Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Threat actors are continuing to leverage artificial intelligence AI to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat...

Nox

Nox - Unified Offensive Security Research Suite Nox is a comp...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service DoS. The vulnerability is due to the Aalto XML processor not correctly enforcing the maxInMemorySize limit when parsing XML input, which allows an attacker to provide oversized XML data that consumes excessive memory and potentially causes a...

Open Redirect

Spring Framework is vulnerable to Open Redirect. The vulnerability is due to improper handling of URLs by UrlFileNameViewController when mapped with an end-of-path and no configured prefix, which allows an attacker to craft a malicious URL that redirects users to an attacker-controlled external...

CVE-2026-47892

A flaw was found in Spring Framework. This vulnerability allows a header predicate bypass to occur in a pre-flight request within a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. This bypass could potentially lead to unexpected behavior or security poli...

CLSA-2026-1788871245 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.31-tuxcare.14...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient processing of the SpEL power operator ^ with BigDecimal or BigInteger operands and large exponent values, which allows an attacker to supply a crafted expression that consumes excessive CPU and memory...

CLSA-2026-1788869692 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.37-tuxcare.11...

CLSA-2026-1788865685 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 9 CVEs. Fixed in 4.3.25.RELEASE-tuxcare.5...

Astro - Reflected XSS via server islands feature

Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application. id: CVE-2025-64764 info: name: Astro - Reflected XSS via server islands feature author: DhiyaneshDk,zhe...

Astro - Broken Access Control

Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers. id: CVE-2025-64525...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

CLEANSTART-2026-XP70950 Hono is a Web application framework that provides support for any JavaScript runtime

Multiple security vulnerabilities affect the langfuse package. Hono is a Web application framework that provides support for any JavaScript runtime. See references for individual vulnerability details...

raptor v3.1.0

╔═══════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ██████╗ █████╗ ██████╗ ████████╗ ██████╗ ██████╗ ║ ║ ██╔══██╗██╔══██╗██╔══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ║ ║ ██████╔╝███████║██████╔╝ ██║ ██║ ██║██████╔╝ ║ ║ ██╔══██╗██╔══██║██╔═══╝ ██║ ██║ ██║██╔══██╗ ║ ║ ██║ ██║█...

CLEANSTART-2026-SU61748 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the solr package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

PT-2026-88515

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces

The rapid integration of AI into human-centred systems such as Brain-Computer Interfaces BCIs has created a poorly understood attack surface linking neural signals to physical systems. Exploits in this domain threaten cognitive autonomy, mental privacy, and physical safety, from neural data...

PT-2026-87166

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An incorrect authorization issue exists within the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that tricks...

Navigating the Latent Manifold: Proactive Concept Drift Adaptation for Resilient NIDS

Network intrusion detection systems NIDS are critical for cybersecurity, safeguarding services and data from potential attacks. However, existing AI-based NIDS often assume static data distributions and fail to handle concept drift, leading to degraded performance and increased false positives in...

PT-2026-88522

The following issues are included in Project Mainline components. Subcomponent CVE ART CVE-2026-28664 Media Framework components CVE-2026-28609, CVE-2026-45527 Documents UI CVE-2026-28636 Media Codecs CVE-2026-28618, CVE-2026-55294 Media Provider CVE-2026-28622, CVE-2026-28638, CVE-2026-28671,...