-
LocalStack for Azure Enters Public Preview with Security Settings Stored but Not Enforced
LocalStack has put its Azure emulator into public preview, free and self-serve, with general availability expected in early 2027. Its own …
-
Anthropic VS code extension on Cursor backdoored for nearly 12 hours
An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple …
-
Google Discloses PageBreak AI Security Agent That Found 500+ XSS Bugs
According to a paper published by Google, its AI-powered security agent has uncovered more than 500 XSS vulnerabilities across its web …
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. …
-
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, allowing them to read their …
-
Anthropic: That Claude Code extension compromise… couldn’t be us
Anthropic has denied allegations that a malicious version of the official Claude Code extension published to Cursor’s marketplace was …
-
CVE-2026-90960 – The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information …
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, …
-
CVE-2026-89270 – The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin …
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization …
-
CVE-2026-88942 – The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected …
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ‘wpf_fid’ JSON Parameter …
-
CVE-2026-120040 – The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information …
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 …
-
CVE-2026-120019 – The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via …
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and …
-
CVE-2026-11396 – The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing …
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all …
●●●
NVD
- CVE-2026-116755 – Improper Neutralization of Special Elements used in a Command (‘Command Injection’) in …
- CVE-2026-117656 – Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in …
- CVE-2026-77152 – Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a …
- CVE-2026-110176 – The File Force Download module for Drupal 7 implements hook_file_download() to add a …
- CVE-2026-90960 – The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information …
EXPLOITS
- PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- Filter generation in practice: from algorithms to LLMs
- Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
- Millions of security cameras at risk: DoS vulnerability in Intelbras devices
- An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infras
- Deploying AI agents securely: how Kaspersky products mitigate AI threats