SecurityOracle Database Hijacked for Tool Storage
Researchers identified a post-exploitation toolkit concealed within Oracle database schema objects to bypass endpoint security tools.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityIBM Langflow OSS Cryptographic Flaw Exposed
A high-severity cryptographic key derivation vulnerability in IBM Langflow OSS could allow unauthorized access to sensitive data.
SecurityIBM Langflow OSS Encryption Flaw Exposed
A cryptographic weakness in IBM Langflow OSS allows attackers to reproduce encryption keys, potentially exposing stored API keys and authentication tokens.
SecurityCISA Warns of Active JetBrains TeamCity Flaw
A deserialization vulnerability in JetBrains TeamCity is under active exploitation, forcing federal agencies to patch systems by August 8, 2026.
SecurityCritical SQL Injection Found in Loca CMS
A critical SQL injection vulnerability in Loca Software CMS allows unauthorized attackers to gain full control over affected database systems.
SecurityBeyond Compliance: Rethinking Cyber Risk
Expert Edna Conway argues that true digital resilience requires moving past checkbox compliance to address complex supply chain risks.
SecurityBeyond the CTEM Implementation Gap
Continuous Threat Exposure Management faces a critical hurdle as organizations struggle to move past theory into active operations.
SecurityBMC Vulnerabilities Expose Servers
New research reveals widespread security flaws in baseboard management controllers across major global server manufacturers.
SecurityCritical Nuxt DevTools RCE Flaw Patched
An unauthenticated remote code execution vulnerability in Nuxt DevTools allows attackers to run arbitrary commands on developer machines via the HMR port.
SecurityFlowise Fixes Critical Root RCE Vulnerability
A critical remote code execution vulnerability in Flowise allows low-privileged attackers to gain root access on vulnerable servers via CSV Agent code injection.
SecurityFlowise Patches Critical CSVAgent RCE Flaw
A critical remote code execution vulnerability in Flowise's CSVAgent allows attackers to bypass python code filters using pandas read_pickle deserialization.
SecurityWebKit Flaws Expose Apple Private Relay
Security researchers uncovered vulnerabilities in WebKit that allow websites to bypass Apple's Private Relay and view IP addresses.
SecurityCandidate Arrested Over ALPR Camera Damage
A Tennessee congressional candidate faces felony vandalism charges after allegedly shooting automated license plate readers.
SecurityFramework Standardizes AI Incident Data
The Linux Foundation and the Open Secure AI Alliance have proposed the SAFE framework to collect and analyze agentic AI incident data.
SecurityWhy AI Orchestration Is a Security Risk
New research shows that the choice of AI orchestration framework can increase agent compromise rates by more than 2.6 times.
SecurityCourt Rules Browser Tools Bypass CFAA
An appellate court has affirmed that the creation of a web browser does not constitute a violation of the CFAA.
SecurityCritical PHP Injection Flaw in MaxSite CMS
A critical PHP object injection vulnerability in MaxSite CMS allows unauthenticated attackers to execute arbitrary code via a malicious cookie.
SecurityMaxSite CMS Critical RCE Flaw Discovered
A critical remote code execution vulnerability in MaxSite CMS allows unauthenticated attackers to inject malicious PHP code into configuration files.
SecurityAI-Generated Fake Vulnerabilities Rising
The integrity of the CVE database is under threat as automated, AI-generated reports exacerbate existing backlogs at NIST.
SecurityMobile Ad SDKs and Location Data Risks
A report from the Electronic Frontier Foundation examines the implications of mobile ad software and user location data sharing.