188 matches found
spectre-meltdown-checker
Spectre & Meltdown Checker Un script de shell autocontenido para evaluar la resistencia de su sistema contra las diversas vulnerabilidades de ejecución transitoria que se publicaron desde principios de 2018, y ofrecerle orientación sobre cómo mitigarlas. Lista de CVE CVE| Nombre| Alias ---|---|--...
CVE-2026-71191
A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz- headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects...
Exploit for CVE-2026-65058
Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65...
CVE-2026-67550
A flaw was found in re2, a component that provides Node.js bindings for Google's RE2 regular expression engine. An attacker can exploit a vulnerability by manipulating the lastIndex parameter with a non-ASCII input. This manipulation can lead to an out-of-bounds heap read, causing the process to...
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
In this article 1. Activity overview 2. How ClickFix works 3. Campaign overview 4. ClickFix moved from open pages to fingerprinting gates 5. The fingerprinting gate 6. Mitigation and protection guidance 7. Indicators of compromise IOC 8. References 9. Learn more Microsoft Threat Intelligence...
Exploit for CVE-2026-61511
CVE-2026-61511 – Proof of Concept For educational and aut...
Exploit for Path Traversal in Apache Http_Server
No d...
WordPress BookingPress Appointment Booking Pro 5.7.2 Authentication Bypass
WordPress BookingPress Appointment Booking Pro plugin version 5.7.2 contains an authentication bypass vulnerability in its REST API that may allow an unauthenticated attacker to bypass authentication and gain unauthorized access. The repository contains technical analysis, threat intelligence...
Email threat landscape: Q2 2026 trends and insights
In this article 1. Tycoon2FA Q2 disruption impact 2. QR code phishing attacks 3. CAPTCHA-gated phishing tactics 4. Malicious payloads 5. Business email compromise 6. Microsoft Teams threats 7. Notable phishing campaigns 8. Mitigation and protection guidance 9. Indicators of compromise IOCs The...
GHSA-8342-988Q-86CR n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
Impact In an n8n instance, when a validly-signed incoming token was matched to a local account by its email claim, the service did not check that the trusted key's permitted role ceiling covered that account, nor that the email claim was verified. As a result, anyone able to obtain a token accept...
CVE-2026-59846
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. Mitigation Make sure you are not executing connections with untrusted username inputs...
CVE-2026-47261
A flaw was found in Wasmtime, a runtime for WebAssembly. This vulnerability allows an attacker to bypass intended access controls when a filesystem preopen is configured with read-only file permissions but also allows directory mutations. By using specific open flags, an attacker can truncate fil...
CVE-2026-15163
A flaw was found in Wireshark. A local user could trigger multiple protocol dissector infinite loops by providing specially crafted network traffic for analysis. This could lead to a Denial of Service DoS condition, making the application unresponsive. Mitigation To mitigate this issue, users...
reflex-dev/reflex has an Open Redirect vulnerability
MitigationMake sure GITHUBCODESPACESPORTFORWARDINGDOMAIN is not set in a production environment. So the following is correct:assert os.getenv"GITHUBCODESPACESPORTFORWARDINGDOMAIN" is None Vulnerability Description---Vulnerability Overview - When theGET/auth-codespace page loads in a GitHub...
Securing AI agents: When AI tools move from reading to acting
In this article 1. From reading to acting 2. Attack pattern: MCP tool poisoning in a finance workflow 3. Mitigation and protection guidance 4. References 5. Learn more As enterprise deployments mature, some enterprise AI agents are shifting from reading content to taking action. In this post,...
CVE-2026-12208
A flaw was found in the jsonata JavaScript library. A prototype pollution vulnerability exists in the createFrame function in src/jsonata.js, allowing a remote attacker to manipulate object prototype attributes. This could lead to unauthorized modification of application behavior. Mitigation Do n...
AutoJack: How a single page can RCE the host running your AI agent
In this article 1. Why we are looking at agent frameworks 1. What is AutoGen Studio 2. The AutoJack chain at a glance 3. Anatomy of the chain 1. Issue 1: Origin allowlist that the agent itself defeats 2. Issue 2: Auth middleware that opts MCP out 3. Issue 3: serverparamsfrom the URL is the comman...
Exploit for CVE-2026-39949
No d...
security-advisories
security-advisories Security advis...
AI brands as bait: How threat actors are using the AI hype in social engineering
In this article 1. ChatGPT-themed lure leads to phishing kit collecting credit card data 2. Claude-themed phishing campaign collected credentials and access tokens 3. "Awesome AI Windows Plugin” malvertising deploys Vidar stealer 4. Fake DeepSeek V4 installers on GitHub delivered Vidar Stealer 5...