### Summary The `POST /runners/load-reader` endpoint in DbGate accepts a `functionName` parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. ...
## Summary **Type:** Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate access on `require_workspace_member(workspace...
Over 900 automatic tank gauge (ATG) systems across the United States, used to monitor fuel and chemical storage tanks across various critical infrastructure sectors, have been found exposed online and...
CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability. The post OWASP Incubator Project Helps ...
### Summary The Klever seednode REST API starts a Gin engine with `Engine.Run(restAPIInterface)`. In Gin v1.9.1, `Engine.Run` calls Go's default `http.ListenAndServe`, which constructs an HTTP server ...
### Summary `networkMessenger.directMessageHandler` in `network/p2p/libp2p/netMessenger.go` spawns a fresh goroutine for every incoming direct message before the antiflood layer makes an admission dec...
Summary: The private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack system...
### Summary The shared form-view submit handler in NocoDB writes the form's `redirect_url` to `window.location.href` after a same-host check that does not validate the URL scheme. A user with `editor`...
### Summary An authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. ### Details The comment write paths...
## Summary In `wasmtime-wasi`, when a filesystem preopen is given `DirPerms::all()` and `FilePerms::READ` without `FilePerms::WRITE`, this wasmtime-wasi enforced access control mechanism can be bypass...
### Summary A connected peer can send a compressed `RequestDataType_HashArrayType` direct request that is only `442` bytes on the wire but expands into `200000` decoded hash entries inside the resolve...
## Summary Omni supports importing standalone Talos clusters. During this process, an ImportedClusterSecrets resource is created, which contains the full CA secrets bundle for the cluster being import...
Arabic-speaking users have emerged as the target of a new Android spyware codenamed Asin, according to findings from ESET. The Slovakian cybersecurity company said it first detected the malware spread...
AI worms, or "viruses with wings and brains," adapt to new environments, seek out vulnerabilities, and will likely strike within a year, researchers say.
All three proof-of-concept exploits weaponized in the wild since April 10, 2026. A TOCTOU race condition in Windows Defender's threat remediation engine enables local privilege escalation to SYSTEM. Two of three variants remain UNPATCHED. Full kill chain, MITRE ATT&CK mapping, IOCs, YARA rules, and SIEM queries inside.
Unauthenticated remote attackers can execute arbitrary commands with elevated privileges on FortiClient EMS servers (versions 7.4.5–7.4.6). Exploited as a zero-day since March 31, 2026. CISA added to KEV catalog April 6. Full patch (7.4.7) still pending. Internet-exposed EMS instances at critical risk.
73% of production enterprise AI deployments vulnerable. 67% of successful attacks go undetected for 72+ hours. The rise of agentic AI with tool access transforms prompt injection from a content moderation problem into a full-stack data breach vector. Real-world government breach: 150GB exfiltrated. Full technical breakdown and enterprise defensive playbook inside.
Critical double-free memory corruption (CWE-415) in Windows IKE Service Extensions. Unauthenticated network-based RCE via UDP 500/4500 — affects every Windows 10/11 and Server variant. All internet-exposed VPN gateways at immediate risk. Microsoft patches released April 14, 2026.
Microsoft's April 2026 Patch Tuesday delivers patches for 163 CVEs including 2 actively exploited zero-days. SharePoint Server spoofing vulnerability (CVE-2026-32201) added to CISA KEV with April 28 federal deadline. Full breakdown of all 8 Critical CVEs inside.