Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure

Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-82329 CVSS score: 9.8, a case of authentication bypass that could lead to administrative access in...

CVE-2024-7953 DataEdgePlatform DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...

CVE-2024-7953 DataEdgePlatform DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...

CVE-2024-7952 DataEdgePlatform DataMosaix™ Private Cloud

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

CVE-2024-7952 DataEdgePlatform DataMosaix™ Private Cloud

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

librest: weak random number generation in PKCE implementation

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

Important: Red Hat Security Advisory: rest security update

An update for rest is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-79921

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulti...

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet formerly UNC5669 since 2024. Google Threat Intelligence Group GTIG and Mandiant teams described the threat actor as "specializing in manipulating...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

CVE-2026-58566

Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-51934

Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. Tenda A18 v.15.13.07.09 allows a remote attacker to execute arbitrary code via the fromSetCmdlineRun function...

CVE-2026-51788

An issue in cleverangeauth v.0.1.10 allows a remote attacker to cause a denial of service via the accountverification function and the accounts/models.py component...

CVE-2026-19592

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19592

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the htmlquotestring function by providing a specially crafted HTML attribute. This can lead to memory corruption and potentially result in arbitrary code execution or a denial of service...

wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the convertfname function. This occurs when processing a server-supplied filename that requires character set conversion, leading to memory corruption due to incorrect buffer reallocation. This can...

Moderate: Red Hat Security Advisory: wget security, bug fix, and enhancement update

An update for wget is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

wget: GNU Wget: Memory corruption via crafted Metalink URL

A flaw was found in GNU Wget. A malicious server could exploit a heap buffer underread vulnerability by providing a specially crafted Metalink document containing a URL with only whitespace characters. This could lead to memory corruption and abnormal program behavior, potentially causing a denia...

WordPress SigmaForms Pro plugin <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability discovered by Doan Dinh Van in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.11...