📡 Kaspersky Securelist · 2026-03-26 An AI gateway designed to steal your data A significant proportion of cyberincidents are linked to supply chain attacks, and this proportion is constantly growing. Over the past year, we have seen a wide variety of methods used in such attacks, ranging from creation of malicious but

📡 Kaspersky Securelist · 2026-03-26 Coruna: the framework used in Operation Triangulation CVE-2023-32434CVE-2023-38606 Introduction On March 4, 2026, Google and iVerify published reports about a highly sophisticated exploit kit targeting Apple iPhone devices. According to Google, the exploit kit was first discovered in targeted attacks conducted by a customer of an unnamed

📡 Compass Security · 2025-02-12 Mitigating Fragmented SQL Injection Attacks: Effective Solutions This blog post breaks down Fragmented SQL Injection, a method hackers use to bypass authentication by manipulating two different input fields at the same time. Our security expert explains why single quotes matter in SQL injection attacks and how using

📡 Security Affairs · 2026-04-30 Anti-DDoS Firm Heaped Attacks on Brazilian ISPs CVE-2023-1389 A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm’

📡 Imperva Blog · 2026-04-30 That AI Extension Helping You Write Emails? It’s Reading Them First Executive Summary We found 18 AI browser extensions marketed as productivity tools that are not as they seem. This group includes extensions such as: * One that surveils your emails as you compose them * Another that

📡 NVD-Latest · 2026-05-03 CVE-2026-5063 (CVSS 7.2) - The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln CVE-2026-5063 CVE-2026-5063 CVSS:7.2 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submit_nex_form(

📡 NVD-Latest · 2026-05-03 CVE-2026-7698 (CVSS 7.3) - A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7. CVE-2026-7698 CVE-2026-7698 CVSS:7.3 A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/

📡 NVD-Latest · 2026-05-04 CVE-2026-42364 (CVSS 9.9) - An os command injection vulnerability exists in the DdnsSetting.cgi functionalit CVE-2026-42364 CVE-2026-42364 CVSS:9.9 An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command

📡 Ars Technica Security · 2026-04-30 Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India In December 2025, we detected a wave of malicious emails designed to look like official correspondence from the Indian tax service. A few weeks later, in January 2026, a similar campaign began

📡 NVD-Latest · 2026-05-04 CVE-2026-42370 (CVSS 9.0) - A stack overflow vulnerability exists in the WebCam Server Login functionality o CVE-2026-42370 CVE-2026-42370 CVSS:9.0 A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to

📡 Tenable Blog · 2026-05-01 Essential Data Sources for Detection Beyond the Endpoint The 2026 Unit 42 Global Incident Response Report delivers a sharp wake-up call: Threat actors are now moving 4x faster to exfiltration than in 2025. By striking across three or more surfaces simultaneously, adversaries are intentionally exploiting the blind

📡 NVD-Latest · 2026-05-05 CVE-2026-7784 (CVSS 7.3) - A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue aff CVE-2026-7784 CVE-2026-7784 CVSS:7.3 A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue affects some unknown processing of the file

📡 NVD-Latest · 2026-05-05 CVE-2026-44028 (CVSS 7.5) - An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded re CVE-2026-44028 CVE-2026-44028 CVSS:7.5 An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the

📡 NVD-Latest · 2026-05-05 CVE-2026-43527 (CVSS 7.7) - OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability i CVE-2026-43527 CVE-2026-43527 CVSS:7.7 OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration

📡 NVD-Latest · 2026-05-05 CVE-2026-43530 (CVSS 8.8) - OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval bi CVE-2026-43530 CVE-2026-43530 CVSS:8.8 OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that

📡 NVD-Latest · 2026-05-05 CVE-2026-7833 (CVSS 7.2) - A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerabilit CVE-2026-7833 CVE-2026-7833 CVSS:7.2 A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file

📡 GitHub-Advisory · 2026-05-05 GHSA-3h96-34p3-xm76 - GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_ GHSA-3h96-34p3-xm76 MEDIUM rubygems/graphql CVE: GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured

📡 GitHub-Advisory · 2026-05-05 CVE-2026-32688 - Plug.Cowboy vulnerable to unauthenticated remote DoS via HTTP/2 `:scheme` atom-t CVE-2026-32688 GHSA-q8x4-x7mp-5vg2 HIGH erlang/plug_cowboy CVE: CVE-2026-32688 Summary An unauthenticated remote denial-of-service vulnerability in Plug.Cowboy.Conn allows any attacker who can reach an HTTPS Plug.Cowboy listener via HTTP/2 to permanently

📡 NVD-Latest · 2026-05-04 CVE-2026-7750 (CVSS 8.8) - A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerabil CVE-2026-7750 CVE-2026-7750 CVSS:8.8 A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerability affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component POST

📡 NVD-Latest · 2026-05-04 CVE-2026-24072 (CVSS 8.8) - An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earl CVE-2026-24072 CVE-2026-24072 CVSS:8.8 An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read

📡 NVD-Latest · 2026-05-04 CVE-2026-23918 (CVSS 8.8) - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 CVE-2026-23918 CVE-2026-23918 CVSS:8.8 Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66.

📡 NVD-Latest · 2026-05-04 CVE-2026-40563 (CVSS 7.1) - Description: Improper Control of Generation of Code ('Code Injection') vulnerabi CVE-2026-40563 CVE-2026-40563 CVSS:7.1 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query

📡 NVD-Latest · 2026-05-05 CVE-2026-5100 (CVSS 7.5) - The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the CVE-2026-5100 CVE-2026-5100 CVSS:7.5 The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including,

📡 NVD-Latest · 2026-05-05 CVE-2026-3456 (CVSS 7.5) - The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation p CVE-2026-3456 CVE-2026-3456 CVSS:7.5 The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in

📡 NVD-Latest · 2026-05-05 CVE-2026-4803 (CVSS 7.2) - The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Si CVE-2026-4803 CVE-2026-4803 CVSS:7.2 The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta