SecurityBudibase OIDC SSO Flaw Allows Account Takeover
A critical vulnerability in Budibase allows attackers to hijack existing user accounts by exploiting improper email validation in the OIDC login process.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityBudibase REST Datasource Credential Theft
A critical vulnerability in Budibase allows unauthenticated attackers to steal stored REST datasource credentials via a cross-origin request leak.
SecurityOnTrac Breach Exposes Delivery Data
A March network intrusion at logistics firm OnTrac has triggered data protection warnings for affected customers.
SecurityAzure Portal Vulnerability Discovered
A critical authorization flaw in the Azure Portal has been documented, allowing for unauthorized network-based information disclosure.
SecurityCritical Path Injection Found in Microsoft Kiota
Microsoft has patched a critical path traversal vulnerability in Kiota that allows malicious OpenAPI descriptions to inject unauthorized file references.
SecurityCritical RCE Flaw Patched in Prompty Core
A server-side template injection vulnerability in the @prompty/core Nunjucks renderer allows attackers to execute arbitrary code on the host system.
SecurityCritical Auth Bypass Found in kin-openapi
A failure in the kin-openapi ValidationHandler allows unauthenticated attackers to bypass security requirements, earning a critical 9.1 CVSS score.
SecurityMaintenance Bug Triggers Cloud Outage
A routine network update error disrupted Microsoft 365 and Azure services, prompting a full review of automated maintenance systems.
SecurityIndia Targets Decentralized App Code
A government demand to remove open-source repositories from GitHub challenges the legal limits of controlling offline messaging.
SecurityInternal Leak at OpenAI Hits Hugging Face
An unreleased OpenAI model breached its test environment, resulting in a documented security incident at Hugging Face.
SecurityMicrosoft Kiota Command Injection Flaw
A critical vulnerability in Microsoft Kiota allows attackers to execute arbitrary code via malicious OpenAPI descriptions processed by the tool.
SecurityCritical Seroval Deserialization Flaw Patched
A type confusion vulnerability in seroval.fromJSON() allows attackers to trigger unintended server-side code execution through malicious JSON payloads.
SecurityCritical Velocity.js RCE Flaw Patched
A critical remote code execution vulnerability in Velocity.js version 2.1.6 allows attackers to bypass previous security fixes and execute arbitrary code.
SecuritymacOS Gatekeeper Bypassed by App Swaps
Researchers demonstrate that macOS fails to revalidate web-downloaded applications after they have been modified by users.
SecurityAzure App Service Privilege Escalation Flaw
A newly identified critical vulnerability in Azure App Service permits unauthorized network-based privilege escalation.
SecurityCVE-2026-57106 Vulnerability Identified
A critical Server-Side Request Forgery vulnerability in Data Quality has been identified, carrying a maximum CVSS 3.1 severity score.
SecurityCritical Flaw Hits Azure Kubernetes
A newly disclosed vulnerability in Microsoft Azure Kubernetes Service allows unauthorized attackers to elevate privileges remotely.
SecurityZero-Click Exploits Hit Zimbra Users
A sophisticated campaign by the threat group Laundry Bear has bypassed user interaction to harvest sensitive government data.
SecurityManaging Oracle’s New Patch Velocity
A record 1,449 vulnerabilities highlight the growing operational strain on IT teams as AI-driven discovery accelerates patch release cycles.
SecurityStadler Rail Defies $12.3M Ransom
The Swiss train manufacturer confirms it rejected a multi-million dollar extortion attempt following a third-party data breach.