1340 matches found
Is Your AppSec Program Built to Close the OWASP Top 10 2025 Coverage Gap?
Key Takeaways Most AppSec programs treat API-layer coverage as a DAST extension, but BOLA, BFLA, and SSRF require authenticated multi-role testing that traditional scanners weren’t built to run at scale. Modern authentication flows OAuth2, JWT validation, MFA-protected sessions often fall outside...
GHSA-93Q6-WWJH-JC6H @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString
Finding Location: core/src/server/render-to-string.ts:307-311 CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. Mitigating Factor: These CSS injection vectors onl...
PT-2026-55383
Finding Location: core/src/server/render-to-string.ts:307-311 CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes 65xpression, null bytes, or CSS comments exp//ression. Mitigating Factor: These CSS injection vectors only...
CVE-2026-53308
In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Free allocated workqueue and fix removal order Use devm interface for allocating workqueue to fix two bugs at the same time: 1. Driver leaks the memory on remove, because the workqueue is not destroyed. 2...
Agentic Disconnect: The Latency Crisis Facing Modern AI Architecture
...
PT-2026-51516
Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12 Description The software fails to validate cookie names within the setCookie, serialize, and serializeSigned functions. When an application uses a user-controlled cookie name, invalid characters such as control...
PT-2026-49241
Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.1 Description The native TCP stack contains a use-after-free flaw when iterating the global connection list in the net tcp foreach function. The issue occurs because the function releases the tcp lock while invokin...
CVE-2026-8613
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titletag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-48392
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title tag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
zero2shell-50
ZeroToShell-50 🚀 A highly curated, containerized training g...
The Intersection of Encryption and AI
As part of their 20th Anniversary celebration, Dark Reading asked five cybersecurity industry leaders who wrote blogs or columns for them over the years to select their favorite piece and share their reflections on the topic today. This is my section. Renowned technologist and author Bruce Schnei...
Why Encrypted File Sharing Is Essential for Modern Businesses
Consider the history of any recent corporate scandal, and it is quite possible to guess what the story…...
Hunting-Bugs
2026 Practical Bug Bounty Guide Built on real-world experie...
State of SDLC Security 2026: How Risk Scales in Modern Development
Insights from real-world environments into how code, developer tooling, automation, and AI are reshaping application security...
Filter-Then-Verify: A Multiphase GNN and ModernBERT Framework for Social Engineering Detection in Email Networks
Social engineering attacks exploit human trust rather than software vulnerabilities, making them difficult to detect using conventional filters. We propose a two-stage filter-then-verify framework combining inductive Graph Neural Networks GNNs for structural anomaly detection with a co-attention...
homebridge-modern-forms (0.0.2), node-red-contrib-self-healing (>=0.9.1, <=0.9.3) potentially affected by unknown CVE via arpping (2.0.0)
arpping NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on arpping and may be impacted: - homebridge-modern-forms 0.0.2 - node-red-contrib-self-healing =0.9.1, =0.9.3 Source cves: unknown CVE Source advisory: MEND:WS-2020-0439...
Widening the Gap: Exploiting LLM Quantization Via Outlier Injection
LLM quantization has become essential for memory-efficient deployment. Recent work has shown that quantization schemes can pose critical security risks: an adversary may release a model that appears benign in full precision but exhibits malicious behavior once quantized by users. However, existin...
Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks
Recent cryptographic results establish that neural networks can be backdoored such that no efficient algorithm can distinguish them from a clean model. These guarantees, however, have been confined to stylised architectures of limited practical relevance, leaving open whether comparable...
Modern Defensible Architecture: Resilience for the Australian Federal Government
How Wiz enables Australian government agencies to operationalise MDA with real-time context, zero trust enforcement, and end-to-end cloud visibility...
PT-2026-35876
Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.3 Description The tsig plugin can be bypassed on non-plain-DNS transports, specifically DoT, DoH, DoH3, DoQ, and gRPC. This occurs because the plugin relies on the transport writer's TsigStatus function instead o...