Why API Discovery Is Critical for Modern AppSec Programs

Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure , and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pul...

Malicious Package

Overview node-config-svg-contract is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview cilm-ui-commons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview index-design-system is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @hzero-front-ui/themes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview eslint-generate-prerelease is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview eslint-publish-release is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview datetime-fmt-xutil is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @kolbo/mcp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview core-js-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix...

MINI-PR8Q-MVG5-8CQR

Bulletin has no description...

MINI-24CF-6Q52-4WFR

Bulletin has no description...

ECHO-7458-DC2A-8577

Bulletin has no description...

Imperva API Security Token & Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks

Every year, the security industry publishes benchmark reports built more or less the same way: pick a handful of common vulnerabilities, measure how often they show up, publish the percentages, and move on. We just finished our second year running one of those reports — and the most important thi...

MINI-HV8M-QX62-M74H

Bulletin has no description...

PT-2026-71416

CWE-306: Missing Authentication for Critical Function...

Slackware Linux 15.0 / current rsync Vulnerability (SSA:2026-225-01)

The version of rsync installed on the remote host is prior to 3.5.0. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-225-01 advisory. New rsync packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding descriptio...

Fedora 43 : vaultwarden (2026-84a39c58c9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-84a39c58c9 advisory. update to 1.37.1 fixes several cves, and some undisclosed vulnerabilities patched by upstream that will be published later Tenable has extracted the precedin...

Qualys Introduces Real-Time Cloud Security Posture Management (CSPM) for Faster Risk Detection and Remediation

Key Takeaways Cloud environments change continuously, while security still relies on periodic scans, leaving gaps where risks go undetected. That gap becomes exposure. Qualys Real-Time CSPM monitors cloud changes as they happen, while still supporting periodic scans for environments that require...