Radware 2026 Global Threat Analysis Report

This is the Radware 2026 Global Threat Analysis Report that provides details on global network and application attack trends of 2025...

CVE-2024-2343

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the formtourlaction function. This makes it possible for authenticated attackers, with contributor-level access and above, to...

CVE-2022-50682

A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine. This could enable header injection and potentially facilitate further web application attacks...

CVE-2022-50682

A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine. This could enable header injection and potentially facilitate further web application attacks...

Tech Overtakes Gaming as Top DDoS Attack Target, New Gcore Radar Report Finds

The latest Gcore Radar report analyzing attack data from Q1–Q2 2025, reveals a 41% year-on-year increase in total attack volume. The largest attack peaked at 2.2 Tbps, surpassing the 2 Tbps record in late 2024. Attacks are growing not only in scale but in sophistication, with longer durations,...

Addressing API Security with NIST SP 800-228

According to the Wallarm Q1 2025 ThreatStats report, 70% of all application attacks target APIs. The industry can no longer treat API security as a sidenote; it’s time to treat it as the main event. NIST seems to be on board with this view, releasing the initial public draft of NIST SP 800-228, a...

Attack and Defense Techniques in Large Language Models: a Survey and New Perspectives

Large Language Models LLMs have become central to numerous natural language processing tasks, but their vulnerabilities present significant security and ethical challenges. This systematic survey explores the evolving landscape of attack and defense techniques in LLMs. We classify attacks into...

Shifting from reCAPTCHA to hCaptcha

We are adding another CAPTCHA vendor and helping our customers migrate from Googles reCAPTCHA to hCaptcha. Why We Are Making This Change We continuously evaluate our security measures to ensure they align with the evolving landscape of threats. After carefully evaluating several different CAPTCHA...

CVE-2023-5515

The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications...

Slipping Through the Security Gaps: The Rise of Application and API Attacks

...

Slipping Through the Security Gaps: The Rise of Application and API Attacks

...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

K05391775: The BIG-IP ASM system may not properly perform attack signature checks

Security Advisory Description The BIG-IP ASM system may not properly perform attack signature checks on request and response content. This issue occurs when all of the following conditions are met: Your system is running BIG-IP 13.1.x. BIG-IP systems running 14.1.x and later are not affected. A...

Klyda - Highly Configurable Script For Dictionary/Spray Attacks Against Online Web Applications

The Klyda project has been created to aid in quick credential based attacks against online web applications. Klyda supports the use from simple password sprays, to large multithreaded dictionary attacks. Klyda is a new project, and I am looking for any contributions. Any help is very appreciated...

Integrate Serverless Security for Runtime Apps

Serverless solutions are prone to a high degree of application attacks. Learn how to build runtime application self-protection with vulnerability visibility and mitigation capabilities for your serverless applications...

Financial Services: Web Application Attacks Grow by 38% In First Half of 2021

During his career in the middle of the last century, professional bank robber Willie Sutton made off with an estimated $2 million in stolen money. Urban legend has it that when a journalist asked Sutton why he robbed banks, he replied, “That’s where the money is.” In later interviews, Sutton...

Reddit: Application level DOS at Login Page ( Accepts Long Password )

Application-level Denial of Service DOS It is an emerging class of security attacks on sites. They aim to overwhelm the site by flooding the server with requests that are disguised as legitimate users. The sudden increase in traffic shuts down machines and networks to make them unavailable to oth...

Web Application Firewalls Instrumental in Digital-First Banking

Like many industries, the banking and insurance sectors have shifted their resources to be digital-first, all the more so since the start of the global pandemic. For today’s customers, who increasingly begin their banking experiences using digital channels, whether online or mobile, a digital-fir...

It's universal: We all love to exchange gifts. Singles' Day and Diwali are two more reasons to do so.

There is scientific evidence that humans secrete "feel good" chemicals in their brain, such as serotonin, dopamine, and oxytocin, while giving. So it's no wonder that many of us look forward to the holidays. Online mobile shopping trends for Singles' Day and Diwali certainly confirm that. Sadly,...

Web Application and API Protection -- From SQL Injection to Magecart

SQL injections were first discovered in 1998, and over 20 years later, they remain an unsolved challenge and an ongoing threat for every web application and API. The Open Web Application Security Project OWASP highlighted injection flaws in its Top 10 lists for both web application security risks...