in a coordinated supply-chain attack targeting blockchain developers.
A coordinated burst of 12 malicious npm packages impersonating developer utilities was disclosed within 14 minutes on May 22–23, 2026, targeting AI/LLM and DevOps workflows.
Key findings • 40 malicious npm packages disclosed in the same instant across three scopes • All packages share the same C2 host: oob.moika.tech • Post-install scripts exfiltrate process.…
Key findings • All 16 packages share the @t-in-one/ npm scope, registered on May 28, 2026 • Every package was disclosed in a single coordinated advisory push on May 29 • All packages exec…
A coordinated disclosure of 25 vulnerabilities across more than 20 WordPress plugins between May 28–31, 2026, includes three critical-severity CVEs enabling unauthenticated admin account creation and authentication bypass.
Seven vulnerabilities, including command injection and stack-based buffer overflows, have been disclosed for the Edimax BR-6478AC router, all remotely exploitable with public exploit code already circulating.
Seven vulnerabilities, including a high-severity authentication bypass, have been disclosed in the open-source Open5GS 5G Core network software, with public exploits already released for all flaws.
Fifteen vulnerabilities, including 13 stack-based buffer overflows and 2 command injection flaws, have been disclosed for the end-of-life TRENDnet TEW-432BRP router, with public exploit code available and no firmware patches forthcoming.
This week's roundup covers active exploitation of FortiClient EMS and Trend Micro Apex One vulnerabilities, a high-severity SharePoint RCE patch, and a LinkedIn-themed phishing campaign abusing Adobe's A/B testing platform.
Eight unauthenticated high-severity vulnerabilities — seven SQL injections and one path-traversal — were disclosed together in Open ISES Tickets 3.30A, exposing ticketing servers to database theft and file exfiltration.
Public exploit code has been released for a critical remote code execution vulnerability in Flowise, a low-code platform for building LLM applications, putting unpatched self-hosted instances at immediate risk.
Armur AI released Pentest Swarm AI, the first open-source autonomous penetration testing platform using swarm intelligence to coordinate nmap, SQLMap, Burp Suite, and Metasploit via a stigmergic blackboard architecture.
Microsoft Threat Intelligence uncovered 33 malicious npm packages that exploit dependency confusion to deploy a reconnaissance payload targeting developer environments across nine organizational scopes.
A coordinated disclosure of 19 CVEs on May 29, 2026, reveals systemic authorization failures, hardcoded secrets, and unauthenticated RCE in the open-source PraisonAI multi-agent orchestration platform.
Nine vulnerabilities were disclosed on May 29, 2026, in the open-source Admidio membership management system, including IDOR bugs, missing CSRF protections, and an incomplete authorization fix that could leak SSO private keys.
Four vulnerabilities in the open-source FreeScout help desk platform were disclosed on May 29, 2026, including an email injection flaw that allows unauthenticated agent impersonation and two authorization bypass bugs affecting internal notes.
Rapid7's latest Metasploit release includes new modules for the DirtyFrag Linux kernel privilege escalation vulnerabilities, a Citrix NetScaler info leak scanner, and exploits for dompdf and a WordPress plugin.
JetBrains patched 11 security vulnerabilities in TeamCity on May 29, 2026, including a high-severity RCE via Perforce connection settings and an unauthenticated SSRF, all fixed in version 2026.1.
Threat actors are exploiting ChatGPT's share link feature to display fake OpenAI outage pages that trick users into downloading malware disguised as the ChatGPT desktop app.
Nine vulnerabilities, including three critical sandbox escapes, were disclosed in the vm2 Node.js library on May 29, 2026, with novel attack vectors via WebAssembly JSPI and Promise species.
Ten vulnerabilities, including a CVSS 10.0 hardcoded authentication secret and multiple command injection flaws, were disclosed in the self-hosted PaaS Dokploy on May 29, 2026, allowing unauthenticated admin takeover and full server compromise.
Three high-severity vulnerabilities were disclosed in the Gotenberg document conversion API on May 29, 2026, including a race condition that crashes the service, an SSRF deny-list bypass via crafted IPv6 addresses, and a path-traversal flaw in zip entry handling.