
Cyber Attacks
View all
OpenAI Chrome Extension Gets Tab Read and Action Access, Sparking Enterprise Security Concerns
OpenAI’s updated extension can now read open tabs and execute browser actions, raising access control concerns for enterprise security teams.
Cloud Security
View allVulnerabilities
View all
Totolink X2000R Stack Overflow in boa formUploadFile Permits Authenticated Arbitrary Code Execution
An authenticated stack overflow in the boa formUploadFile feature of specific X2000R firmware permits arbitrary code execution on the device.

Totolink X2000R Stack Overflow in VPN Filter Allows Remote Code Execution
Authenticated attackers can exploit stack-based buffer overflows in the X2000R router's boa formFilter to achieve arbitrary code execution.

IBM DataStage Redis flaw lets anonymous users inject data and break encryption boundaries
A critical vulnerability in IBM DataStage allows anonymous users to write to shared Redis stores, bypassing encryption boundaries and poisoning tenant data.

IBM Planning Analytics Buffer Overflow Risks Arbitrary Code Execution
A stack-based buffer overflow in IBM Planning Analytics 2.0 and 2.1 allows attackers to execute arbitrary code on affected systems.
Data Breaches
View all
Data Classification Mistakes That Expose Your Infrastructure

Credit Freezes: 6 Common Misunderstandings That Leave You Exposed

Email Account Compromise Prevention Checklist for Secure Operations

Password reuse is a security risk: how to break the chain
Latest news
Vulnerabilities
Pillow Heap Out-of-Bounds Read in TIFF Decoding Exposes Memory
A vulnerability in Pillow allows attackers to extract heap memory by uploading malformed TIFF images, with no authentication required.
Vulnerabilities
MCP SDK Vulnerability Allows HTTP Memory Exhaustion via Unbounded Inputs
Attackers can crash Model Context Protocol servers by sending large arrays, causing out-of-memory errors without needing credentials.
Vulnerabilities
VikRentCar CSRF Flaw in Versions Up to 1.4.8
A high-severity cross-site request forgery vulnerability in VikRentCar allows Cross Site Request Forgery.
Vulnerabilities
ThreadX Module Manager Use-After-Free Flaw Exposes Kernel Objects
Eclipse ThreadX up to 6.5.1.202602a contains a high-severity memory error allowing deallocation of active kernel control blocks.
Vulnerabilities
Red Hat Strimzi Console: Arbitrary Image Deployment Enables Cluster-Wide Control-Plane Access
Attackers with create permissions on Console resources can deploy arbitrary images to gain cluster-wide Strimzi control-plane access.
Vulnerabilities
Google Cloud Shell Cross-Site WebSocket Hijacking Patched
An unauthenticated flaw in Cloud Shell allowed session hijacking and token theft. Google patched the issue on 22 July 2026, requiring no customer action.
Vulnerabilities
YS-infoware BA-Workflow SQL Injection Enables Authenticated Users to Delete Database Records
Authenticated users of BA-Workflow versions prior to 3.6 can inject SQL to read, modify, or delete database records, posing a high severity risk.
Vulnerabilities
Pillow PDF rewriting flaw triggers infinite loops and service denial
A logic error in the Python imaging library allows crafted PDFs to lock workers in infinite cycles, risking denial of service for affected applications.











