PT-2026-95476

Name of the Vulnerable Software and Affected Versions Mojolicious versions prior to 9.48 Description The CSRF helpers csrf field, csrf token, and csrf protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected i...

CVE-2026-93604: Improper Access Control

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-54519: Missing Authorization

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

SUSE SLES15 Security Update : perl-Mojolicious (SUSE-SU-2026:4151-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4151-1 advisory. This update for perl-Mojolicious fixes the following issue: - CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH...

CVE-2026-87242

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Hyperion Financial...

CVE-2026-87198

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financia...

EUVD-2026-79777

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Whil...

EUVD-2026-79604

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Introduction Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more mature organizations, this testing happens...

Astra Linux – Vulnerability in usbutils

The vulnerability of the readlinkrecursive function in the USBUtils utility is related to buffer overflow on the stack. Exploiting this vulnerability could allow an attacker to cause a system failure...

Astra Linux – Vulnerability in Linux, Linux 5.10

A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c within the Linux kernel. This flaw allows a local attacker with special user privileges CAPSYSADMIN or CAPSYSRAWIO to cause confidentiality issues...

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue: CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle bsc1271431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

SUSE-SU-2026:4151-1 Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue: - CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle bsc1271431...

The vulnerability of the Siebel Cloud Manager component in the cloud version of the Siebel CRM Cloud Applications management system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Siebel Cloud Manager cloud version of the Siebel CRM Cloud Applications system’s customer relationship management system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

ROS-20260911-73-0040

The vulnerability of the Password component in Microsoft Edge and Google Chrome relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the ep93xx_spi_setup_dma() function in the drivers/spi/spi-ep93xx.c file of the Linux operating system’s SPI device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ep93xxspisetupdma function in the drivers/spi/spi-ep93xx.c file of the Linux operating system’s SPI device driver is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...

A week in security (August 31 – September 6)

Last week on Malwarebytes Labs: The hidden work of modernizing Malwarebytes X Money rollout linked to password-reset attacks Free streaming boxes may be routing criminal traffic through your home StreamRat Android malware spreads through Meta and TikTok ads Your phone or computer may soon ask how...

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between...

X Money rollout linked to password-reset attacks

X says attackers may be targeting accounts because its X Money payments service is now more widely available. The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X say...

Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data

Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track , the court case management platform sold by its West Publishing Corporation unit, in March 2026, affecting courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. West Publishing said it...