Weak Password Requirements

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Weak Password Requirements via the authentication process. An attacker can bypass intended authentication mechanisms by sending a high volume of password guesses without restriction...

EUVD-2026-16315

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration...

Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.115: CVE-2025-48989: HTTP/2 protocol including DNS over HTTPS is vulnerable to "MadeYouReset" DoS attack bsc1243895. CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM...

2025 Talos Year in Review: Speed, scale, and staying power

The 2025 Talos Year in Review is now available to view online. The pace and scale of adversary activity in 2025 placed sustained pressure on security teams across industries. As with each annual report, our goal at Talos is to provide the security community with a clear analysis of the tactics,...

📄 Starlink DNS Rebinding

This python script implements a DNS rebinding attack targeting Starlink infrastructure CVE-2023-52235. ================================================================================================================================== | Title : Starlink DNS Rebinding Exploit | | Author : indoushka...

OESA-2026-1530 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures 30 days in default configurations, the...

CVE-2026-22040 NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is possible to reliably trigger heap memory...

CVE-2026-22040

The vulnerability CVE-2026-22040 affects NanoMQ (NanoMQ) Broker version 0.24.6. A crafted traffic pattern—high-frequency publishes with rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter—can reliably trigger a heap memory corruption in the Broker process, ca...

PT-2026-23067

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.6 Description NanoMQ MQTT Broker, an Edge Messaging Platform, is susceptible to a heap memory corruption issue in version 0.24.6. This occurs when a specific traffic pattern is generated, combining high-frequency...

How to Maximize DDoS Readiness with Proactive Protection Strategies

Strengthen DDoS Readiness with proactive protection strategies, risk assessments, traffic monitoring, scalable defenses, and rapid response planning...

flexget (3.6.5), oarepo (11.0.28) +1 more potentially affected by CVE-2026-27205 via flask (2.2.4)

flask PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - flexget 3.6.5 - oarepo 11.0.28 - rapid-qc-ms =1.0.0, =1.1.0 Source cves: CVE-2026-27205 Source advisory: OSV:PYSEC-2026-2151...

flexget (3.6.5), oarepo (11.0.28) +1 more potentially affected by CVE-2026-27205 via flask (2.2.4)

flask PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - flexget 3.6.5 - oarepo 11.0.28 - rapid-qc-ms =1.0.0, =1.1.0 Source cves: CVE-2026-27205 Source advisory: OSV:GHSA-68RP-WP8R-4726...

From Exposure to Exploitation: How AI Collapses Your Response Window

We’ve all seen this before: a developer deploys a new cloud workload and grants overly broad permissions just to keep the sprint moving. An engineer generates a "temporary" API key for testing and forgets to revoke it. In the past, these were minor operational risks, debts you’d eventually pay do...

From Shadow APIs to Shadow AI: How the API Threat Model Is Expanding Faster Than Most Defenses

The shadow technology problem is getting worse. Over the past few years, organizations have scaled microservices, cloud-native apps, and partner integrations faster than corporate governance models could keep up, resulting in undocumented or shadow APIs. We’re now seeing this pattern all over aga...

CVE-2026-1104 FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with...

8 Top MDR Providers for Mid-Market Companies

Top 8 MDR providers for mid-market firms needing expert detection, faster response, and reduced noise without building full in-house SOCs...

Availability Attacks without an Adversary: Evidence from Enterprise LANs

Denial-of-Service DoS conditions in enterprise networks are commonly attributed to malicious actors. However, availability can also be compromised by benign non-malicious insider behavior. This paper presents an empirical study of a production enterprise LAN that demonstrates how routine docking...

CVE-2025-7105

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in /api/convos/fork to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service...

Exploit for Uncontrolled Resource Consumption in Ietf Http

Exploit-Title-HTTP-2-2.0---Denial-Of-Service-DOS-...

MiracleLinux 8 : dotnet6.0-6.0.123-1.el8.ML.1 (AXSA:2023-6511:24)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6511:24 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description...