SiteGuard's statistics feature runs attacker commands as root
A command-injection bug in the statistics function of SiteGuard Server Edition lets an attacker run OS commands as root or SYSTEM on the host, and i…
Open Source
⚑ Report a ProblemLatest Open Source news from Tech News
All topics
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
PaperCut Vulnerabilities Enable Pre-Authentication RCE: Patch Now to Prevent System Compromise
Introduction: The Critical Threat Within Print Management Systems A seemingly innocuous print management system has emerged as a critical attack vec…
word3-3
1. Artifact: log4j:log4j:1.2.17 Original JDK Target Java 1.4 (Class file major/minor version 48.0). Built to run on JDK 1.4 through JDK 8. When exec…
word-2
Artifact: log4j:log4j:1.2.17 Original JDK Target Java 1.4 (Class file major/minor version 48.0). Built to run on JDK 1.4 through JDK 8. When executi…
CVE-2026-41264: How a Regex Let Prompts Run Code in Flowise
import pandas as np , os as pandas pandas . system ( " xcalc " ) Those two lines are the whole bypass in CVE-2026-41264 , a CVSS 9.8 bug in Flowise…
Mooncake Mass Disclosure — CVSS 9.8 Arbitrary Memory Read/Write in KV Cache Transfer Engine
A crafted TCP packet to Mooncake's transfer data port is enough to read and write arbitrary process memory — no authentication required. CVE-2026-10…
CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root
Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel & WHM — EmailTrack (Email ▸ Track Delivery) Vulnerability class CWE-89…
LightLLM Mass Disclosure — 2 CVSS 9.8 Unauthenticated RCE in LLM Serving Framework
Two unauthenticated CVSS 9.8 RCEs in LightLLM — the LLM serving framework used with LLaMA, Mistral, and Qwen deployments. No patch confirmed. All ve…
Beyond CVSS: A Risk-Based Approach to Vulnerability Prioritization
Your vulnerability scanner shows: CVE-XXXX-XXXX CVSS: 9.8 Severity: Critical The natural reaction is: "This is critical. Put it at the top of the re…
Confused Deputy: The Old Bug That AI Agents Keep Reintroducing
Back in 1988, a compiler running on a commercial timesharing system had permission to write to a shared directory for recording language feature usa…
Confirmed vs. Potential Vulnerabilities: How to Act on Each Without Creating Alert Fatigue
Confirmed vulnerabilities are security flaws a scanner has actively verified as present — through direct proof, not inference. Potential vulnerabili…
CVE-2026–17633 - Authenticated RCE in Langflow OSS via /api/v1/custom_component
Summary Field Value CVE ID CVE-2026-17633 CVSS 8.5 (HIGH) CWE CWE-94 (Improper Control of Generation of Code) Affected Langflow OSS 1.0.0 – 1.10.3 P…
Before You Trust a Vulnerability Report, Check This Page First
A vulnerability report can look polished and still leave out the context you need to make a good decision. Before I look at the highest-severity fin…
Droid ASC: A High-Performance Tool for Android Reverse Engineering and Vulnerability Discovery
Article Summary: Droid ASC is a high-performance tool for Android reverse engineering and mobile security testing. It reduces memory usage by two or…
CVE-2026-12243 — How a Percent-Encoded Slash Bypasses NLTK's Path Traversal Guard
CVE ID CVE-2026-12243 Affects NLTK (Natural Language Toolkit) ≤ 3.9.4 Weakness CWE-22 (Path Traversal) CVSS 3.1 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C…
7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them)
7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them) If you've used GitHub Copilot, Claude Code, or any AI coding assistant…
Finding Exposed Services (and Fixing Them) with ScanSearch
Ever wondered what parts of your infrastructure are accidentally visible to the entire internet? It's a common blind spot. We spend a lot of time se…
Августовский «В тренде VM»: уязвимости ViPNet Client, ядра Microsoft Windows и Microsoft SharePoint
Хабр, привет! На связи Александр Леонов, ведущий эксперт центра безопасности Positive Technologies (PT ESC) и дежурный по самым опасным уязвимостям…
Benchmarking GPT-4o, Claude 3.5 Sonnet, and Llama 3 for Automated Code Auditing & Vulnerability Detection
Evaluating LLMs on standardized leaderboards (like MMLU or HumanEval) is helpful, but it rarely tells you how a model performs on real-world edge ca…
Google pays $250K for Linux vulnerability allowing guest VM escapes
Both vulnerabilities allow untrusted users to gain root privileges.
Go-go Gadget...
Are you looking for vulnerability intel that standard scanners skip? OSV-Scanner is an awesome SCA tool for unearthing vulnerabilities in open-sourc…
PamStealer: the macOS stealer that checks your password through PAM before stealing it
Someone double-clicks what they think is Maccy, a clipboard manager, and gets a macOS password prompt: "Maccy wants to make changes." They type it i…
Inside the CVE List: How Vulnerabilities Get Their ID Cards
Thousands of software bugs are discovered every day around the world. But turning these bugs into an official, globally recognized CVE code (such as…
Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds
The vulnerability, disclosed 12 months ago, affects multiple manufacturers.
One CVE, four ignore files: unifying Trivy, Grype, Snyk and osv-scanner
You triaged the CVE. A scanner flagged CVE-2023-45853 in zlib, you read the advisory, confirmed the vulnerable code path isn’t reachable from your i…
Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed
A separate zero-day also disclosed by Nightmare Eclipse appears to be patched as well.
Топ самых интересных CVE за май 2026 года
Май 2026 года ознаменовался всплеском критических уязвимостей в корпоративных и потребительских технологиях. Подводим итоги месяца: три уязвимости в…
High-severity vulnerability in Linux caused by a single errant character
Use-after-free bug can be exploited to evade sandbox defenses.
Google publishes exploit code threatening millions of Chromium users
Google publishes exploit code before patch, reported 29 months earlier, is fixed.
Linux bitten by second severe vulnerability in as many weeks
Production-version patches are coming online and should be installed pronto.