SecurityFlowise Critical RCE Flaw Patched
A Unicode homoglyph bypass in Flowise allows attackers to execute arbitrary code on host systems by tricking the Python code validation engine.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityCISA Flags Critical IBM Langflow Flaw
A code injection vulnerability in IBM Langflow has been added to CISA's catalog, requiring rapid remediation for federal agencies.
SecurityCISA Warns of Active N-able N-central Flaw
CISA has added an authentication bypass vulnerability in N-able N-central to its Known Exploited Vulnerabilities catalog, requiring immediate action.
SecurityBeyond CASB: Addressing AI Interactions
Current security controls often overlook the semantic context of AI prompts, requiring new layers to govern agentic workflows.
SecurityOligo Secures $60M for Runtime Security
The Tel Aviv-based security firm reaches a $140 million total funding milestone to scale its application and cloud workload protections.
SecurityObsidian Reaches $1.1B Valuation
Obsidian Security secures $85 million in Series D funding to grow its platform for governing AI agents within enterprise environments.
SecurityRapid Weaponization of New Flaws Grows
New findings from CrowdStrike suggest China-linked groups are increasingly exploiting critical vulnerabilities within 24 hours.
SecurityResearch Exposes Google Passkey Exploits
Researchers identified three methods to compromise passkeys, highlighting vulnerabilities in Google's synchronization process.
SecurityCritical Auth Flaw Found in OpenCode Studio
A missing authentication vulnerability in OpenCode Studio versions prior to 2.4.4 allows unauthenticated attackers to steal files and delete user videos.
SecurityCritical RCE Flaw Found in Kotaemon 0.12.0
An unauthenticated remote code execution vulnerability in Kotaemon allows attackers to run arbitrary system commands by exploiting insecure deserialization.
SecurityCritical Command Injection Hits Puwell Cameras
Puwell IP cameras running firmware versions 2.x through 4.x are vulnerable to unauthenticated remote code execution via a flaw in the DebugShell interface.
SecurityZenity Secures $125 Million in Funding
The AI security firm, which focuses on agentic framework governance, reaches a total of $180 million in lifetime capital.
SecurityAI Safety Bypassed via Task Splitting
Threat actors are breaking malicious projects into small, fragmented tasks to circumvent AI safety guardrails, according to research.
SecurityVendor Shifts at Black Hat 2026
Security vendors at Black Hat 2026 are pivoting toward autonomous AI workflows, governance, and integrated exposure management tools.
Moving Beyond Heroics in Vendor Risk
Operationalizing third-party risk management requires shifting security involvement to the start of the procurement lifecycle.
SecurityDNA Analysis Software Vulnerability
Thermo Fisher addresses a flaw in forensic software that allowed for the undetectable manipulation of DNA data files.
SecurityCritical File Upload Flaw Hits HUMANIST HR
A critical unrestricted file upload vulnerability in Bilin Software's HUMANIST Digital Human Resources allows remote attackers to execute code.
SecurityCritical Command Injection Hits GL.iNet MT3000
A critical remote command injection vulnerability in GL.iNet GL-MT3000 routers allows unauthenticated attackers to execute arbitrary code on affected devices.
SecurityCritical Adobe Campaign SSRF Flaw Discovered
A critical server-side request forgery vulnerability in Adobe Campaign Classic allows unauthenticated attackers to achieve privilege escalation.
SecurityCritical SQL Injection Hits Adobe Campaign
A critical SQL injection vulnerability in Adobe Campaign Classic allows low-privileged attackers to execute arbitrary code without user interaction.