Twitter Whistleblower Complaint: The TL;DR Version
Twitter is blasted for security and privacy lapses by the company’s former head of security who alleges the social media giant’s actions amount to a national...
Threat Intelligence Feed
Aggregating 3834 articles from trusted cybersecurity sources
LATEST CVEs
CVE-2026-6583
A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edi
CVE-2026-6582
A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_
CVE-2026-6581
A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function SetMobileAPIn
CVE-2026-6580
A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of
CVE-2026-6579
A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file bl
CVE-2026-6578
A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the fi
CVE-2026-6577
A vulnerability was identified in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of
CVE-2026-6576
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHan
CVE-2026-6574
A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file
CVE-2026-6573
A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.m
CVE-2026-6572
A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown f
CVE-2026-6571
A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGr
CVE-2026-6570
A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file
CVE-2026-6569
A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/co
CVE-2026-6568
A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareO
CVE-2026-6564
A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the compone
CVE-2026-6563
A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoByI
CVE-2026-6562
A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Sear
CVE-2026-6561
A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file applicat
CVE-2026-6560
A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_B
CVE-2026-6559
A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/l
CVE-2026-0868
The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
CVE-2026-6056
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-41242
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers
CVE-2026-40948
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `s
CVE-2026-2986
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes
CVE-2026-2505
The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including
CVE-2026-0894
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin
CVE-2026-41254
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed
CVE-2026-32690
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by th
CVE-2026-32228
UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate t
CVE-2026-30912
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to f
CVE-2026-30898
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause
CVE-2026-25917
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing t
CVE-2026-41253
In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working
CVE-2026-6518
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload an
CVE-2026-6048
The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget
CVE-2026-4801
The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via exter
CVE-2026-40494
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P
CVE-2026-40493
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P
Latest News
Firewall Bug Under Active Attack Triggers CISA Warning
CISA is warning that Palo Alto Networks’ PAN-OS is under active attack and needs to be patched ASAP.
Fake Reservation Links Prey on Weary Travelers
Fake travel reservations are exacting more pain from the travel weary, already dealing with the misery of canceled flights and overbooked hotels.
iPhone Users Urged to Update to Patch 2 Zero-Days
Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack.
Google Patches Chrome’s Fifth Zero-Day of the Year
An insufficient validation input flaw, one of 11 patched in an update this week, could allow for arbitrary code execution and is under active attack.
Upgrading Mozilla’s Root Store Policy to Version 2.8
In accordance with the Mozilla Manifesto, which emphasizes the open development of policy that protects users’ privacy and security, we have worked with the ...
Data Breaches
Vercel Reports Data Breach Amid Claims of Compromised Internal Infrastructure
According to a recent security bulletin published by Vercel, the cloud platform company has suffered a data breach involving unauthorized access to its inter...
Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials
Web infrastructure provider Vercel has disclosed a security breach that allows bad actors to gain unauthorized access to "certain" internal Vercel systems. T...
Vercel confirms breach as hackers claim to be selling stolen data
Cloud development platform Vercel has disclosed a security incident after threat actors claimed to have breached its systems and are attempting to sell stole...
ShinyHunters alleges Kemper Corporation hack, exposes over 13M records
Major U.S.
That data breach alert might be a trap
Ignoring a real breach notification invites risk, but falling for a bogus one could be even worse. Stop reacting on autopilot.
Recently leaked Windows zero-days now exploited in attacks
Threat actors are exploiting three recently disclosed Windows security vulnerabilities in attacks aimed at gaining SYSTEM or elevated administrator permissio...
Cookeville Regional Medical Center hospital data breach impacts 337,917 people
A ransomware attack on Cookeville Regional Medical Center hospital (Tennessee) exposed data of 337,000 people after hackers stole 500GB of sensitive informat...
Major luxury clothing retailers allegedly breached, samples leaked
Cybernews reports that leading global luxury apparel retail firms Lacoste, Ralph Lauren, Canada Goose, and Carter's were claimed to have had their "supply ch...
Cookeville Medical Center Notifies Patients After July 2025 Ransomware Attack
Tennessee's CRMC notifies over 337,000 patients of Rhysida ransomware breach exposing sensitive data
Data Breach at Tennessee Hospital Affects 337,000
Cookeville Regional Medical Center was targeted last year by the Rhysida ransomware group, which stole 500GB of data. The post Data Breach at Tennessee Hospi...
Data breach at edtech giant McGraw Hill affects 13.5 million accounts
The ShinyHunters extortion group has leaked data from 13.5 million McGraw Hill user accounts, stolen after breaching the company's Salesforce environment ear...
Smashing Security podcast #463: This AI company leaked its own code. It’s also built something terrifying
A hacking group claims to have broken into the flood defence system protecting Venice's Piazza San Marco - and is offering to sell access to whoever wants it...