SecurityFormat String Bug Found in SurrealDB
A critical vulnerability identified in SurrealDB's rquickjs component allows for potential memory access or code execution.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityUrwid Session Hijacking Vulnerability
A critical flaw in the Urwid web display backend allows attackers to predict session IDs and gain unauthorized terminal access.
SecurityVMware Avi Auth Bypass Flaw Detailed
A critical authentication bypass vulnerability identified in VMware Avi Load Balancer could allow unauthorized access to the control plane.
SecuritySession Hijacking in Urwid Web Backend
A critical vulnerability in the Urwid display backend allows attackers to hijack active sessions through PRNG prediction or local access.
SecurityCritical Auth Bypass Found in VMware Avi
A critical authentication bypass flaw in VMware Avi Load Balancer has been disclosed, requiring immediate attention to specific versions.
SecuritySurrealDB Security Flaw Risks Execution
A critical format string vulnerability in SurrealDB enables unauthorized memory access and potential code execution.
SecurityDigital Reality Mirrors Watch Dogs' World
A look at how a decade-old video game accurately predicted the rise of invasive surveillance tools and city-wide data networks.
SecuritySurrealDB Security Flaw Identified
A critical format string vulnerability in SurrealDB versions before 1.1.1 could allow unauthorized memory access or code execution.
SecuritySurrealDB Injection Flaw Risks Control
A critical vulnerability in SurrealDB enables privilege escalation and potential root-level takeover via malicious export commands.
SecurityCVE-2026-9323 Exposes Urwid Sessions
A critical flaw in the Urwid web display backend allows session hijacking via predictable identifiers and insecure file handling.
SecuritySecuring Identity Without Data Exposure
New architectural approaches to age verification aim to satisfy global mandates while keeping biometric data off centralized servers.
SecurityUnauthenticated Execution Risk in Langflow
A critical vulnerability in IBM Langflow OSS allows remote actors to execute flows without authentication.
SecurityAI Spam Filters Falter Against Salting
Modern LLM-powered email security is struggling to identify phishing attempts that use decades-old text-hiding techniques.
SecurityGPT-5.6 Data Erasure: An Honest Error?
OpenAI confirms that its latest model occasionally wipes user files, attributing the behavior to internal alignment miscalculations.
SecurityPath Traversal Flaw Hits IBM Langflow
A critical vulnerability in IBM Langflow OSS allows for arbitrary file writes due to improper input validation.
SecurityWordPress Core Flaws Risk Unauth Access
A dual-vulnerability chain allows unauthenticated code execution on WordPress core installations, prompting emergency updates.
SecurityEY Security Breach Exposes Tax Documents
A compromised third-party support platform has led to the exposure of client tax files at professional services giant Ernst & Young.
SecurityCritical Auth Bypass in VMware Avi Load
A critical authentication bypass vulnerability has been identified in VMware Avi Load Balancer, documented as CVE-2026-47865.
SecurityPentagon Puts CMMC Audits on Hold
The DoD has suspended mandatory third-party assessments, but experts warn that core legal cybersecurity obligations remain unchanged.
OnlyFans Takedowns Shield Web Servers
Copyright enforcement by adult content creators is inadvertently neutralizing infrastructure vulnerabilities across the public sector.