227 matches found
MINI-FP74-CCM4-3RQQ
Bulletin has no description...
MINI-G82C-XR2F-79FC
Bulletin has no description...
MINI-825F-JG4F-FGJ9
Bulletin has no description...
MINI-4C28-PM55-F938
Bulletin has no description...
MINI-6MFC-H745-F78R
Bulletin has no description...
MINI-CM58-VC2F-GJHV
Bulletin has no description...
MINI-6245-838X-CX2R
Bulletin has no description...
MINI-P45G-RCGM-6CC3
Bulletin has no description...
MINI-GCF4-75MV-29GH
Bulletin has no description...
CVE-2026-45337
Better Auth (TypeScript library) vulnerability CVE-2026-45337 affects versions 1.6.0–1.6.10 in the deviceAuthorization plugin. The root cause is that the verification path does not claim ownership of the pending device code and the approve/deny checks short-circuit when userId is unset, allowing ...
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...
MINI-32JX-3XFG-235H
Bulletin has no description...
MINI-M23W-W8JF-9GH8
Bulletin has no description...
MINI-V24M-X4MX-RP6P
Bulletin has no description...
EUVD-2026-42726
Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to...
MINI-X57P-536M-268V
Bulletin has no description...
MINI-39HF-MXX6-WGRH
Bulletin has no description...
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password page. It used a...
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
One of the most common pieces of anti-phishing advice is to double-check the website's domain name before providing your credentials. Typically, a fraudulent domain stands out to the trained eye, differing from the official URL by at least a few characters. Recently, however, we encountered a...