Vulnerabilities
Chrome Sandbox Escape: AI-Assisted Chain of Three Zero-Days Impacts Windows Users
Xbow researchers used an AI model to chain three Chrome flaws, escaping the Windows sandbox in six days and earning a $250,000 bounty from Google.
Vulnerabilities
Vulnerabilities
Vulnerabilities
WeGIA 3.8.6 Patches Unauthenticated SQL Injection in Billing Module
LabRedesCefetRJ released version 3.8.6 to fix a critical SQL injection flaw that allowed attackers to steal or delete data without logging in.
Vulnerabilities
Unauthenticated Heap Overflow in Juniper SVR Enables Remote Denial of Service
Malformed IPv4 packets targeting Secure Vector Routing interfaces allow attackers to crash Juniper SRX firewalls via a critical buffer overflow vulnerability.
Vulnerabilities
.NET Improper Link Resolution Vulnerability Enables Local Privilege Escalation on Linux and macOS
An authorized attacker can exploit improper link resolution in .NET to elevate privileges locally on Linux and macOS systems running affected runtime versions.
Vulnerabilities
Linux vhost stale cache flaw CVE-2026-74580 grants root and enables VM escape to host
A stale cache bug in Linux vhost allows local users to gain root privileges or lets virtual machines break out to the host system.
Vulnerabilities
.NET WPF Patch Fixes High-Severity RCE Flaw in Framework 8-11 Preview Requiring User Interaction
Microsoft patches a high-severity vulnerability in .NET WPF that allows attackers to run arbitrary code if users engage with crafted content.
Vulnerabilities
.NET WPF Out-of-Bounds Write in CVE-2026-70007 Allows Remote Code Execution
Microsoft patches high-severity heap corruption flaw in .NET WPF runtime that enables remote attackers to execute code via crafted pixel-shader bytecode.
Vulnerabilities
ASP.NET Core Unbounded Memory Growth in Localization Logic
Unauthenticated requests can exhaust memory via synthetic culture names in ASP.NET Core, leading to denial of service across multiple platforms.
Vulnerabilities
.NET WPF Deserialization Flaw Enables Remote Code Execution on Windows Systems
A high-severity deserialization flaw in .NET WPF lets attackers run code on Windows systems if a user interacts with a crafted link.
Vulnerabilities
Ivanti Zero-Day Chain Grants Unauthenticated Root Access to Patched Gateways
Threat actor UTA0576 chained three Ivanti zero-days to bypass authentication and execute commands as root on fully patched remote access gateways.
Vulnerabilities
Samsung QA-Board Critical OS Command Injection Vulnerability Earns 9.8 CVSS Rating in CVE-2026-110392
A critical flaw in the Samsung platform allows OS command injection, rated 9.8. No patch status is provided in the source material.
Vulnerabilities
Directory Listing Exposure: What It Is and How to Stop It
Default server configurations often serve file indexes when index files are missing, handing attackers a map of your internal structure without authentication.
Vulnerabilities
Prototype Pollution Explained: How Hidden Data Overwrites Break Web Apps
A single injected property can overwrite default settings in a browser, turning safe default behaviors into security failures without any user interaction.
Vulnerabilities
CVE-2026-106621 Enables Arbitrary Code Execution in Adobe ColdFusion Without User Interaction
A critical code injection flaw in Adobe ColdFusion allows remote attackers to run arbitrary code without needing victim interaction.
Vulnerabilities
Difference Between SQL Injection and Command Injection
SQL injection targets the database interpreter, while command injection targets the operating system shell, creating distinct attack surfaces that require separate mitigation strategies.
Vulnerabilities
API Vulnerabilities: Definition, Mechanics, and Mitigation Strategies
API flaws often bypass traditional web defenses by exposing data logic directly, allowing attackers to manipulate business rules rather than just stealing credentials.
Vulnerabilities
Cisco UCS UEFI Secure Boot flaw lets attackers run rogue code via shell memory edits
Attackers with physical access or valid credentials can bypass UEFI Secure Boot on Cisco UCS servers using shell memory commands.
Vulnerabilities
What Is Virtual Patching: How It Works Without Code Changes
Virtual patching stops attacks at the network edge by filtering malicious traffic, allowing you to protect systems immediately while developers prepare permanent code fixes.
Vulnerabilities
Windows Network Policy Server Heap Buffer Overflow Permits Unauthenticated Remote Code Execution
A critical buffer overflow in Network Policy Server lets attackers run code remotely on affected Windows versions without prior authentication.
Vulnerabilities
Microsoft QUIC Use-After-Free Flaw Enables Remote Code Execution on Windows 11
An unauthorized attacker can execute code over a network via a critical use-after-free vulnerability in the Microsoft QUIC protocol on multiple Windows 11 versions.
Vulnerabilities
Content Security Policy unsafe-inline: What It Does and How to Remove It
The unsafe-inline directive nullifies Content Security Policy protections by permitting any script execution, turning a security header into a decorative label that attackers bypass with ease.
Vulnerabilities
IBM MCP Context Forge CVE-2026-53709 Allows Unauthenticated Admin Token Forgery
A critical flaw in IBM’s MCP Context Forge lets attackers create admin tokens without credentials. The issue persists until version 1.0.2 is deployed.
Vulnerabilities
npm Trusted Publishing Slug Reuse Vulnerability Left 1,500 Packages Exposed to Hijacking via Abandoned GitHub Repo Names
Attackers could hijack over 1,500 npm packages by reclaiming abandoned GitHub repository names, bypassing credential checks to push updates.
Vulnerabilities
Self-Hosted GitLab Vulnerability Myths: What Actually Compromises Your Instance
Most self-hosted GitLab breaches stem from misconfiguration and exposed services, not zero-day exploits in the core codebase.