4033 matches found
CVE-2026-50143
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...
Microweber Information Disclosure
Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0281 info: name: Microweber Information Disclosure author: pikpikcu severity: high description: Microweber contains a...
Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available...
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web , a browser-centric...
CVE-2026-59503 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...
Input Validation Vulnerability
Apache Camel Mail Component is vulnerable to Improper Input Validation and Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to the MailProducer accepting attacker-controlled mail.smtp. and mail.smtps. headers, allowing untrusted input to override mail session...
CVE-2026-54123
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...
EUVD-2026-54300
The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
Summary The shared HTTP CONNECT helper parses a proxy response with http.ReadResponse over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor...
The vulnerability of Unbound, a DNSSEC resolver, allows a attacker to cause a service failure.
The vulnerability of Unbound DNS server’s DNSSEC validator is related to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
An unknown Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most ...
Exposure Of Sensitive Information To An Unauthorized Actor
linuxfabrik-lib is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to lib.url.fetch following cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, which allows an attacker controlling a...
The vulnerability of the Unbound DNS server, related to access to an uninitialized pointer, allows a hacker to cause a service failure.
The vulnerability of the Unbound DNS server relates to access to an uninitialized pointer. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
CVE-2026-17700
An insufficient validation of untrusted input flaw was found in the Actor component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517789833...
CVE-2026-17700
Insufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
Chromium: CVE-2026-15116 Use after free in Actor
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-13930
An insufficient policy enforcement flaw was found in the Actor component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=512937764...
CVE-2026-15116
An use after free flaw was found in the Actor component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522092013...
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's...
