ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole and the core @apostrophecms/archive-page does, so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The move operation is...

nono v0.75.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

GHSA-8CJ9-R88M-8945 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...

Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Improper Check for Unusual or Exceptional Conditions, Cross-site Scripting (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)

Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-33937 DESCRIPTION:...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Authorization (CVE-2026-33186)

Summary There are vulnerabilities in google.golang.org/grpc-v1.78.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33186. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions pri...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...

Exploit for CVE-2026-65643

CVE‑2026‑65643 – cPanel Domain Parking RC...

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

The worst part is how normal these attacks look. A call from IT. A shared file. A trusted app. A simple request to click “Allow.” Why break in when someone might open the door? That idea runs through this edition. Attackers use real tools, fake login pages, old account links, and software guides...

envsec v1.0.0-rc.2

envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Impact Standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations. When Cilium deployment is configured with a specific custom clusterName rather than...

GHSA-FM8W-2M5W-9J7R Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Impact Standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations. When Cilium deployment is configured with a specific custom clusterName rather than...

Ruby on Rails: Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown

Summary ActionText::Contenttomarkdown escapes text nodes so that a stored rich text body cannot turn into Markdown syntax. Text whose immediate parent is or is exempt from that escaping MarkdownConversion::SKIPESCAPINGPARENTS and is instead kept inert by the delimiter its visitor wraps around it...

SUSE CVE-2026-80734

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

Exploit for CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin...

CVE-2026-85239

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

CVE-2026-75035

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

ASCII smuggling crosses over from AI prompt injection to phishing evasion

In this article 1. What is ASCII smuggling? 2. Writing a practical ASCII-smuggling signature 3. What we observed: ASCII smuggling repurposed for phishing 4. What is known and what is new 5. Is there a detection gap? 6. Mitigation and protection guidance 7. References 8. Learn More Microsoft...

ASCII smuggling crosses over from AI prompt injection to phishing evasion

In this article 1. What is ASCII smuggling? 2. Writing a practical ASCII-smuggling signature 3. What we observed: ASCII smuggling repurposed for phishing 4. What is known and what is new 5. Is there a detection gap? 6. Mitigation and protection guidance 7. References 8. Learn More Microsoft...