SecurityCritical MQTT Broker Flaw: CVE-2026-44091
An unauthenticated remote attacker can manipulate system configurations via a malicious MQTT ID, creating a critical risk to data integrity and system availability.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityCritical SSRF Flaw Hits IBM WebSphere
A critical server-side request forgery vulnerability in IBM WebSphere Application Server allows unauthenticated attackers to potentially compromise systems.
SecurityAI Vulnerability Hunting Falls Short
New data from VulnCheck reveals that AI-assisted vulnerability discovery is not yet driving a surge in real-world exploitation.
SecuritySecuring AI Agents Without Reinvention
Enterprise security frameworks require adaptation rather than complete replacement to address the rise of autonomous AI agents.
SecurityCritical AMMOS AIT-DSN Flaw Discovered
A missing authentication bug in the AMMOS Instrument Toolkit allows unauthenticated attackers to control Deep Space Network communication sessions.
SecurityCritical Auth Flaw Found in AMMOS Toolkit
A missing authentication vulnerability in the AMMOS Instrument Toolkit GUI allows unauthenticated attackers to hijack sessions and issue spacecraft commands.
SecurityPrebid Server Flaw Exposes Host Data
A critical vulnerability in prebid-server allows attackers to manipulate outbound requests, risking unauthorized data exposure.
SecurityDecades-Old BMC Flaw Exposes Servers
A legacy vulnerability in IPMI 2.0 leaves over 24,000 servers vulnerable to offline password cracking and potential remote control.
SecurityMate Secures Funding for Agentic SOC
The startup plans to expand its R&D and sales teams after raising $35 million in a new Series A investment round.
SecurityAI Vulnerability Scares Prove Premature
New research shows AI-discovered flaws are exploited at the same rate as traditional ones, debunking 'vulnpocalypse' fears.
SecurityCISA and ACSC Blueprint OT Isolation
New joint guidance from US and Australian agencies outlines methods to physically isolate critical operational technology systems.
SecurityCritical SQL Injection in @hypequery/clickhouse
A severe SQL injection vulnerability in @hypequery/clickhouse allows attackers to execute arbitrary SQL commands by manipulating input parameters.
SecurityCritical Command Injection Hits IBM Aspera
A critical shell command injection flaw in IBM Aspera Faspex 5 allows remote authenticated attackers to execute arbitrary code with high-level privileges.
SecurityCritical RCE Flaw Found in IBM Aspera Faspex
A critical vulnerability in IBM Aspera Faspex 5 allows remote authenticated attackers to execute arbitrary code via unquoted shell interpolation.
SecurityCritical Privilege Flaw Hits IBM WebSphere
A severe vulnerability in the IBM WebSphere administrative console allows unauthenticated attackers to gain full control of the application server.
SecurityRunlayer Sues Rippling Over MCP Claims
A legal dispute over Model Context Protocol technology highlights the risks startups face when piloting tools with tech giants.
SecurityCritical Apache Thrift Flaw Discovered
A certificate validation flaw in Apache Thrift c_glib bindings exposes systems to interception, requiring an immediate update to version 0.24.0.
SecurityApple Ecosystem Faces Widespread Patching
Recent updates address hundreds of vulnerabilities across iOS and macOS platforms, highlighting significant risks in kernel security.
SecurityCAF Bank Shuts Online Portal After Breach
A critical third-party software flaw forces the charity-focused bank to suspend digital access for 14,000 organizations.
SecurityManaging the Rise of Autonomous AI Agents
Hush Security secures $30 million in Series A funding to address the growing identity and governance challenges posed by AI agents.