CVE-2026-48036

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

GHSA-7F3J-J7JJ-R3VR Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled...

Opening the Black Box: Agentless Threat Detection for Virtual Appliances

Mapping appliances event logs to real-world campaigns: A step-by-step researcher’s guide to continuous agentless monitoring...

DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection

Most existing LLM safety evaluation and defense methods follow a static formulation: jailbreak vulnerabilities are evaluated with fixed attack methods, and guardrails are trained on fixed malicious prompt datasets. However, real-world adversaries continuously evolve their capabilities and expand...

CVE-2026-16450

The CVE-2026-16450 issue affects zsadmin2025 ZS-Admin (up to commit b52e14536d59fda11e56e2536a1c32e82a38cead) in the MyBatis-Plus Tenant Plugin, specifically the function getTenantId in /api/system/sys/dept/page. The underlying problem is manipulation of the X-Tenant-Id argument, which leads to a...

Fig Expands SecOps Engineering Lifecycle as Security Teams Seek More Resilient Infrastructure

Learn how Fig adds testing, deployment, and continuous verification to SecOps, helping security teams keep detections reliable as infrastructure evolves. daily...

CVE-2026-64175

A flaw was found in the Linux kernel's iwlwifi driver. When the Wi-Fi firmware crashes, the driver continues to process network transmission requests inefficiently. This creates a continuous loop of attempting to send data through an unresponsive firmware, consuming excessive CPU resources and...

AuthProbe: Specification-Driven, Multi-Identity Detection of Broken Object-Level Authorization in Recruitment API

Broken Object-Level Authorization BOLA, also known as Insecure Direct Object Reference IDOR, has topped the OWASP API Security ranking since 2019 and is the root cause of some of the largest exposures of applicant data in recruitment technology. The defining feature of this flaw class is that a...

dotnet: .NET: Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service DoS. An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash...

Top Five Compliance Audit Software and Tools: Mastering Modern Regulatory Risk

Executive Summary Manual audit preparation no longer scales across hybrid, cloud, endpoint, and application environments. Compliance monitoring software must move from checklist validation to continuous control monitoring. The strongest platforms connect evidence collection with risk...

EUVD-2026-45873

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-14254 Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force...

CVE-2026-14254 Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force...

EUVD-2026-44930

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force...

CVE-2026-14254

CVE-2026-14254 describes a race condition in Delphix Continuous Data’s account lockout mechanism. Parallel authentication requests could bypass the lockout threshold because the failed-login counter and lockout status were not updated in time, undermining brute-force protections and allowing cont...

Improper Authentication

go.woodpecker-ci.org/woodpecker/v3 is vulnerable to Improper Authentication. The vulnerability is due to the gRPC layer trusting a client-supplied agentid value instead of the authenticated agent identity after JWT verification, which allows an authenticated attacker to impersonate any other agen...

PT-2026-60476

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force...

CVE-2026-14254: Improper Restriction of Excessive Authentication Attempts

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force...

CVE-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...