SiteGuard's statistics feature runs attacker commands as root
A command-injection bug in the statistics function of SiteGuard Server Edition lets an attacker run OS commands as root or SYSTEM on the host, and i…
Programming
⚑ Сообщить о проблемеПоследние новости Programming от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
rust
security
showdev
testing
tutorial
typescript
webdev
Fridge hack costing millions and sparking fires stemmed from poor security
Incident hitting 700 supermarkets exploited outdated devices exposed to the Internet.
PaperCut Vulnerabilities Enable Pre-Authentication RCE: Patch Now to Prevent System Compromise
Introduction: The Critical Threat Within Print Management Systems A seemingly innocuous print management system has emerged as a critical attack vec…
word3-3
1. Artifact: log4j:log4j:1.2.17 Original JDK Target Java 1.4 (Class file major/minor version 48.0). Built to run on JDK 1.4 through JDK 8. When exec…
word-2
Artifact: log4j:log4j:1.2.17 Original JDK Target Java 1.4 (Class file major/minor version 48.0). Built to run on JDK 1.4 through JDK 8. When executi…
CVE-2026-41264: How a Regex Let Prompts Run Code in Flowise
import pandas as np , os as pandas pandas . system ( " xcalc " ) Those two lines are the whole bypass in CVE-2026-41264 , a CVSS 9.8 bug in Flowise…
Ghost CMS Mass Disclosure — 6 CVEs Including CVSS 8.1 Staff Session Bypass
A Ghost staff user with valid credentials can log into any other staff account using only the target's password — bypassing 2FA entirely. CVE-2026-1…
Mooncake Mass Disclosure — CVSS 9.8 Arbitrary Memory Read/Write in KV Cache Transfer Engine
A crafted TCP packet to Mooncake's transfer data port is enough to read and write arbitrary process memory — no authentication required. CVE-2026-10…
CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root
Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel & WHM — EmailTrack (Email ▸ Track Delivery) Vulnerability class CWE-89…
Attackers have been exploiting critical Zimbra flaw to steal emails
A simple email gives the attackers the ability to remotely inject OS commands.
LightLLM Mass Disclosure — 2 CVSS 9.8 Unauthenticated RCE in LLM Serving Framework
Two unauthenticated CVSS 9.8 RCEs in LightLLM — the LLM serving framework used with LLaMA, Mistral, and Qwen deployments. No patch confirmed. All ve…
Beyond CVSS: A Risk-Based Approach to Vulnerability Prioritization
Your vulnerability scanner shows: CVE-XXXX-XXXX CVSS: 9.8 Severity: Critical The natural reaction is: "This is critical. Put it at the top of the re…
Confused Deputy: The Old Bug That AI Agents Keep Reintroducing
Back in 1988, a compiler running on a commercial timesharing system had permission to write to a shared directory for recording language feature usa…
Confirmed vs. Potential Vulnerabilities: How to Act on Each Without Creating Alert Fatigue
Confirmed vulnerabilities are security flaws a scanner has actively verified as present — through direct proof, not inference. Potential vulnerabili…
CVE-2026–17633 - Authenticated RCE in Langflow OSS via /api/v1/custom_component
Summary Field Value CVE ID CVE-2026-17633 CVSS 8.5 (HIGH) CWE CWE-94 (Improper Control of Generation of Code) Affected Langflow OSS 1.0.0 – 1.10.3 P…
Before You Trust a Vulnerability Report, Check This Page First
A vulnerability report can look polished and still leave out the context you need to make a good decision. Before I look at the highest-severity fin…
Можно ли найти IDOR статическим анализом? Пишем ядро для Python
Написал ядро статического анализа для детекта IDOR-уязвимостей в Python-коде. Вместо поиска подозрительных конструкций и ключевых слов оно отслежива…
Droid ASC: A High-Performance Tool for Android Reverse Engineering and Vulnerability Discovery
Article Summary: Droid ASC is a high-performance tool for Android reverse engineering and mobile security testing. It reduces memory usage by two or…
CVE-2026-12243 — How a Percent-Encoded Slash Bypasses NLTK's Path Traversal Guard
CVE ID CVE-2026-12243 Affects NLTK (Natural Language Toolkit) ≤ 3.9.4 Weakness CWE-22 (Path Traversal) CVSS 3.1 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C…
7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them)
7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them) If you've used GitHub Copilot, Claude Code, or any AI coding assistant…
Finding Exposed Services (and Fixing Them) with ScanSearch
Ever wondered what parts of your infrastructure are accidentally visible to the entire internet? It's a common blind spot. We spend a lot of time se…
Benchmarking GPT-4o, Claude 3.5 Sonnet, and Llama 3 for Automated Code Auditing & Vulnerability Detection
Evaluating LLMs on standardized leaderboards (like MMLU or HumanEval) is helpful, but it rarely tells you how a model performs on real-world edge ca…
Google pays $250K for Linux vulnerability allowing guest VM escapes
Both vulnerabilities allow untrusted users to gain root privileges.
PamStealer: the macOS stealer that checks your password through PAM before stealing it
Someone double-clicks what they think is Maccy, a clipboard manager, and gets a macOS password prompt: "Maccy wants to make changes." They type it i…
Inside the CVE List: How Vulnerabilities Get Their ID Cards
Thousands of software bugs are discovered every day around the world. But turning these bugs into an official, globally recognized CVE code (such as…
One CVE, four ignore files: unifying Trivy, Grype, Snyk and osv-scanner
You triaged the CVE. A scanner flagged CVE-2023-45853 in zlib, you read the advisory, confirmed the vulnerable code path isn’t reachable from your i…
Google publishes exploit code threatening millions of Chromium users
Google publishes exploit code before patch, reported 29 months earlier, is fixed.
How to Check if You're Affected by CVE-2026-26268 in Cursor (and What to Do)
CVE-2026-26268 is a CVSS 8.1 high-severity vulnerability in the Cursor AI IDE that lets a malicious repository execute arbitrary code on a developer…
Mozilla says 271 vulnerabilities found by Mythos have "almost no false positives"
The developer of Firefox says it has "completely bought in" on AI-assisted bug discovery.
Топ самых интересных CVE за апрель 2026 года
Собрали самые интересные CVE апреля в нашу традиционную подборку. Критическими уязвимостями под RCE в прошлом месяце отметились Microsoft Azure и Bi…