Vulnerabilities Chrome WebGL Has Another Critical RCE — CVE-2026-93372 Hits Android and DesktopSeptember 18, 2026September 18, 20268 mins
Vulnerabilities Crawlab’s JWT Secret Is Literally Hard-Coded — Admin Takeover Leads to Cluster RCESeptember 18, 20269 mins
Vulnerabilities HCL BigFix Has a 9.8 SQL Injection — Cross-Tenant PII Is at RiskSeptember 18, 20268 mins
Vulnerabilities Microsoft Fabric Has a CVSS 10 Authentication Bypass — No Credentials RequiredSeptember 18, 2026September 18, 20267 mins
Vulnerabilities Prebid Server Java Has a CVSS 10 SSRF — Your Ad Server Can Reach the CloudSeptember 18, 20267 mins
Vulnerabilities Unbound DNS Has a Heap Overflow — A Malicious Zone Can Reach RCESeptember 18, 20268 mins
Vulnerabilities vm2 Sandbox Is Breaking Again — Fresh Escapes Can Reach Host RCESeptember 18, 20268 mins
Vulnerabilities Jenkins Script Security Has Multiple Sandbox Escapes — Pipelines Can Reach the Controller JVMSeptember 17, 2026September 17, 20267 mins
Vulnerabilities Jenkins Robot Framework Plugin Can Write Arbitrary Files — Then Take the ControllerSeptember 17, 20267 mins
Vulnerabilities LightGBM Has an Attacker-Controlled Out-of-Bounds Write in Model FilesSeptember 17, 20268 mins
Vulnerabilities Manticore Search Has an Authorization Bypass — Read-Only Users Can Become AdminSeptember 17, 20267 mins
Vulnerabilities AVideo Has a Critical Authentication Bypass — Steal the Hash, Become AdminSeptember 17, 2026September 17, 20267 mins
Vulnerabilities AI Agent nanobot Has a 9.2 SSRF — It Can Reach Cloud CredentialsSeptember 17, 20268 mins
Vulnerabilities SafeLine Has a 9.2 Authentication Bypass — The Admin Cookie Can Be ForgedSeptember 17, 2026September 17, 20267 mins
Vulnerabilities UVdesk Has a 9.8 Installation Wizard Flaw — No Login RequiredSeptember 17, 2026September 17, 20267 mins
Vulnerabilities Feast Has a 9.8 JWT Bypass — Attackers Can Become the Internal ServiceSeptember 17, 20267 mins
Vulnerabilities Cisco ISE Has a CVSS 10 Zero-Day — Attackers Are Already InsideSeptember 17, 2026September 17, 20267 mins
Vulnerabilities Windows Netlogon Has a 9.8 RCE — Domain Controllers Are the PrizeSeptember 16, 20269 mins
Vulnerabilities ScreenConnect Is Under Active Attack — Remote Sessions Can Push Unauthorized FilesSeptember 16, 20267 mins
Vulnerabilities Magento Has a CVSS 10 Zero-Day — Attackers Are Already InsideSeptember 16, 2026September 16, 20267 mins
Vulnerabilities Acronis Backup Plugin Is Being Exploited to Escape Into RootSeptember 16, 2026September 16, 20267 mins
Vulnerabilities Orkes Conductor Has a 9.8 RCE Hidden Inside Its Workflow EngineSeptember 15, 2026September 15, 20269 mins
Vulnerabilities LiteSpeed Shared Hosting Isolation Can Collapse Into Root AccessSeptember 15, 20268 mins
Vulnerabilities Vite Dev Servers Are Being Mass-Scanned for Cloud CredentialsSeptember 15, 20269 mins
Vulnerabilities Metabase SQL Injection Just Became a 1-Million-User Data BreachSeptember 15, 20269 mins
Vulnerabilities TCP and DNS Can Still Be Hijacked From the Wrong Side of the NetworkSeptember 15, 202610 mins
Vulnerabilities Claude Escaped the Sandbox and Started Touching Real InfrastructureSeptember 15, 20269 mins
Vulnerabilities vLLM Can Execute Malicious Model Code Despite trust_remote_code=FalseSeptember 15, 2026September 15, 20267 mins
Vulnerabilities BlueMoon Turned Chrome and Windows Bugs Into a Shared Espionage WeaponSeptember 15, 2026September 15, 20268 mins
Vulnerabilities Grafana’s GitHub Breach Started With One Missed TokenSeptember 13, 2026September 13, 20268 mins
Vulnerabilities MapLibre’s Sanitizer Skipped One Attribute. That Was Enough for Critical XSSSeptember 13, 2026September 13, 20268 mins
Vulnerabilities One Stolen Police Credential Breached Florida’s Driver DatabaseSeptember 13, 20269 mins
Vulnerabilities Windows Kerberos Has an 8.8 RCE. A Captured Authentication Exchange Can Become Code ExecutionSeptember 12, 2026September 12, 20267 mins
Vulnerabilities Check Point VPN Has Two 9.8 RCEs. The Certificate Parser Is the Attack SurfaceSeptember 12, 20267 mins
Vulnerabilities N-central Has Another Attack Chain. Two Bugs Can Create a Rogue AdministratorSeptember 12, 20268 mins
Technical Breakdowns How a Telerik Padding Oracle Turns Encrypted State Into RCESeptember 12, 2026September 11, 20264 mins
Vulnerabilities Manchester Airports Lost 8.7 Million Records Through an API DoorSeptember 11, 20265 mins
Vulnerabilities Greenberg Traurig Data Hit the Dark Web. The Law Firm Says It Was Not BreachedSeptember 11, 20265 mins
Vulnerabilities Surfshark Exposed an Internal Test Server. Hackers Got the Build SecretsSeptember 11, 2026September 11, 20264 mins
Vulnerabilities AdaptHealth Lost Data on 4.1 Million People After a CyberattackSeptember 11, 20264 mins
Vulnerabilities Veradigm Was Hit Through a Vendor. Patient Data Left Through an APISeptember 11, 20264 mins
Vulnerabilities GitLab Has a CVSS 10 Path Traversal. Anonymous Attackers Can Read Server FilesSeptember 11, 20263 mins
Vulnerabilities Casdoor Has a CVSS 9.9 Cross-Tenant Bypass. One Admin Can Cross the WallSeptember 11, 2026September 11, 20265 mins
Vulnerabilities Secure Boot Can Be Bypassed From UEFI Shell. The OS Never Gets a ChanceSeptember 11, 20266 mins
Weekly Bugstoday Weekly: The Week Attack Surfaces Stopped Making SenseSeptember 11, 2026September 11, 20263 mins
