WebGoat v2026.3

WebGoat: A deliberately insecure Web Application Introduction WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. This program is a demonstration of common server-side application flaws. The exercises are intended to be used b...

A week in security (September 7 – September 13)

Here's what we've covered in the last seven days on Malwarebytes Labs: Crypto customers targeted by scammers after email marketing provider breach Android malware creates a hidden copy of your banking app BlueMoon exploit kit turns Chrome and Windows flaws into attacks Will AI kill us all within...

CVE-2026-87637

creationtimestamp| type| source ---|---|--- 2026-09-10 01:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4wrxnbwu2j 2026-09-10 04:45:21+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 05:37:06+00:00| seen|...

A week in security (August 31 – September 6)

Last week on Malwarebytes Labs: The hidden work of modernizing Malwarebytes X Money rollout linked to password-reset attacks Free streaming boxes may be routing criminal traffic through your home StreamRat Android malware spreads through Meta and TikTok ads Your phone or computer may soon ask how...

Practice Makes (Im)Perfect: A Look Back at Benchmarking Practices for Microarchitectural Side-Channel Attacks

Microarchitectural side-channel research has grown at an exceptional pace in recent years, increasing the need for rigorous and meaningful benchmarking. Early attack papers typically relied on indirect proxies, such as covert-channel bandwidth or key-recovery on naive AES and RSA implementations,...

Apache Log4j2 FilteredObjectInputStream Code Execution

The vulnerability of the FilteredObjectInputStream component in the Apache Log4j2 logging library is related to deserialization mechanism flaws. Exploiting this vulnerability allows an attacker to execute arbitrary code...

ASB-A-397216638

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname CVE-2026-16093: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers CVE-2026-16072: Organization...

CVE-2026-79242

creationtimestamp| type| source ---|---|--- 2026-08-26 05:18:15+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-31 05:17:40+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260831...

CVE-2026-80192

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

PT-2026-109466

Уязвимость сервера приложений Apache Tomcat связана с недостатками процедуры авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность и доступность защищаемой информации...

CVE-2026-21752 HCL Hive is affected by a use of vulnerable third-party components

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...

EUVD-2026-64917

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...

CVE-2026-21752

HCL Hive is affected by its use of vulnerable third-party components , which could allow a remote attacker to gain unauthorized access or compromise the system by exploiting publicly documented security flaws. The CVSS 3.1 score is 7.5 (HIGH) , with a High confidentiality impact over a network wi...

Automated-Data-and-Code-Quality-Controller

codesentry Static analysis for Python and JavaScript. Finds i...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2025-62718, CVE-2026-40175)

Summary Axios is vulnerable to infrastructure tampering and Critical SSRF and exposure of private internal/loopback endpoints attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser an...

PT-2026-80728

A security issue was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystems: - Open vSwitch;...

[SECURITY] [DSA 6423-1] kitty security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6423-1 [email protected] https://www.debian.org/security/ Nilesh Patra August 09, 2026 https://www.debian.org/security/faq -...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses micrometer-core-1.15.11.jar, spring-core-6.2.18.jar, spring-security-web-6.5.10.jar, spring-data-commons-3.5.11.jar, spring-webmvc-6.2.18.jar, spring-expression-6.2.18.jar and spring-security-config-6.5.10.jar which are vulnerable to CVE-2026-40983, CVE-2026-40984,...