CVE-2016-20036

Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various parameters is not properly sanitized before being returned to users. Attackers can inject malicious script code through parameters like...

CVE-2026-28521

arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information...

CVE-2026-28521 arduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosure

arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information...

CVE-2026-28521 arduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosure

arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information...

PT-2026-25552

arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information...

Wa3r-OffSec-Kit

Waer's Cybersecurity Knowledge Base 50+ documents · 2...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to runc CVE-2025-52881

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to runc CVE-2025-52881. The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2025-52881 DESCRIPTION: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions...

Twenty Years of Cloud Security Research

This post will look at the past 20 years of cloud security research, separating the two decades into eras with important milestones defined that resulted in the change of one era to the next...

Malicious code in thief-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bcebc8919f53e78dae4adb16168fdd37abea93d969d3411b948ed1781c6faf28 During installation, package attempts to exfiltrate cloud credentials and sensitive env variables --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-1407 Malicious code in thief-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bcebc8919f53e78dae4adb16168fdd37abea93d969d3411b948ed1781c6faf28 During installation, package attempts to exfiltrate cloud credentials and sensitive env variables --- Category: MALICIOUS - The campaign has clearly malicious...

PT-2026-25149

Name of the Vulnerable Software and Affected Versions Multi-Cloud Object Gateway Core affected versions not specified Description A container privilege escalation flaw exists in certain Multi-Cloud Object Gateway Core images. The issue originates from the /etc/passwd file being created with...

From transparency to action: What the latest Microsoft email security benchmark reveals

In our last benchmarking post, Clarity in complexity: New insights for transparent email security ,1 we shared why transparency matters more than ever in email security and how clear, consistent benchmarking helps security teams cut through noise and make confident decisions. Today, we’re...

BIT-PARSE-2026-30939 Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The server...

EUVD-2026-11381

SiYuan has a Full-Read SSRF via /api/network/forwardProxy...

GHSA-56CV-C5P2-J2WG SiYuan has a Full-Read SSRF via /api/network/forwardProxy

Summary The /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to...

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

Summary The /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to...

GHSA-WRHR-RF8J-R842 ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.

The pcd coder lacks proper boundary checking when processing Huffman-coded data. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. ==3900053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003c6c at pc 0x55601b9cc552 bp...

How to Scale Phishing Detection in Your SOC: 3 Steps for CISOs

Phishing has quietly turned into one of the hardest enterprise threats to expose early. Instead of crude lures and obvious payloads, modern campaigns rely on trusted infrastructure, legitimate-looking authentication flows, and encrypted traffic that conceals malicious behavior from traditional...

Security Bulletin: IBM OpenPages for Cloud Pak for Data is Vulnerable to Improper Restriction of XML External Entity Reference (CVE-2022-39135)

Summary IBM OpenPages for Cloud Pak for Data is Vulnerable to Apache Calcite Core 1.37.0 introduced the SQL operators vulnerable to a potential XML External Entity XXE attack. . These vulnerabilities were remediated. Vulnerability Details CVEID:CVE-2022-39135 DESCRIPTION: Apache Calcite 1.22.0...

📄 Microsoft Windows Cloud Files Mini Filter Driver Local Privilege Escalation

Proof of concept exploit for a heap-based buffer overflow vulnerability in the Windows Cloud Files Mini Filter Driver cldflt.sys that allows local attackers to escalate privileges from user-level to SYSTEM-level access on affected Windows systems. The vulnerability exists in the Cloud Files Mini...