SiteGuard's statistics feature runs attacker commands as root
A command-injection bug in the statistics function of SiteGuard Server Edition lets an attacker run OS commands as root or SYSTEM on the host, and i…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
- игры
AI
News
Tech
agents
ai
api
architecture
automation
backend
beginners
career
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Fridge hack costing millions and sparking fires stemmed from poor security
Incident hitting 700 supermarkets exploited outdated devices exposed to the Internet.
PaperCut Vulnerabilities Enable Pre-Authentication RCE: Patch Now to Prevent System Compromise
Introduction: The Critical Threat Within Print Management Systems A seemingly innocuous print management system has emerged as a critical attack vec…
word3-3
1. Artifact: log4j:log4j:1.2.17 Original JDK Target Java 1.4 (Class file major/minor version 48.0). Built to run on JDK 1.4 through JDK 8. When exec…
word-2
Artifact: log4j:log4j:1.2.17 Original JDK Target Java 1.4 (Class file major/minor version 48.0). Built to run on JDK 1.4 through JDK 8. When executi…
CVE-2026-41264: How a Regex Let Prompts Run Code in Flowise
import pandas as np , os as pandas pandas . system ( " xcalc " ) Those two lines are the whole bypass in CVE-2026-41264 , a CVSS 9.8 bug in Flowise…
Ghost CMS Mass Disclosure — 6 CVEs Including CVSS 8.1 Staff Session Bypass
A Ghost staff user with valid credentials can log into any other staff account using only the target's password — bypassing 2FA entirely. CVE-2026-1…
Mooncake Mass Disclosure — CVSS 9.8 Arbitrary Memory Read/Write in KV Cache Transfer Engine
A crafted TCP packet to Mooncake's transfer data port is enough to read and write arbitrary process memory — no authentication required. CVE-2026-10…
CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root
Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel & WHM — EmailTrack (Email ▸ Track Delivery) Vulnerability class CWE-89…
Attackers have been exploiting critical Zimbra flaw to steal emails
A simple email gives the attackers the ability to remotely inject OS commands.
LightLLM Mass Disclosure — 2 CVSS 9.8 Unauthenticated RCE in LLM Serving Framework
Two unauthenticated CVSS 9.8 RCEs in LightLLM — the LLM serving framework used with LLaMA, Mistral, and Qwen deployments. No patch confirmed. All ve…
Beyond CVSS: A Risk-Based Approach to Vulnerability Prioritization
Your vulnerability scanner shows: CVE-XXXX-XXXX CVSS: 9.8 Severity: Critical The natural reaction is: "This is critical. Put it at the top of the re…
Confused Deputy: The Old Bug That AI Agents Keep Reintroducing
Back in 1988, a compiler running on a commercial timesharing system had permission to write to a shared directory for recording language feature usa…
Confirmed vs. Potential Vulnerabilities: How to Act on Each Without Creating Alert Fatigue
Confirmed vulnerabilities are security flaws a scanner has actively verified as present — through direct proof, not inference. Potential vulnerabili…
CVE-2026–17633 - Authenticated RCE in Langflow OSS via /api/v1/custom_component
Summary Field Value CVE ID CVE-2026-17633 CVSS 8.5 (HIGH) CWE CWE-94 (Improper Control of Generation of Code) Affected Langflow OSS 1.0.0 – 1.10.3 P…
Before You Trust a Vulnerability Report, Check This Page First
A vulnerability report can look polished and still leave out the context you need to make a good decision. Before I look at the highest-severity fin…
Можно ли найти IDOR статическим анализом? Пишем ядро для Python
Написал ядро статического анализа для детекта IDOR-уязвимостей в Python-коде. Вместо поиска подозрительных конструкций и ключевых слов оно отслежива…
Droid ASC: A High-Performance Tool for Android Reverse Engineering and Vulnerability Discovery
Article Summary: Droid ASC is a high-performance tool for Android reverse engineering and mobile security testing. It reduces memory usage by two or…
CVE-2026-12243 — How a Percent-Encoded Slash Bypasses NLTK's Path Traversal Guard
CVE ID CVE-2026-12243 Affects NLTK (Natural Language Toolkit) ≤ 3.9.4 Weakness CWE-22 (Path Traversal) CVSS 3.1 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C…
7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them)
7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them) If you've used GitHub Copilot, Claude Code, or any AI coding assistant…
Finding Exposed Services (and Fixing Them) with ScanSearch
Ever wondered what parts of your infrastructure are accidentally visible to the entire internet? It's a common blind spot. We spend a lot of time se…
Как я решил приоритизацию самых критических уязвимостей и создал Vulnaware
У уязвимостей нет инцидента, нет простоя, нет тикета с горящим SLA. У неё нет ничего, что обычно заставляет IT сервис решать проблему быстрее. Именн…
Vulnerability giving attackers full control of Macs is under active exploitation
Screen-sharing bug lets remote hackers log in without a password.
Августовский «В тренде VM»: уязвимости ViPNet Client, ядра Microsoft Windows и Microsoft SharePoint
Хабр, привет! На связи Александр Леонов, ведущий эксперт центра безопасности Positive Technologies (PT ESC) и дежурный по самым опасным уязвимостям…
Thousands of servers can be backdoored by exploiting buggy motherboard controllers
Baseboard management controllers from the world's biggest manufacturers are a security mess.
Benchmarking GPT-4o, Claude 3.5 Sonnet, and Llama 3 for Automated Code Auditing & Vulnerability Detection
Evaluating LLMs on standardized leaderboards (like MMLU or HumanEval) is helpful, but it rarely tells you how a model performs on real-world edge ca…
Google pays $250K for Linux vulnerability allowing guest VM escapes
Both vulnerabilities allow untrusted users to gain root privileges.
Go-go Gadget...
Are you looking for vulnerability intel that standard scanners skip? OSV-Scanner is an awesome SCA tool for unearthing vulnerabilities in open-sourc…
PamStealer: the macOS stealer that checks your password through PAM before stealing it
Someone double-clicks what they think is Maccy, a clipboard manager, and gets a macOS password prompt: "Maccy wants to make changes." They type it i…
Inside the CVE List: How Vulnerabilities Get Their ID Cards
Thousands of software bugs are discovered every day around the world. But turning these bugs into an official, globally recognized CVE code (such as…