Vulnerabilities
7 npm Package Mistakes That Expose Your Codebase to Attacks
Most supply chain compromises stem from local dependency management errors rather than external exploits, making your lock files the primary defense line.
Vulnerabilities
Vulnerabilities
Check Inventory: TMS Amelia Plugin SQL Injection Flaw Exposes Sites to Database Manipulation
A critical SQL injection flaw in TMS Amelia Booking Plugin versions up to 2.4.10 exposes sites to database manipulation, requiring immediate inventory checks.
Vulnerabilities
Secure AI Coding Agents Against Malicious Package Injection
AI coding agents introduce vulnerabilities faster than teams can fix them, requiring continuous security checks beyond standard pull request scans.
Vulnerabilities
Secure IoT Refrigeration Controllers After Mass French Supermarket Breach
Attackers exploited vulnerabilities in internet-connected fridge units at 700 French stores using flaws flagged by Claroty and CISA in three specific device models.
Vulnerabilities
Upgrade WeGIA to 3.8.6 to stop CVSS 9.8 SQL injection from exposing billing and credentials
A critical SQL injection in WeGIA versions prior to 3.8.6 allows attackers to manipulate billing and credential data without authentication.
Vulnerabilities
Patch Windows Now to Fix Exploited Shell Bypass and Record 1,413 Flaws
Microsoft’s October update fixes a record number of flaws, including an actively exploited Windows Shell zero-day that bypasses security warnings.
Vulnerabilities
Secure Frontend Dashboard Instances Affected by CVE-2026-107424 Privilege Escalation Flaw
A critical vulnerability in Frontend Dashboard versions through 3.0.7 allows attackers to escalate privileges, requiring immediate inventory and containment of exposed instances.
Vulnerabilities
Update .NET Runtimes to Fix High-Severity Out-of-Bounds Write in System.Net.Sockets
Windows applications using .NET 8 through 11 must update NuGet packages to address CVE-2026-70197, a high-severity remote code execution flaw in socket handling.
Vulnerabilities
Patch Zoom Clients to Block Network-Based Certificate Validation Flaws
Two high-severity flaws in Zoom Workplace and My Notes allow unauthenticated attackers to access sensitive data over a network, requiring immediate version checks.
Vulnerabilities
Update Chrome Extended Stable and Stable Channels to Patch 28 and 37 Security Flaws
Google releases critical patches for memory corruption bugs in latest desktop builds for Windows, Mac and Linux.
Vulnerabilities
Isolate Genesis World Instances to Block Directory Traversal Flaws
Zero Day Initiative reports three unpatched flaws in Genesis World that enable information disclosure and remote code execution via manipulated file paths.
Vulnerabilities
Inspect QEMU vhost setups: Stale IOTLB cache enables VM escape and kernel R/W via CVE-2026-74580
A stale IOTLB cache in Linux vhost allows local privilege escalation and guest escape, requiring immediate review of virtualized environments using QEMU.
Vulnerabilities
Patch AEM Now: Critical Code Execution Flaw Affects Cloud and On-Prem Instances
Adobe Experience Manager users must address CVE-2026-106626, a critical input validation flaw allowing privileged attackers to run arbitrary code without interaction.
Vulnerabilities
Patch Blazor Debugger Now to Block Remote Code Execution on Dev Machines
CVE-2026-102870 allows attackers to run code on developer workstations via the ASP.NET Core debugger; update NuGet packages immediately.
Vulnerabilities
Update Ivanti Connect Secure to 25.1.3+ to Stop Unauthenticated Remote Command Execution via CVE-2026-104935
Ivanti confirms zero-day exploitation of CVE-2026-104935, allowing remote command execution without credentials on affected VPN appliances.
Vulnerabilities
CISA Known Exploited Vulnerabilities: Action Plan for Small Business
Small teams can prioritize patching by focusing only on vulnerabilities that attackers are actively using in the wild right now.
Vulnerabilities
How Cross-Site Scripting Works Step by Step
Cross-site scripting fails when the browser treats user input as data rather than executable code, breaking the attack chain before any payload runs.
Vulnerabilities
Authentication Bypass Vulnerabilities: How They Work and How to Fix Them
Authentication bypass flaws often stem from predictable logic errors in code rather than complex cryptographic weaknesses, allowing attackers to skip identity checks entirely.
Vulnerabilities
Patch SaltStack Docs Repo to Block Malicious PR Code and Prevent Secret Theft
A critical flaw in the SaltStack documentation repository allowed attackers to steal secrets by injecting malicious code into forked pull requests before a recent patch.
Vulnerabilities
Zero-Day Vulnerabilities Explained: How Unknown Flaws Threaten Your Data
A zero-day vulnerability is a software flaw unknown to the vendor, leaving users exposed until a patch exists, often exploited before detection.
Vulnerabilities
Self-Hosted GitLab Vulnerability Prevention Checklist
Self-hosted GitLab instances require strict network segmentation and least-privilege database access to prevent lateral movement after an initial breach.
Vulnerabilities
Patch IBM Db2 Mirror for i 7.4-7.6 Now to Address Critical Code Execution Risk (CVE-2026-96012)
IBM Db2 Mirror for i versions 7.4 through 7.6 contain a critical flaw allowing authenticated attackers to escalate privileges and execute code.
Vulnerabilities
Patch MarkLogic Server Now to Block Privilege Escalation in CVE-2026-85955
A critical flaw in MarkLogic Server allows remote attackers to execute code with elevated permissions by bypassing required privilege checks.
Vulnerabilities
Patch GitLab CE and EE to Block Unauthenticated Remote Code Execution
A critical flaw in GitLab CI/CD allows unauthenticated attackers to run arbitrary code. Self-managed users must upgrade immediately to mitigate this severe risk.