Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,184 stories synthesized.
The Lunex malware-as-a-service platform is distributing Psychedelic Stealer, leveraging a vulnerable AMD driver to disable security monitoring and steal browser credentials from Ukrainian users.
A researcher successfully used a locally hosted, uncensored AI model to modify a Windows credential-dumping utility, bypassing two EDR products in a lab environment.
F-Droid, the open-source Android app repository client, has launched version 2.0, marking its most significant update in ten years with a complete modernization of its codebase and user interface.
Key findings • Four critical vulnerabilities disclosed on September 26, 2026, affect Joomla extensions from lomart.fr and joomlaboat.com. • Flaws include unauthenticated remote code installat…
Key findings • Thirteen vulnerabilities disclosed simultaneously for Froxlor server administration panel. • Critical flaws include arbitrary file deletion, private key exposure, and incomplet…
Key findings • Four Nodemailer vulnerabilities disclosed on September 26, 2026, impacting versions prior to 10.0.9. • High-severity CVE-2026-100700 allows denial of service via regex backtrac…
Key findings • Nine vulnerabilities disclosed in Budibase on September 26, 2026, patched in version 3.45.0. • High severity flaws include authentication bypass, arbitrary file write/read, and…
Key findings • Seven vulnerabilities in Grav CMS and its plugins were disclosed on September 26, 2026. • High severity flaws include privilege escalation (CVE-2026-100670) and stored XSS (CVE…
Key findings • Twelve vulnerabilities disclosed in Netty on September 26, 2026, affecting multiple codecs and handlers. • Several High severity vulnerabilities related to HTTP/3 and QPACK pro…
Key findings • Eight vulnerabilities in VLLM disclosed on September 26, 2026, patched in version 0.29.0. • Multiple vulnerabilities related to improper validation of stop_token_ids and resour…
Key findings • Fourteen vulnerabilities disclosed for Siyuan Note on September 26, 2026, impacting versions prior to 3.8.4. • Batch includes High severity SQL injection, multiple stored XSS, …
Key findings • 19 vulnerabilities disclosed for Capgo.app on September 26, 2026, impacting authorization and access control. • Multiple High severity flaws found, including privilege escalati…
Key findings • Six vulnerabilities disclosed in Flowise on September 26, 2026, patched in v3.1.5. • Multiple authentication bypass flaws allow unauthorized account access via SSO and email. …
Recent incidents, including a breach at Hugging Face, underscore the urgent need for robust Zero Trust architectures for AI agents, starting with fundamental visibility.
A 16-year-old security researcher discovered a critical authentication vulnerability in Microsoft's internal Titan analytics service, which could have allowed forged administrator access and unauthorized SQL queries, potentially exposing an estimated 17.3 trillion database rows.
Key findings • 25 WordPress plugins disclosed with vulnerabilities between Sept 25-26, 2026. • Flaws include RCE, Privilege Escalation, and multiple Stored XSS vulnerabilities. • Affected…
Key findings • 25 CVEs disclosed for OpenClaw on September 26, 2026, with many rated High severity. • Multiple vulnerabilities involve authorization bypass, allowing non-owners to access owne…
A former U.S. Army soldier has been sentenced to 70 months in prison for a wide-ranging cybercrime spree that included attacks on AT&T and Snowflake, resulting in the theft of billions of records and millions in extortion payments.
Kiteworks has alerted its customers to cease using its platform due to credible threat intelligence from federal agencies indicating a potential targeting by threat actors.
CISA has added CVE-2026-87902, a WordPress Core Remote File Inclusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation.
LabCorp will pay $2.2 million to 42 states and Washington D.C. to settle litigation over a 2019 data breach affecting 10.2 million patients, stemming from a third-party vendor compromise.
Key findings • Zammad: 25 vulnerabilities disclosed on September 25, 2026, affecting multiple versions. • Critical vulnerability CVE-2026-84458 allows account takeover via flawed SSO identity…
A voice phishing scam advertised on Telegram ironically instructed applicants not to read scripts, while simultaneously providing the exact script to be used.
Key findings • 25 RabbitMQ vulnerabilities disclosed on September 25, 2026, span multiple versions and severity levels. • High severity flaws include authentication bypass, XSS in Management …