Vulnerabilities
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Malicious actors are targeting open-source AI platform MLflow and web-based SCADA software FUXA with critical vulnerabilities.
Vulnerabilities
CVE and advisory hub
Vulnerabilities
AI 'Mind Viruses' Demonstrate Self-Replicating Payloads Across Agent Networks
Researchers at Anthropic and EPFL have shown that AI agents can spread self-propagating payloads, dubbed 'mind viruses,' through persistent system prompt files. While no wild infections have been confirmed, the study highlights vulnerabilities in agent networks and varying susceptibility across models.
Vulnerabilities
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session.
Vulnerabilities
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Vulnerabilities
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software.
Vulnerabilities
Cavern C2 Framework Evolves with New Communication Module and Google Apps Script Relay
Kaspersky researchers have discovered new components in the Cavern command-and-control framework used by Iranian nation-state hackers, expanding its communication capabilities and allowing it to blend in with legitimate traffic.
Vulnerabilities
Cybersecurity Threats: A Week in Review
A summary of the latest cybersecurity threats and vulnerabilities.
Vulnerabilities
Critical Flaws in WordPress Plugins Expose Sites to Unauthenticated RCE and Auth Bypass Attacks
Two high-severity vulnerabilities have been discovered in popular WordPress plugins, Forminator Forms and User Profile Builder, allowing unauthenticated attackers to execute arbitrary code and gain administrative access to sites.
Vulnerabilities
Microsoft Defender Patch Bypass Exploit Claims SYSTEM Access
A security researcher has released a proof-of-concept exploit for a Microsoft zero-day vulnerability, claiming it can bypass a previously released patch and grant an attacker SYSTEM-level privileges.
Vulnerabilities
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
A high-severity vulnerability in Cisco's Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild, allowing an unauthenticated attacker to trigger a denial-of-service (DoS) condition.
Vulnerabilities
SAP Commerce Cloud Vulnerability Allows Unauthenticated Attackers to Execute Arbitrary Code
SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution.
Vulnerabilities
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
Microsoft has released its monthly security updates, addressing 398 flaws, including a Windows driver zero-day under active attack.
Vulnerabilities
Adobe Patches Critical Flaws in ColdFusion, Commerce, and Campaign Classic
Adobe releases updates to address multiple critical security vulnerabilities in ColdFusion, Commerce, and Campaign Classic, with some flaws having a CVSS score of 10.0.
Vulnerabilities
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability, CVE-2026-59310, is a directory-traversal vulnerability in the VMware vCenter server that can be exploited to execute arbitrary code.