68 matches found
CISA: A Tale of Two SOCs - Insights from Two Red Team Assessments
The Cybersecurity and Infrastructure Security Agency CISA conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems SBSs and cloud resources...
CVE-2026-9203 Server-side request forgery in Progress MarkLogic Server
A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resourc...
EUVD-2026-47643
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field intended only for a key identifier. Because JWT headers are Base64-encoded...
CVE-2026-65599
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field intended only for a key identifier. Because JWT headers are Base64-encoded...
AI Inference Is Swallowing the Cloud
...
CVE-2025-10560
Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...
CVE-2025-10560
The CVE-CWE entry documents a vulnerability in Worksnaps before version 1.6.20260201 where hardcoded cloud credentials and related secret material were embedded in Worksnaps client binaries. The exposed data included AWS access keys and S3 bucket information, and the credentials authenticated as ...
CVE-2025-10560
Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...
CVE-2025-10560: Use of Hard-coded Credentials
Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...
IaC Inventory: A Unified View Across Code, Deployments, and Cloud
As AI applications introduce a new class of infrastructure resources, visibility into what your IaC creates, where it runs, and whether it has drifted has never been more critical...
The agentic SOC—Rethinking SecOps for the next decade
Every major shift in cyberattacker behavior over the past decade has followed a meaningful shift in how defenders operate. When security operation centers SOCs deployed endpoint detection and response EDR—and later extended detection and response XDR—security teams raised the bar, pushing...
Server-side Request Forgery (SSRF)
Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the RAG search tools not properly validating user-supplied URLs at runtime. An attacker can access internal or cloud resources by supplying...
CVE-2025-61121
Mobile Scanner Android App version 2.12.38 package name com.glority.everlens, developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitiv...
CVE-2025-61120
AG Life Logger Android App version v1.0.2.72 and before package name com.donki.healthy, developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force...
CVE-2025-61120
AG Life Logger Android App version v1.0.2.72 and before package name com.donki.healthy, developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force...
Glority Limited Mobile Scanner Android App 安全漏洞
Glority Limited Mobile Scanner Android App is a mobile scanning application from Glority. A security vulnerability exists in Glority Limited Mobile Scanner Android App version 2.12.38, which stems from improper handling of cloud service credentials and could lead to disclosure of sensitive...
CVE-2025-61121
The Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd. , is susceptible to a credential leakage vulnerability. The root cause is the improper handling of cloud service credentials , which may allow attackers to obtain these crede...
PT-2025-44430
Name of the Vulnerable Software and Affected Versions AG Life Logger versions prior to v1.0.2.72 Description The AG Life Logger Android App has issues with access control. Exposed credentials in network traffic could allow misuse of cloud resources. Predictable verification codes enable potential...
CVE-2025-61120
The AG Life Logger Android App (package name com.donki.healthy), developed by IO FIT, K.K. , is vulnerable to improper access control in versions v1.0.2.72 and before . The root causes include exposed credentials in network traffic and predictable verification codes , which facilitate brute-force...