13613 matches found
X Money rollout linked to password-reset attacks
X says attackers may be targeting accounts because its X Money payments service is now more widely available. The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X say...
Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data
Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track , the court case management platform sold by its West Publishing Corporation unit, in March 2026, affecting courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. West Publishing said it...
153M+ driver’s licenses for sale on new dark web platform
A new dark web platform called Nexus claimed to be selling 153 million driver’s license scans and millions of other identity and medical cards. The collection included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including...
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphonin...
CVE-2026-40205
A flaw was found in Dovecot. An attacker with a partially valid OAuth2 token can bypass authorization checks in remote token validation paths. This allows the attacker to authenticate with insufficient permissions, leading to a breach of integrity where the configured authorization policy is not...
MGASA-2026-0356 Updated perl-Mojolicious packages fix a security vulnerability
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle...
Updated perl-Mojolicious packages fix a security vulnerability
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle...
PT-2026-89828
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle...
Google Chrome XML Component
The vulnerability of XML components in Google Chrome and Microsoft Edge relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a speciall...
Linux net/core/dev.c Buffer Overflow
The vulnerability in the net/core/dev.c module of the Linux operating system relates to accessing memory beyond the permissible buffer data size limits. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected...
Linux kernel Bluetooth L2CAP Buffer Overflow
The vulnerability of the l2capinformationrsp function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
A division-by-zero error on some AMD processors may potentially return speculative data, resulting in a loss of confidentiality...
A week in security (August 17 – August 23)
Last week on Malwarebytes Labs: Zombie Card: An expired Visa credit card can be used for purchases Medical records, SSNs, and bank details exposed in CareCloud data breach ChatGPT for Teens tackles risky chats and homework shortcuts Twitch wants your content for Amazon AI training. Here’s how to...
Medical records, SSNs, and bank details exposed in CareCloud data breach
Healthcare technology giant CareCloud has confirmed that a data breach earlier this year impacted more than 3.75 million people, making it one of the largest healthcare data incidents disclosed this year. The New Jersey-based company, which provides electronic health record EHR and practice...
MINI-PWVP-3PVF-HQRR
Bulletin has no description...
GHSA-6F2P-296R-CC28 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
9 million images of people’s faces exposed by reverse lookup service
Researcher Jeremiah Fowler found a cloud database containing more than 9 million image files accessible without authentication, WIRED reports. The leaky bucket, containing some 450 GB of images, was traced back to a US-registered company called ClarityCheck. In their own words, ClarityCheck says:...
PT-2026-80235
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
PT-2026-80744
Name of the Vulnerable Software and Affected Versions Tekton Pipelines-as-Code versions prior to 0.48.0 Description When configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by...