CVE-2026-8593

CVE-2026-8593 affects Checkmk BI API Pack permission enforcement in versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL). The issue allows users without permissions to view and modify BI packs and rules. The provided metrics indicate a CVSS v4.0 base score ...

Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution

Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it's observing in-the-wild exploitation of CVE-2026-6875 CVSS score: 9.5, a sandbox escape...

MAL-2026-10973 Malicious code in fluffy-octo-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that...

PT-2026-62791

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of Oracle E-Business Intelligence. An unauthenticated attacker with network access via HTTP...

PT-2026-62707

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Platform Security. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence AI skills or Model Context Protocol MCP servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit...

Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering ...

The ACLU Is Arming Lawyers to Expose State Surveillance Secrets

A new toolkit for attorneys in Massachusetts targets the technologies police use—and conceal—to build criminal cases, from facial recognition to AI-written police reports...

EUVD-2026-45878

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

Nebula AI-Powered Penetration Testing 2.0.1b2

Nebula is an advanced, AI-powered penetration testing open-source tool that revolutionizes penetration testing by integrating state-of-the-art AI models into your command-line interface. Designed for cybersecurity professionals, ethical hackers, and developers, Nebula automates vulnerability...

CVE-2026-15995

IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple...

CVE-2026-15091

CVE-2026-15091 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0, where improper neutralization of input during web page generation could allow a remote attacker to execute arbitrary scripts. The connected IBM security bulletin confirms the issue and states a fix in version 1.3.0. I...

CVE-2026-15093

CVE-2026-15093 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0 and 1.2.0. Affected component: handling/validation of user-supplied URLs, enabling a remote attacker to redirect users to malicious websites due to improper URL validation. The IBM Security Bulletin consolidates multiple vulnerab...

EUVD-2026-45294

IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple...

The Race to Field Military Autonomy Is On, Can Trusted Information Infrastructure Keep Pace?

Military forces are under increasing pressure to field autonomous capabilities faster than ever before. Across the U.S., UK, and NATO, new investment, evolving defense strategies, and accelerated acquisition pathways are transforming how capability is delivered, rewarding programs that can move...

PT-2026-60843

Name of the Vulnerable Software and Affected Versions IBM Engineering AI Hub versions 1.0.0 through 1.2.0 Description Improper neutralization of input during web page generation allows a remote attacker to execute arbitrary scripts. This issue is a Cross-Site Scripting XSS flaw, where malicious...

MAL-2026-10736 Malicious code in memtry-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11638a6b1b7876a94ef23285cb88f0127c003bb5e4d786dbaba5c30a9cbdfdb7 memtry-cli installs an MCP server whose memtryonboarding tool returns a prompt that instructs the connected AI agent to scan the installer's home...

MAL-2026-10722 Malicious code in @whalent/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...

AI Can Find Bugs, But Human Knowledge Still Proves Them

Artificial intelligence AI is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run repetitive...

EUVD-2026-44893

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...