SecurityManaging Vulnerability Data and CVE Risks
Understanding the lifecycle of Common Vulnerabilities and Exposures and how to maintain a defensible security posture in your network.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityChrome Security Cycles Reach New Peak
Google implements dynamic patching and accelerated release cadences to combat a record-breaking surge in browser vulnerability reports.
SecurityCritical ArcadeDB Authorization Flaw Found
A critical authorization bypass in ArcadeDB allows unauthenticated attackers to access and modify databases via specific HTTP endpoints.
SecurityCritical ArcadeDB Flaw Allows Code Execution
A severe authorization bypass in ArcadeDB allows unauthenticated users to execute arbitrary JavaScript, earning a critical 9.8 CVSS severity rating.
SecurityCritical Auth Bypass Found in Better-Auth SCIM
A severe authorization flaw in the better-auth SCIM plugin allows attackers to hijack user accounts and sessions by manipulating provider ID namespaces.
SecurityCritical Shell Injection Hits Wazuh Workflows
A critical shell injection vulnerability in Wazuh workflows allows attackers to execute arbitrary commands and steal sensitive credentials via pull requests.
SecurityThe Dark Side of Vibe Coding: Hidden Security Risks in AI-Generated Code (and How to Fix)
Vibe coding helps developers build software in minutes using AI, but it introduces critical security blind spots. how to secure AI-generated code against hidden vulnerabilities
SecurityCritical Auth Bypass Found in TNG Plugin
A critical vulnerability in the Single Sign On For TNG WordPress plugin allows unauthenticated attackers to reset any user password and take over sites.
SecurityLaw Firms Under Pressure From AiTM Attacks
New data from eSentire indicates that adversary-in-the-middle phishing has bypassed standard authentication protocols at law firms.
SecurityWhat Is An AitM (Adversary-in-the-Middle) Attack? How to stay safe.
An overview of how interception attacks bypass traditional authentication and what defenders can do to protect their data integrity.
SecurityNavigating the Black Hat Event Landscape
Security professionals must prioritize technical substance over corporate spectacle to address evolving AI and APT threat vectors.
SecurityMinnesota Water Systems Face Cyber Siege
Authorities are investigating a series of attacks on over 30 water systems as experts point to potential Iranian state actors.
SecurityCritical RCE Flaw Found in Juggle 1.6.0
A critical vulnerability in Juggle 1.6.0 allows unauthenticated attackers to execute arbitrary OS commands via the H2 database console.
SecurityCritical NocoBase RCE Vulnerability Found
A severe SQL injection flaw in NocoBase allows unauthenticated attackers to gain remote code execution via a simple registration and API request.
SecurityCritical Flyto-Core SSRF Flaw Found
A critical vulnerability in the Flyto-Core verification service allows unauthenticated attackers to steal internal secrets and perform SSRF attacks.
SecurityBank-Vaults Webhook Flaw Exposes Secrets
A critical vulnerability in the vault-secrets-webhook allows unauthorized outbound requests and potential theft of cluster-wide service account tokens.
SecurityCritical Hard-Coded Credential Flaw in DMS+
A critical vulnerability in Rich Source's DMS+ allows unauthenticated remote attackers to gain full control over affected devices using a fixed API key.
SecurityCritical XSS Flaw Hits OpenClaw Dashboard
A stored cross-site scripting vulnerability in the OpenClaw Dashboard allows unauthenticated attackers to execute arbitrary code in administrator sessions.
SecurityCisco Investigates Zero-Day FMC Flaw
A static credential vulnerability in Cisco Secure FMC Software is undergoing active exploitation in the wild, according to the company.
SecurityCritical RCE Flaw Found in Azure Cosmos DB
A critical vulnerability in Azure Cosmos DB allows unauthorized remote code execution, earning a maximum CVSS score of 10.