Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Initial Access/ T1190

T1190Exploit Public-Facing Application

T1190 — Exploit Public-Facing Application is a MITRE ATT&CK technique in the Initial Access tactic. Clankerusecase tracks 459 detection use cases covering it and 2574 threat-intel articles citing it.

Initial Access
View on the matrix → Filter Detection Library MITRE official spec ↗
459Use cases
2574Articles
0Sub-techniques
1Tactic

Use cases covering this technique (459)

Authentication not detected on admin API endpoint Internal delivery · hunting DD Excessive resource consumption of third-party API Internal actions · hunting DD JWT authentication bypass attempt Internal delivery · alerting DD Local File Inclusion (LFI) exploited Internal delivery · alerting DD Spring4Shell RCE attempts (CVE-2022-22963) Internal delivery · alerting DD AWS S3 bucket ACL / policy made public Internal actions · alerting DDCW Command injection exploited (WAF detection) Internal delivery · alerting DD Distributed credential-stuffing campaign Internal delivery · alerting DD Log4Shell RCE attempts (CVE-2021-44228) Internal delivery · alerting DD SQL injection exploited (WAF detection) Internal delivery · alerting DD SSRF exploited (WAF detection) Internal delivery · alerting DD Asset exposure — vulnerability matches article CVE(s) Internal recon · alerting DSP [WEEKLY] AI-Agent Server (PraisonAI/MCP) Spawns OS Shell or Recon LOLBin — Unauthenticated RCE Exploitation Internal exploit · alerting DSΣPDDCS [WEEKLY] AI/LLM Agent Framework Runtime Spawning Shell, Recon, or Egress Child Process Internal exploit · alerting DSΣPDDCS [WEEKLY] AI/LLM Framework Web Service Spawns Shell or Network Tool (Agent-Framework Unauthenticated RCE) Internal exploit · alerting DSΣPDDCS [WEEKLY] Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) Internal exploit · alerting DSPDD [WEEKLY] Developer/AI tooling runtime spawns shell or egress LOLBin (unauth RCE post-expl) Internal exploit · alerting DSPDDCS [WEEKLY] Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint Internal exploit · alerting DSPDD [WEEKLY] Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request Internal actions · alerting DSPDD [WEEKLY] Gitea Service Account Post-Exploitation: git/gitea Spawning Interpreters or Egressing to Cloud Metadata Internal exploit · alerting DSΣPDDCS [WEEKLY] Internet-Exposed AI Agent/LLM Service Spawns Shell or LOLBin After Inbound Connection Internal exploit · alerting DSΣPDDCS [WEEKLY] Internet-facing server process spawns interpreter then beacons to first-seen external host within 5 minutes Internal install · alerting DSPDD [WEEKLY] Internet-Facing Service Daemon Spawns Shell or Ingress Tool Then Beacons Out Internal exploit · alerting DSΣPDDCS [WEEKLY] Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) Internal install · alerting DSΣPDD [WEEKLY] Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution Internal exploit · alerting DSΣPDD [WEEKLY] Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain Internal exploit · alerting DSPDD [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress Internal exploit · alerting DSΣPDD [WEEKLY] Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) Internal exploit · alerting DSPDD [WEEKLY] Public-facing app auth/authz bypass into server-side code execution (patch-bypass wave) Internal exploit · alerting DSΣPDDCS [WEEKLY] Public-Facing App Auth-Bypass to Server-Side Code Execution (web-server process spawning a shell/interpreter) Internal exploit · alerting DSΣPDDCS [WEEKLY] Public-Facing App Runtime Spawns Shell, LOLBin, or Container-Control Tool Internal exploit · alerting DSΣPDD [WEEKLY] Self-hosted application service spawns shell or SSH within seconds of inbound unauthenticated API write Internal exploit · alerting DSPDD [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain Internal exploit · alerting DSΣPDD [WEEKLY] Service-process parent spawns subprocess containing CLI-argument-injection tokens Internal exploit · alerting DSΣPDD [WEEKLY] SSRF-Driven Secret Egress: Public-Facing App Reaches Cloud Metadata/Attacker Host Internal actions · alerting DSΣPDDCSCW [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host Internal exploit · alerting DSPDD [WEEKLY] Web-Facing Service Process Writes to RCE/Persistence Paths (Path-Traversal File-Write) Internal install · alerting DSΣPDDCS [WEEKLY] Web-Server Process Post-Exploit Anchor: Plugin/Extension RCE Leading to Shell Spawn or Webroot Script Drop Internal install · alerting DSΣPDD [WEEKLY] Web-tier interpreter post-exploitation: shell/net-tool spawn, secret-file read, or cloud IMDS reach Internal install · alerting DSΣPDDCSCW Cisco IOS XE Request Platform Package Describe Shell Pattern ESCU actions · alerting P Cisco IOS XE WebUI Login From IOSd Local Port ESCU actions · alerting P Cisco IOS XE WebUI Programmatic Configuration ESCU actions · hunting P CrushFTP Server Side Template Injection ESCU actions · alerting P Ivanti VTM New Account Creation ESCU actions · alerting P Ollama Possible RCE via Model Loading ESCU actions · hunting P Ollama Suspicious Prompt Injection Jailbreak ESCU actions · hunting P PTC Windchill Gateway Command Execution ESCU actions · hunting P PTC Windchill GW READY OK Probe ESCU actions · hunting P Suspicious Java Classes ESCU actions · hunting P Cisco NVM - Webserver Download From File Sharing Website ESCU actions · alerting P ConnectWise ScreenConnect Path Traversal ESCU actions · alerting P ConnectWise ScreenConnect Path Traversal Windows SACL ESCU actions · alerting P Detect Exchange Web Shell ESCU actions · alerting P Exchange PowerShell Abuse via SSRF ESCU actions · alerting P Java Writing JSP File ESCU actions · alerting P Linux Suspicious Child Process of PostgreSQL ESCU actions · alerting P Linux Suspicious React or Next.js Child Process ESCU actions · alerting P Living Off The Land Detection ESCU actions · alerting P Log4Shell CVE-2021-44228 Exploitation ESCU actions · alerting P MOVEit Certificate Store Access Failure ESCU actions · hunting P MOVEit Empty Key Fingerprint Authentication Attempt ESCU actions · hunting P MS Exchange Mailbox Replication service writing Active Server Pages ESCU actions · alerting P Outbound Network Connection from Java Using Default Ports ESCU actions · alerting P PaperCut NG Suspicious Behavior Debug Log ESCU actions · hunting P Web or Application Server Spawning a Shell ESCU actions · alerting P Windows Identify PowerShell Web Access IIS Pool ESCU actions · hunting P Windows Metasploit Confluence Plugin Execution ESCU actions · alerting P Windows MOVEit Transfer Writing ASPX ESCU actions · alerting P Windows PaperCut NG Spawn Shell ESCU actions · alerting P Windows SharePoint Spinstall0 Webshell File Creation ESCU actions · alerting P Windows Shell or Script Execution From IIS Directory ESCU actions · hunting P Windows Shell Process from CrushFTP ESCU actions · alerting P Windows Suspicious React or Next.js Child Process ESCU actions · alerting P Windows TeamCity Payload Execution from Temp Directory ESCU actions · alerting P Windows TeamCity Plugin Installed ESCU actions · hunting P Windows Unusual File Creation in Confluence Directory ESCU actions · hunting P Windows WSUS Spawning Shell ESCU actions · alerting P WinRM Spawning a Process ESCU actions · alerting P Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity ESCU actions · alerting P Cisco SD-WAN - Low Frequency Rogue Peer ESCU actions · hunting P Cisco SD-WAN - Peering Activity ESCU actions · hunting P Cisco Secure Firewall - High Priority Intrusion Classification ESCU actions · alerting P Cisco Secure Firewall - Lumma Stealer Activity ESCU actions · alerting P Cisco Secure Firewall - Oracle E-Business Suite Correlation ESCU actions · alerting P Cisco Secure Firewall - Oracle E-Business Suite Exploitation ESCU actions · alerting P Cisco Secure Firewall - React Server Components RCE Attempt ESCU actions · alerting P Cisco Secure Firewall - Static Tundra Smart Install Abuse ESCU actions · alerting P Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity ESCU actions · alerting P Cisco Smart Install Oversized Packet Detection ESCU actions · alerting P Cisco Smart Install Port Discovery and Status ESCU actions · alerting P Detect Outbound LDAP Traffic ESCU actions · hunting P Detect Zerologon via Zeek ESCU actions · alerting P F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 ESCU actions · alerting P Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint ESCU actions · alerting P Adobe ColdFusion Access Control Bypass ESCU actions · hunting P Adobe ColdFusion Unauthenticated Arbitrary File Read ESCU actions · hunting P Cisco IOS XE Implant Access ESCU actions · alerting P Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure ESCU actions · hunting P Citrix ADC and Gateway Unauthorized Data Disclosure ESCU actions · alerting P Citrix ADC Exploitation CVE-2023-3519 ESCU actions · hunting P Citrix ShareFile Exploitation CVE-2023-24489 ESCU actions · hunting P Confluence CVE-2023-22515 Trigger Vulnerability ESCU actions · alerting P Confluence Data Center and Server Privilege Escalation ESCU actions · alerting P Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527 ESCU actions · alerting P Confluence Unauthenticated Remote Code Execution CVE-2022-26134 ESCU actions · alerting P ConnectWise ScreenConnect Authentication Bypass ESCU actions · alerting P CrushFTP Authentication Bypass Exploitation ESCU actions · alerting P Detect F5 TMUI RCE CVE-2020-5902 ESCU actions · alerting P Exploit Public Facing Application via Apache Commons Text ESCU actions · hunting P Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 ESCU actions · alerting P Fortinet Appliance Auth bypass ESCU actions · alerting P HTTP Duplicated Header ESCU actions · hunting P HTTP Rapid POST with Mixed Status Codes ESCU actions · hunting P HTTP Request to Reserved Name on IIS Server ESCU actions · alerting P Hunting for Log4Shell ESCU actions · hunting P Ivanti Connect Secure Command Injection Attempts ESCU actions · alerting P Ivanti Connect Secure SSRF in SAML Component ESCU actions · alerting P Ivanti Connect Secure System Information Access via Auth Bypass ESCU actions · hunting P Ivanti EPM SQL Injection Remote Code Execution ESCU actions · alerting P Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 ESCU actions · alerting P Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082 ESCU actions · alerting P Java Class File download by Java User Agent ESCU actions · alerting P Jenkins Arbitrary File Read CVE-2024-23897 ESCU actions · alerting P JetBrains TeamCity Authentication Bypass CVE-2024-27198 ESCU actions · alerting P JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 ESCU actions · alerting P JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 ESCU actions · alerting P JetBrains TeamCity RCE Attempt ESCU actions · alerting P Juniper Networks Remote Code Execution Exploit Detection ESCU actions · alerting P Log4Shell JNDI Payload Injection Attempt ESCU actions · hunting P Log4Shell JNDI Payload Injection with Outbound Connection ESCU actions · hunting P Nginx ConnectWise ScreenConnect Authentication Bypass ESCU actions · alerting P PaperCut NG Remote Web Access Attempt ESCU actions · alerting P ProxyShell ProxyNotShell Behavior Detected ESCU actions · alerting P SAP NetWeaver Visual Composer Exploitation Attempt ESCU actions · hunting P Spring4Shell Payload URL Request ESCU actions · alerting P SQL Injection with Long URLs ESCU actions · alerting P Tomcat Session Deserialization Attempt ESCU actions · hunting P Tomcat Session File Upload Attempt ESCU actions · hunting P VMWare Aria Operations Exploit Attempt ESCU actions · alerting P VMware Server Side Template Injection Hunt ESCU actions · hunting P VMware Workspace ONE Freemarker Server-side Template Injection ESCU actions · hunting P Web JSP Request via URL ESCU actions · alerting P Web Remote ShellServlet Access ESCU actions · alerting P Web Spring4Shell HTTP Request Class Module ESCU actions · alerting P Web Spring Cloud Function FunctionRouter ESCU actions · alerting P Windows Exchange Autodiscover SSRF Abuse ESCU actions · alerting P Windows IIS Server PSWA Console Access ESCU actions · hunting P Windows SharePoint Spinstall0 GET Request ESCU actions · alerting P Windows SharePoint ToolPane Endpoint Exploitation Attempt ESCU actions · alerting P WordPress Bricks Builder plugin RCE ESCU actions · alerting P WS FTP Remote Code Execution ESCU actions · alerting P Ivanti Sentry Authentication Bypass ESCU actions · alerting P Linux Java Spawning Shell ESCU actions · alerting P Splunk Enterprise Windows Deserialization File Partition ESCU actions · alerting P Splunk RCE via Serialized Session Payload ESCU actions · hunting P Splunk Unauthenticated Log Injection Web Service Log ESCU actions · hunting P Windows Java Spawning Shells ESCU actions · alerting P [LLM] Ray host OOB callback to oast.fun/interact.sh (ShadowRay exploit validation) Bespoke exploit · alerting DSΣPDDCSCW [LLM] MLflow unauthenticated webhook create + /test SSRF exploitation (CVE-2026-64849) Bespoke exploit · alerting SΣP [LLM] MLflow/Python server egress to cloud metadata IP 169.254.169.254 (SSRF landing) Bespoke exploit · hunting DSΣPDDCS [LLM] GitLab GraphQL mutation delivered over HTTP GET to /api/graphql (CVE-2026-19650) Bespoke exploit · hunting SΣP [LLM] Self-managed GitLab running versions vulnerable to CVE-2026-19478 / CVE-2026-19650 Bespoke recon · alerting DS [LLM] Node.js runtime spawning a shell/command interpreter (vm2 sandbox breakout RCE) Bespoke exploit · hunting DSΣPDDCS [LLM] Vulnerable vm2 package (<=3.11.5) exposed to CVE-2026-47698 sandbox breakout Bespoke exploit · hunting DS [LLM] New API CVE-2026-71479: integer-overflow multiplier in billing request (self-crediting) Bespoke exploit · alerting SΣPDD [LLM] conflibot command injection: shell spawned by Node action with git + shell metacharacters (CVE-2026-55158) Bespoke exploit · alerting DSΣPCS [LLM] Clop hex-named JSP webshell dropped under PTC Windchill /login (CVE-2026-12569) Bespoke install · alerting DSΣPDDCS [LLM] POST to hex-named JSP webshell under /Windchill/login/ in web/proxy logs Bespoke exploit · hunting SΣP [LLM] vCenter CVE-2026-59310 PoC cron drop + backdoor fetch (zz-poc59310-syslog.log) Bespoke exploit · hunting DSΣPDDCS [LLM] Rogue vSphere admin account creation via GoodMoodle-VCFleet UA from 146.59.252.178 Bespoke delivery · hunting DSΣPDDCS [LLM] SAP Commerce Cloud CVE-2026-58231: default OAuth client abuse against Data Hub Adapter Bespoke exploit · hunting SΣP [LLM] SAP Commerce (Hybris) Java process spawning OS command shell — CVE-2026-58231 RCE payoff Bespoke exploit · hunting DSΣPDDCS [LLM] Inbound Screen Sharing (VNC port 5900) from a public IP to a Mac — CVE-2026-65400 exposure Bespoke exploit · hunting DSΣPCS [LLM] Internet-facing macOS hosts unpatched against the Screen Sharing CVE cluster (exposure hunt) Bespoke recon · hunting DSP [LLM] SharePoint STS certificate/thumbprint disclosure endpoint accessed from external IP (CVE-2026-55040 recon) Bespoke recon · alerting SΣP [LLM] SharePoint CVE-2026-55040 chain: metadata recon then post-bypass API calls from one external IP Bespoke actions · alerting SP [LLM] ColdFusion server process spawning OS shell / LOLBin (CVE-2026-48362 / CVE-2026-48273 RCE) Bespoke exploit · hunting DSΣPDDCS [LLM] Exposure: unpatched Adobe ColdFusion / Campaign Classic (APSB26-90 & APSB26-120 CVEs) Bespoke exploit · hunting DSP [LLM] Traefik ReplacePathRegex auth bypass: glued dot-dot traversal in request path Bespoke exploit · alerting SΣPDD [LLM] Traefik path-traversal bypass CONFIRMED: traversal request returns 2xx on protected route Bespoke actions · alerting SPDD [LLM] Traefik dynamic config write introducing unbounded ReplacePathRegex capture group Bespoke weapon · hunting DSΣPCS [LLM] Vulnerable Traefik version exposed to CVE-2026-65600 / CVE-2026-48020 Bespoke recon · alerting DS [LLM] Nuxt/Vite dev server (node.exe) spawns shell or LOLBin child — DevTools RPC RCE Bespoke exploit · alerting DSΣPDDCS [LLM] Nuxt dev server bound to non-loopback interface (nuxi/nuxt dev --host) Bespoke delivery · hunting DSΣPDDCS [LLM] Inbound non-loopback connection to Nuxt/Vite dev server (node.exe HMR port) Bespoke delivery · hunting DSPCS [LLM] Unauthenticated Flowise OAuth2 token-refresh endpoint access from external source (CVE-2026-70478) Bespoke exploit · alerting SΣP [LLM] Flowise OAuth2 credentialId enumeration (mixed 200/404 probing) Bespoke recon · alerting SP [LLM] Flowise CSV Agent prompt-injection: validator-bypass Python tokens POSTed to /api/v1/prediction Bespoke delivery · hunting SP [LLM] Flowise (node) process spawning a shell — CVE-2026-70477 pyodide→child_process RCE landing Bespoke exploit · alerting DSΣPCS [LLM] Malicious csvFile data URI with Python/JS breakout posted to Flowise /api/v1/prediction Bespoke exploit · hunting SΣP [LLM] Flowise Node.js process spawning OS shell/recon (Pyodide js-interop RCE sink) Bespoke actions · alerting DSΣPDDCS [LLM] Unicode homoglyph dunder payload to Flowise /api/v1/prediction (validator bypass) Bespoke delivery · hunting SP [LLM] Flowise additionalConfig database-path override in vector-upsert API request (CVE-2026-69259) Bespoke exploit · hunting SP [LLM] Flowise node process writes SQLite DB file to system directory (arbitrary-write RCE primitive) Bespoke install · alerting DSΣPCS [LLM] Flowise node runtime spawns shell interpreter (post-exploit command execution) Bespoke exploit · alerting DSΣPCS [LLM] Flowise node.js spawns Unix shell/command binaries as root (CSVAgent Pyodide RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] Flowise CSVAgent exploit HTTP sequence: chatflow create + prediction trigger Bespoke exploit · hunting SP [LLM] Flowise/node process spawning Unix shell or netcat reverse shell (CVE-2026-69254 vm2 escape) Bespoke install · alerting DSΣPDDCS [LLM] Flowise API exploitation: path-traversal / JS-injection payloads to /api/v1 endpoints (CVE-2026-69254) Bespoke delivery · hunting SΣP [LLM] Flowise node process spawning shell/netcat (TypeORM DataSource RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] Malicious JavaScript entity file written into Flowise storage by node Bespoke delivery · hunting DSΣPCS [LLM] Sequelize Oracle SQLi: TO_DATE/TO_TIMESTAMP quote-bypass payload in HTTP request Bespoke delivery · alerting SΣP [LLM] ApostropheCMS SSPP payload: $pullAll/__proto__ PATCH to piece-type API (CVE-2026-53609) Bespoke exploit · alerting SΣP [LLM] ApostropheCMS auth-bypass symptom: protected piece-type endpoint 401/403 → 200 transition Bespoke actions · hunting SP [LLM] ApostropheCMS exploit chain: unauth PATCH to /@apostrophecms/global → 200 GET on /user within 30s Bespoke exploit · alerting SP [LLM] NocoBase anonymous account sign-up via auth-basic (allowSignUp) exploitation prerequisite Bespoke delivery · hunting SΣP [LLM] CVE-2026-52887 SQLi payload in NocoBase myInAppChannels filter[latestMsgReceiveTimestamp][$lt] Bespoke exploit · alerting SΣP [LLM] PostgreSQL container process spawning shell — COPY TO PROGRAM RCE (CVE-2026-52887) Bespoke install · alerting DSΣPCS [LLM] NocoBase sign-up immediately followed by myInAppChannels exploitation from same source Bespoke delivery · alerting SP [LLM] Malicious vault-addr annotation on ConfigMap/Secret admission (CVE-2026-54725) Bespoke delivery · alerting SΣPDD [LLM] Vulnerable Pterodactyl Wings node (< v1.12.3) exposed to CVE-2026-52855 config-secret disclosure Bespoke exploit · hunting DSP [LLM] Rails web process reads /proc/self/environ or app secrets (Active Storage libvips file-read) Bespoke actions · hunting SPCS [LLM] Ruby/Puma Rails web process spawns a shell (post-file-read RCE via forged secret_key_base cookie) Bespoke exploit · alerting DSΣPCS [LLM] Internet-facing hosts running activestorage vulnerable to CVE-2026-66066 Bespoke exploit · hunting DS [LLM] Flyto2 flyto-verification unauthenticated POST /run on :8344 (CVE-2026-67426 SSRF entry) Bespoke exploit · hunting DSΣPCS [LLM] flyto-verification SSRF to cloud metadata IP (169.254.169.254) — runner-secret/IMDS theft Bespoke actions · hunting DSΣPDDCS [LLM] Langflow CVE-2026-33017 unauthenticated RCE exploitation (build_public_tmp) Bespoke exploit · hunting DSΣPDD [LLM] Logging-operator Flow/Output CRD injects Fluentd @type exec block (CVE-2026-54680) Bespoke delivery · alerting SΣPDD [LLM] Prebid-server SSRF payload in OpenRTB2 auction request parameters Bespoke exploit · hunting SΣP [LLM] Prebid-server outbound requests to internal ranges / internal host fan-out (SSRF) Bespoke actions · alerting DSPDDCSCW [LLM] Prebid-server SSRF filter-bypass via encoded internal host in request Bespoke exploit · hunting SΣP [LLM] @hypequery/clickhouse SQLi: backslash-quote / JSON-apostrophe payload at web edge (CVE-2026-54658) Bespoke exploit · hunting SΣP [LLM] Vulnerable @hypequery/clickhouse package (<2.5.1) present in node_modules Bespoke recon · hunting DSΣPCS [LLM] goshs launched with exploitable empty-credential SFTP config (CVE-2026-62325) Bespoke exploit · alerting DSΣPDDCS [LLM] goshs basic-auth flag with empty username or password (config-audit hunt) Bespoke exploit · hunting DSΣPDDCS [LLM] Unauthenticated inbound SFTP to goshs followed by remote file operations Bespoke actions · hunting DSPDDCS [LLM] Anomalous Host header on Poweradmin OIDC/SAML/logout endpoints (CVE-2026-54588) Bespoke exploit · hunting SP [LLM] Host header fuzzing burst against Poweradmin auth endpoints from single source Bespoke recon · alerting SP [LLM] Spike of AADSTS50011 redirect_uri mismatch at IdP (poisoned Poweradmin callback) Bespoke exploit · alerting DSPDD [LLM] Pheditor forced-password-change auth bypass — POST to pheditor.php Bespoke exploit · hunting SΣP [LLM] Web-server / PHP process writes new .php file under webroot (post-Pheditor webshell drop) Bespoke install · hunting DSΣPDDCS [LLM] Budibase REST query published to PUBLIC role (unauth cred-leak enabler) Bespoke exploit · hunting SΣP [LLM] Stacked SQL-injection payload against Budibase datasource query API (multipleStatements) Bespoke exploit · alerting SΣP [LLM] MySQL server (mysqld) writes exfil file via SELECT INTO OUTFILE on Budibase DB host Bespoke actions · hunting DSΣPCS [LLM] OpenAM /authservice CustomCallback ClassName XML — CVE-2026-62379 pre-auth Class.forName RCE Bespoke exploit · alerting SP [LLM] OpenAM/Tomcat java process spawning shell or LOLBin — CVE-2026-62379 post-exploitation Bespoke install · alerting DSΣPDDCS [LLM] OpenAM WebAuthn pre-auth Java deserialization payload to /json/authenticate (CVE-2026-62263) Bespoke exploit · alerting SΣP [LLM] OpenAM/Tomcat Java process spawning a shell — post-deserialization RCE (CVE-2026-62263) Bespoke exploit · alerting DSΣPDDCS [LLM] Node.js host process spawning OS shell (Nunjucks SSTI child_process.execSync RCE) Bespoke exploit · hunting DSΣPDDCS [LLM] Vulnerable @prompty/core package present in node_modules (GHSA-w28w-gp39-m4p6 exposure) Bespoke delivery · hunting DSΣPDDCS [LLM] Velocity.js SSTI RCE payload (constructor.constructor→child_process) in HTTP request Bespoke delivery · alerting SΣP [LLM] Node.js process spawning shell / recon binary (velocityjs SSTI RCE execution) Bespoke exploit · alerting DSΣPDDCS [LLM] Vulnerable seroval (<=1.5.2) / TanStack Start (<1.167.30) exposure to CVE-2026-59940 deserialization RCE Bespoke exploit · hunting DS [LLM] Auth.js fail-open exploited: protected routes served 200/302 during an active auth-error window Bespoke exploit · hunting SP [LLM] Unpatched Zimbra Collaboration exposed to CVE-2025-66376 (Void Blizzard target) Bespoke exploit · hunting DS [LLM] wp2shell SQLi via author__not_in REST parameter (CVE-2026-60137) Bespoke exploit · alerting SΣP [LLM] Gitea PR head-branch update via API v1 pulls/{index}/update (CVE-2026-58443 exploit vector) Bespoke exploit · hunting SΣP [LLM] Vulnerable Gitea instance exposed to CVE-2026-58443 (≤1.26.4) Bespoke exploit · hunting DSP [LLM] Client-supplied X-WEBAUTH-USER header reaching Gitea (CVE-2026-20896 impersonation) Bespoke exploit · hunting DSPCS [LLM] Gitea container started with reverse-proxy auth exposing permissive trusted-proxies (CVE-2026-20896) Bespoke install · hunting DSΣPDDCS [LLM] Gitea webhook/migration SSRF reaching cloud metadata endpoints (IMDS / Azure WireServer) Bespoke actions · hunting DSΣPDDCS [LLM] Gitea process egress to SSRF allow-list bypass internal ranges (CGNAT / 172.32.0.0/11) Bespoke recon · hunting DSΣPDDCS [LLM] Vulnerable Gitea version exposed to CVE-2026-22874 SSRF (pre-1.26.4) Bespoke weapon · hunting DS [LLM] Vitest Browser Mode / test API (node.exe) accepting inbound connections on 63315/51204 from non-loopback host Bespoke exploit · hunting DSΣPDDCS [LLM] LightRAG destructive document ops post-bypass (DELETE /documents, clear_cache, unauth upload) Bespoke actions · alerting SΣP [LLM] WordPress wp2shell batch REST API pre-auth RCE exploitation (CVE-2026-63030/60137) Bespoke exploit · alerting SΣP [LLM] Web server daemon (php-fpm/apache/nginx/w3wp) spawning a shell or network tool — wp2shell post-exploit code execution Bespoke exploit · alerting DSΣPDDCS [LLM] Siemens RUGGEDCOM ROX II devices exposed to CVE-2025-40947/48/49 (firmware < V2.17.1) Bespoke exploit · alerting DS [LLM] Pheditor terminal RCE: web-server/PHP process spawns shell (CVE-2026-55579) Bespoke exploit · alerting DSΣPDDCS [LLM] Pheditor file-upload abuse: web-server process writes new .php webshell Bespoke install · alerting DSΣPDDCS [LLM] Pheditor default-credential exploitation traffic: POST to /pheditor.php from external source Bespoke delivery · hunting SΣP [LLM] EnvoyExtensionPolicy Lua with double-slash path traversal to secrets (CVE-2026-53713) Bespoke exploit · alerting SΣPDD [LLM] EnvoyExtensionPolicy Lua invoking os/io/debug file primitives Bespoke exploit · hunting SΣPDD [LLM] Anomalous EnvoyExtensionPolicy submitter / suspicious policy name Bespoke delivery · hunting SΣPDD [LLM] Vulnerable Envoy Gateway version exposed to CVE-2026-53713 Bespoke recon · hunting DS [LLM] Unauthenticated access to MantisBT admin/install.php on a production host (CVE-2026-52847) Bespoke recon · hunting SΣP [LLM] Credential-phishing form injection via reflected XSS in MantisBT install.php (CVE-2026-52881) Bespoke delivery · alerting SΣP [LLM] Meta open-redirect injection via reflected XSS in MantisBT install.php (CVE-2026-52881) Bespoke delivery · alerting SΣP [LLM] Broad reflected HTML/XSS payload tokens in MantisBT install.php query string Bespoke exploit · hunting SΣP [LLM] MantisBT self-registration (signup.php) followed by SOAP replay to mantisconnect.php from same source Bespoke exploit · hunting SP [LLM] FacturaScripts upload endpoint: path-traversal sequence in multipart filename Bespoke exploit · alerting SΣP [LLM] FacturaScripts: PHP/.htaccess web-shell written into web-served Dinamic/Assets or node_modules Bespoke install · alerting DSΣPDDCS [LLM] FacturaScripts RCE chain: .htaccess handler-remap override plus payload drop in same asset dir Bespoke exploit · alerting DSPCS [LLM] n8n-MCP vulnerable multi-tenant config exposure (ENABLE_MULTI_TENANT without version-tool mitigation) Bespoke exploit · hunting SP [LLM] Anyquery server mode bound to all interfaces (exposed unauthenticated MySQL port) Bespoke delivery · hunting DSΣPDDCS [LLM] Inbound connection to Anyquery listener from a public IP Bespoke delivery · hunting DSPCS [LLM] Anyquery process writing files to cron/webroot/SSH persistence paths (ATTACH DATABASE AFW) Bespoke install · alerting DSΣPCS [LLM] ATTACH DATABASE statement targeting persistence paths in Anyquery query logs Bespoke exploit · hunting SPDD [LLM] FacturaScripts CVE-2026-45262 SQLi: parenthesis-bypass in REST API filter[] key Bespoke exploit · alerting SΣP [LLM] FacturaScripts filter[] SQLi column-count / schema enumeration (burst probing) Bespoke exploit · hunting SP [LLM] Kimai authenticated session activity with no preceding form-login POST (forged remember-me cookie) Bespoke exploit · hunting SP [LLM] Kimai forged Symfony login-link request (user+expires+hash signed URL) to super_admin Bespoke exploit · hunting SΣP [LLM] DIRAC FileCatalog checkDataset SQL injection carrying Python eval gadget (CVE-2026-61667) Bespoke exploit · hunting SPDD [LLM] DIRAC FileCatalog service Python process spawns shell or recon binary (eval RCE) Bespoke install · alerting DSΣPDDCS [LLM] DIRAC ReqManager service (CVE-2026-45579) spawning a shell or recon/egress binary Bespoke exploit · alerting DSΣP [LLM] File Browser hook-auth pre-auth RCE: filebrowser spawns shell/recon commands (CVE-2026-54088) Bespoke exploit · alerting DSΣPCS [LLM] FileBrowser reverse-proxy bypass: direct external access to exposed port 8085 Bespoke delivery · alerting DSΣPDDCS [LLM] FileBrowser instance configured with auth.method=proxy (exploitable-config exposure) Bespoke recon · hunting DSΣPDDCS [LLM] Authorizer /authorize implicit-flow token leak to off-origin redirect_uri (CVE-2026-54072) Bespoke exploit · alerting SΣP [LLM] Authorizer unauthenticated /graphql client_id reconnaissance (CVE-2026-54072 pre-exploit) Bespoke recon · hunting SΣP [LLM] Authorizer /authorize redirect_uri iteration — multiple distinct targets from one source Bespoke exploit · alerting SP [LLM] Spike in Authorizer /authorize 302 redirects to off-origin hosts (bulk token exfiltration) Bespoke actions · hunting SP [LLM] YesWiki Bazar CalcField eval() RCE — dangerous PHP functions in form-save request Bespoke exploit · alerting SΣP [LLM] YesWiki CalcField ReDoS/stack-overflow DoS — deeply nested parentheses payload Bespoke actions · alerting SΣP [LLM] YesWiki post-RCE — php-fpm/apache spawns Unix shell or recon binary (www-data) Bespoke install · alerting DSΣPDDCS [LLM] YesWiki CalcField exploit attempts — PHP parse/fatal errors from CalcField.php in syslog Bespoke exploit · hunting SPDD [LLM] YesWiki BazarImportAction object-injection exploit request (CVE-2026-52777) Bespoke exploit · alerting SΣP [LLM] Base64 PHP-serialized-object payload in importfiche POST body Bespoke exploit · alerting SP [LLM] YesWiki web-server process spawning an OS shell (deserialization RCE outcome) Bespoke exploit · alerting DSΣPDDCS [LLM] YesWiki unauthenticated erasespamedcomments page-deletion invocation (CVE-2026-52766) Bespoke exploit · alerting SΣP [LLM] Rocket.Chat Livechat file-upload ID enumeration sweep (ObjectId harvest) Bespoke actions · alerting SP [LLM] Rocket.Chat anonymous Livechat visitor bootstrap chained to file-upload access Bespoke exploit · alerting SP [LLM] Rocket.Chat file-upload request carrying Livechat auth params (IDOR signature) Bespoke exploit · hunting SΣP [LLM] phpBB CVE-2026-48611 auth bypass via login_link auth_provider=apache Bespoke exploit · alerting SΣP [LLM] phpBB CVE-2026-48611 post-exploit ACP access from exploiting IP Bespoke actions · alerting SP [LLM] HTTP Basic Authorization header sent to phpBB login_link endpoint Bespoke exploit · hunting SP [LLM] Exposed phpBB instances vulnerable to CVE-2026-48611 / 48612 / 29199 auth bypass Bespoke exploit · hunting DSP [LLM] phpBB ACP access from a source IP with no prior login (CVE-2026-48611 session hijack) Bespoke exploit · hunting SP [LLM] phpBB password-reset host-header poisoning (CVE-2026-29199) Bespoke exploit · hunting SP [LLM] phpBB OAuth account-binding CSRF via cross-site request to /user/oauth/authenticate/ (CVE-2026-48612) Bespoke exploit · hunting SP [LLM] Thymeleaf SpEL tab-character sandbox bypass payload in HTTP request (CVE-2026-40478) Bespoke exploit · alerting SΣPDD [LLM] Java/Tomcat process writes .jsp webshell file to disk (CVE-2026-40478 post-exploit drop) Bespoke install · alerting DSΣPDDCS [LLM] Java/Tomcat process spawns OS command interpreter (post-Thymeleaf SSTI RCE) Bespoke actions · alerting DSΣPDDCS [LLM] Qinglong CVE-2026-3965 auth bypass via /open/user/init credential reset Bespoke exploit · alerting DSΣPDDCS [LLM] Qinglong CVE-2026-4047 case-mismatch auth bypass via /aPi/system/command-run Bespoke exploit · alerting DSΣPDD [LLM] Mailcow Autodiscover endpoint receives unauthenticated XSS payload (GHSA-f9xf-vc72-rcgm) Bespoke delivery · alerting SPDD [LLM] Mailcow login with HTML/JS injected into X-Real-IP header (GHSA-jprq-w83q-q62h) Bespoke delivery · alerting SPDD [LLM] BodySnatcher (CVE-2025-12420) ServiceNow Virtual Agent bot/integration exploit Bespoke exploit · alerting SΣP [LLM] BodySnatcher (CVE-2025-12420) — Hardcoded 'servicenowexternalagent' Token Observed in HTTP Traffic Bespoke exploit · alerting DSΣPDDCS [LLM] ServiceNow Virtual Agent Invocation of Hidden AIA-Agent Invoker AutoChat Topic (CVE-2025-12420) Bespoke exploit · alerting DSPDDCS [LLM] Vulnerable react-server-dom-* package versions (CVE-2025-55182) in workload inventory Bespoke recon · hunting DSPDDCS [LLM] Node.js process spawning interactive shell — suspected post-exploit RCE on Next.js / RSC server Bespoke exploit · alerting DSΣPDDCS [LLM] Anomalous POST to Next.js Server Action / RSC endpoint with 5xx error clustering Bespoke exploit · alerting DSPDDCS [LLM] Next.js CVE-2025-29927 middleware bypass via x-middleware-subrequest header Bespoke exploit · alerting DSΣPDDCS [LLM] Apache Spark CVE-2022-33891 doAs command injection — shell spawned by Spark JVM running 'id -Gn' with metacharacters Bespoke exploit · alerting DSΣPDDCS [LLM] ImageMagick 'convert -resize' command injection via sh -c in Go web app Bespoke exploit · hunting DSΣPDDCS [LLM] Inbound UDP/631 (CUPS IPP discovery) from external network Bespoke delivery · hunting DSΣPDDCS [LLM] Linux assets with vulnerable CUPS packages and external exposure (CVE-2024-47175/76/77/076) Bespoke recon · hunting DSPDDCS [LLM] Log4Shell JNDI exploitation string in inbound HTTP requests (CVE-2021-44228) Bespoke exploit · alerting SΣP [LLM] Log4Shell outbound JNDI callback from Java process to LDAP/RMI (CVE-2021-44228) Bespoke c2 · alerting DSΣPDDCS [LLM] Spring4Shell classLoader payload in inbound HTTP request (CVE-2022-22965) Bespoke exploit · alerting SΣP [LLM] Spring4Shell JSP webshell drop by Tomcat/Java into webapps (CVE-2022-22965) Bespoke install · alerting DSΣPDDCS [LLM] Exposure: hosts running python-multipart ≤0.0.6 / FastAPI ≤0.109.0 vulnerable to CVE-2024-24762 ReDoS Bespoke exploit · hunting DSP [LLM] Vulnerable HTTP/2 server inventory: CONTINUATION flood CVE cluster (CVE-2024-27316 et al.) Bespoke recon · hunting DSP [LLM] HTTP/2 server crash-loop on internet-facing host (CONTINUATION flood DoS exploitation signal) Bespoke actions · alerting DSPDDCS [LLM] Web-app runtime egress to AWS IMDS endpoint (169.254.169.254) — SSRF credential theft Bespoke actions · hunting DSΣPDDCS [LLM] Boolean-tautology SQL injection against Node.js/Express search endpoint Bespoke exploit · hunting SΣP [LLM] Vulnerable Jinja2 < 3.1.3 inventory pivot for CVE-2024-22195 (xmlattr XSS) Bespoke recon · hunting DSP [LLM] Jinja2 xmlattr XSS exploitation attempt in HTTP request parameters (CVE-2024-22195) Bespoke exploit · alerting SΣP [LLM] Struts CVE-2023-50164 path-traversal upload — HTTP exploit attempt Bespoke exploit · alerting DSΣPDD [LLM] Tomcat/Java process writes .jsp/.jspx webshell into webapp directory Bespoke install · alerting DSΣPDDCS [LLM] Tomcat/Java process spawns OS shell or LOLBin (post-webshell RCE) Bespoke actions · alerting DSΣPDDCS [LLM] PHP web-server process initiating outbound TCP (fsockopen reverse shell to attacker) Bespoke c2 · alerting DSΣPCS [LLM] PHP CLI dev server (php -S) spawning a shell or child interpreter (proc_open php -a) Bespoke exploit · alerting DSΣPDDCS [LLM] Browser extension folder write at vulnerable React DevTools 4.27.8 / Vue.js devtools 6.5.0 Bespoke exploit · hunting DSΣPDDCS [LLM] Curl invoked with SOCKS5-hostname resolution (CVE-2023-38545 exploit precondition) Bespoke exploit · hunting DSΣPDDCS [LLM] Vulnerable libcurl/curl version present on host (CVE-2023-38545) Bespoke recon · hunting DS [LLM] Hosts exposed to libwebp heap overflow CVE-2023-4863 / CVE-2023-5129 (TVM) Bespoke weapon · alerting DSP [LLM] Vulnerable SnakeYAML <2.0 present (CVE-2022-1471 unsafe deserialization) Bespoke exploit · hunting DSP [LLM] JVM (java/javaw) spawning OS command interpreter — SnakeYAML gadget RCE outcome Bespoke exploit · hunting DSΣPDDCS [LLM] JVM outbound fetch of remote class/JAR to public host — URLClassLoader gadget Bespoke delivery · hunting DSPDDCS [LLM] node-serialize / serialize-to-js deserialization RCE payload marker `_$$ND_FUNC$$_` in web request Bespoke exploit · alerting SP [LLM] Node.js process spawning a command interpreter (deserialization RCE child_process exec) Bespoke exploit · alerting DSΣPDDCS [LLM] Ruby/Rails app server spawning a Unix shell (post-deserialization RCE) Bespoke exploit · alerting DSΣPCS [LLM] Exposure hunt: hosts running Spring Security vulnerable to CVE-2022-31692 forward/include auth bypass Bespoke recon · hunting DSP [LLM] SnakeYAML deserialization gadget tags in HTTP request (CVE-2022-1471) Bespoke exploit · alerting SΣP [LLM] Java process (java.exe/javaw.exe) spawning OS command shell — SnakeYAML RCE Bespoke exploit · hunting DSΣPDDCS [LLM] Java process outbound LDAP/RMI to fetch remote class — SnakeYAML JNDI gadget Bespoke c2 · alerting DSΣPDDCS [LLM] Pistache CVE-2022-26068 path traversal reading /etc/passwd via /doc/../ Bespoke exploit · alerting SΣP [LLM] Pistache binary theft via /doc/../../proc/self/exe path traversal Bespoke actions · alerting SΣP [LLM] curl --path-as-is traversal command exfiltrating /proc/self/exe or /etc/passwd Bespoke exploit · alerting DSΣPDDCS [LLM] URL-encoded directory traversal (%2e%2e) against node 'st' static-file route (CVE-2014-3744) Bespoke exploit · hunting SΣP [LLM] Vulnerable OpenSSL 3.0.0–3.0.6 exposure (CVE-2022-3602 / CVE-2022-3786, 'SpookySSL') Bespoke exploit · hunting DSP [LLM] Text4Shell (CVE-2022-42889) Commons Text interpolation payloads in inbound web requests Bespoke exploit · alerting SΣP [LLM] Java/JVM spawning OS shell after Text4Shell (CVE-2022-42889) script-engine RCE Bespoke install · alerting DSΣPDDCS [LLM] Git argument injection via --upload-pack option spawned by web-app runtime Bespoke exploit · alerting DSΣPDDCS [LLM] Mercurial argument injection via --config alias/hooks or --debugger from app runtime Bespoke exploit · alerting DSΣPDDCS [LLM] git/hg spawning a shell as child of a web-app runtime (argument-injection RCE evidence) Bespoke exploit · hunting DSPDDCS [LLM] Server application runtime spawning shell with /dev/tcp redirection (RCE to reverse shell) Bespoke exploit · alerting DSΣPCS [LLM] Apache Commons Configuration interpolation RCE payload in HTTP requests (CVE-2022-33980) Bespoke exploit · hunting SΣP [LLM] Java (ProcessBuilder) spawning shell/LOLBin child — Commons Config interpolation RCE Bespoke install · alerting DSΣPDDCS [LLM] Java process fetching first-seen external URL/DNS — Commons Config url/dns lookup (CVE-2022-33980) Bespoke c2 · hunting DSPDDCS [LLM] Prototype pollution attempt via __proto__ in URL query string (CVE-2021-23682, litespeed.js/appwrite) Bespoke exploit · hunting SΣP [LLM] Node.js web process overwriting application .js service file (GraphQL path-traversal file write) Bespoke exploit · hunting DSΣPCS [LLM] Spring4Shell classLoader property injection via dirContext.docBase (Glassfish/Payara/Tomcat) Bespoke exploit · alerting SΣP [LLM] Web path-traversal arbitrary file read via '../' in static-file URL (Crow CVE-2021-23514) Bespoke exploit · alerting SΣP [LLM] Arbitrary file write via '../' in upload 'name' parameter (Mongoose CVE-2022-25299) Bespoke install · alerting DSΣPCS [LLM] Spring4Shell (CVE-2022-22965) classLoader pipeline injection / JSP webshell call in web logs Bespoke exploit · alerting SΣP [LLM] Tomcat/Java JVM spawning command shell (Spring4Shell webshell command execution) Bespoke actions · hunting DSΣPDDCS [LLM] Spring4Shell (CVE-2022-22965) exploit: class.module.classLoader ClassLoader manipulation in HTTP request Bespoke exploit · alerting SΣP [LLM] Tomcat/Java writes JSP webshell into webapps (Spring4Shell post-exploit drop) Bespoke install · alerting DSΣPDDCS [LLM] Java/Tomcat spawns command shell or download tool (Spring4Shell RCE execution) Bespoke exploit · alerting DSΣPDDCS [LLM] Outbound connection to Spring4Shell Mirai staging IPs (107.174.133.167 / 194.31.98.186) Bespoke c2 · hunting DSΣPDDCSCW [LLM] HTTP request to executable PHP inside dompdf font cache (CVE-2022-28368 RCE trigger) Bespoke exploit · alerting SΣP [LLM] Magento CVE-2022-24086/24087 TrojanOrders checkout exploitation from known attacker IP Bespoke exploit · alerting SΣP [LLM] Magento webshell drop (health_check.php / pub-media PHP) written by web-server process Bespoke install · alerting DSΣPCS [LLM] Magento php-fpm/web-server spawning shell or download utility (CVE-2022-24086 RCE) Bespoke exploit · hunting DSΣPCS [LLM] Outbound or inbound connection to TrojanOrders C2/source IP 45.134.20.11 Bespoke c2 · hunting DSΣPDDCS [LLM] Magento CVE-2022-24086 template-directive injection in web requests (getTemplateFilter RCE) Bespoke exploit · hunting SΣP [LLM] Magento web process (w3wp/php-fpm/php-cgi) spawning OS shell — CVE-2022-24086 RCE Bespoke exploit · alerting DSΣPDDCS [LLM] Network activity involving CVE-2022-24086 attacker IP 45.134.20.11 Bespoke c2 · hunting DSΣPDDCSCW [LLM] Celery worker (Python) spawning a shell — CVE-2021-23727 stored command injection Bespoke exploit · hunting DSΣPCS [LLM] Hosts running Celery < 5.2.2 vulnerable to CVE-2021-23727 Bespoke recon · hunting DS [LLM] Log4Shell JNDI lookup string in inbound web request (CVE-2021-44228 exploitation) Bespoke exploit · alerting SP [LLM] Java/Tomcat application server spawning command shell or netcat (Log4Shell RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] Java process making outbound LDAP/RMI callout to public host (JNDI egress) Bespoke c2 · hunting DSΣPDDCS [LLM] Log4j logging configuration file modified (CVE-2021-44832 JDBC Appender precondition) Bespoke weapon · hunting DSΣPDDCS [LLM] Java process outbound LDAP/RMI egress (CVE-2021-44832 remote JNDI data source load) Bespoke exploit · alerting DSΣPDDCS [LLM] Vulnerable Apache Log4j inventory exposed to CVE-2021-44832 (pre-2.17.1/2.12.4/2.3.2) Bespoke recon · hunting DSP [LLM] Log4j CVE-2021-45046 JNDI localhost-bypass payload (${jndi:...127.0.0.1#...}) in web requests Bespoke exploit · alerting DSΣPCS [LLM] Log4Shell RCE execution: java/javaw spawning a shell or LOLBin Bespoke exploit · alerting DSΣPDDCS [LLM] Log4Shell JNDI class fetch: java process outbound to LDAP/RMI ports Bespoke c2 · alerting DSΣPDDCS [LLM] Exposure: hosts running Log4j versions vulnerable to CVE-2021-45046 Bespoke recon · hunting DSP [LLM] Log4Shell JNDI lookup injection string in HTTP requests / process cmdline (${jndi:ldap}) Bespoke exploit · alerting DSΣPDDCS [LLM] Java process making outbound LDAP/RMI connection (Log4Shell second-stage class fetch) Bespoke delivery · hunting DSΣPDDCS [LLM] Java/Tomcat process spawning OS shell (Log4Shell Runtime.exec post-exploitation) Bespoke install · alerting DSΣPDDCS [LLM] Log4Shell JNDI lookup string in inbound HTTP request (URI / User-Agent / headers) Bespoke exploit · alerting SΣP [LLM] Java (java.exe/javaw.exe) spawning shell or LOLBin — Log4Shell post-exploitation Bespoke install · alerting DSΣPDDCS [LLM] Java process outbound to LDAP/RMI/DNS callback port — Log4Shell JNDI fetch Bespoke c2 · alerting DSΣPDDCS [LLM] Log4Shell JNDI lookup string in inbound web request (CVE-2021-44228 exploitation) Bespoke exploit · alerting SΣP [LLM] Java process outbound LDAP/RMI to public IP (Log4Shell JNDI callback) Bespoke c2 · hunting DSΣPDDCS [LLM] Java/Tomcat process spawning shell, curl or wget (Log4Shell RCE follow-on) Bespoke install · alerting DSΣPDDCS [LLM] Prototype pollution / type-confusion payload in web request (__proto__, constructor[prototype]) Bespoke exploit · hunting SΣP [LLM] CVE-2020-9484 Tomcat session deserialization: JSESSIONID path-traversal in HTTP request Bespoke exploit · alerting SΣP [LLM] Tomcat/Java server process spawning an OS command shell (CVE-2020-9484 RCE outcome) Bespoke exploit · alerting DSΣPDDCS [LLM] Attacker-staged .session deserialization payload written outside Tomcat's session store Bespoke delivery · hunting DSΣPDDCS [LLM] SuiteCRM PHAR deserialization via case-mixed phar:// wrapper in admin request Bespoke exploit · alerting SΣP [LLM] Direct HTTP 200 to SuiteCRM /upload or /files (post-.htaccess-deletion code exec) Bespoke actions · hunting SΣP [LLM] ImageMagick convert spawning shell/LOLBin child (ImageTragick CVE-2016-3714 RCE) Bespoke exploit · alerting DSΣPCS [LLM] Semicolon GET parameter cloaking in web/proxy logs (cache poisoning, CVE-2021-23336 / CVE-2020-28473) Bespoke exploit · hunting SΣP [LLM] Assets exposed to cache-poisoning CVEs (Python parse_qsl CVE-2021-23336 / Bottle CVE-2020-28473) Bespoke recon · hunting DSP [LLM] systeminformation inetChecksite curl argument injection (CVE-2020-7752) Bespoke exploit · alerting DSΣPDDCS [LLM] Node.js (Express) process spawning a command shell — express-fileupload prototype-pollution RCE outcome Bespoke exploit · hunting DSΣPDDCS [LLM] Prototype-pollution payload (__proto__ / constructor.prototype) in inbound web requests to Express app Bespoke exploit · hunting SΣP [LLM] Exposure: hosts running express-fileupload vulnerable to CVE-2020-7699 Bespoke exploit · hunting DSP [LLM] Celery task injected into Apache Airflow message broker (unacked queue / execute_command) Bespoke delivery · alerting DSΣPDDCS [LLM] Apache Airflow Celery worker spawns non-airflow child (command-injection RCE, CVE-2020-11981) Bespoke exploit · alerting DSΣPCS [LLM] Apache Airflow task run with --pickle flag (pickle deserialization, CVE-2020-11982) Bespoke exploit · hunting DSΣPDDCS [LLM] Hosts exposed to Apache Airflow Celery broker RCE (CVE-2020-11981 / CVE-2020-11982) Bespoke recon · hunting DSP [LLM] GET request carrying a body / Content-Length — HTTP request smuggling (CL:CL) precursor Bespoke exploit · hunting SP [LLM] Front-end/back-end stack exposed to request-smuggling CVEs (nginx CVE-2020-12440, Werkzeug CVE-2019-16786) Bespoke exploit · alerting DSP [LLM] Ghostcat: inbound AJP (TCP/8009) connections from untrusted/public sources to Tomcat Bespoke exploit · hunting DSΣPDDCS [LLM] Ghostcat RCE: Tomcat/java process spawning a command shell (JSP webshell execution) Bespoke exploit · hunting DSΣPDDCS [LLM] Ghostcat exposure: assets running Tomcat versions vulnerable to CVE-2020-1938 Bespoke exploit · hunting DSP [LLM] Access to exposed Elector '/get-admin-users' credential-leaking API endpoint Bespoke exploit · alerting SΣP [LLM] Node.js launched with --insecure-http-parser flag (strict HTTP parsing disabled) Bespoke exploit · alerting DSΣPDDCS [LLM] Hosts exposed to Node.js Feb-2020 HTTP/TLS CVEs (CVE-2019-15604/15605/15606) Bespoke recon · hunting DS [LLM] Sequelize ORM JSON-path SQLi exploitation via ')) AS DECIMAL)' cast-break (CVE-2019-10748) Bespoke exploit · alerting SΣP [LLM] Exposure: jackson-databind <=2.9.9.2 / Spring Boot 2.1.7 vulnerable to CVE-2019-14379/14439 deserialization RCE Bespoke exploit · alerting DSP [LLM] Java/Spring Boot process spawning a shell — possible jackson-databind deserialization RCE Bespoke exploit · hunting DSΣPDDCS [LLM] Webmin password_change.cgi unauthenticated command injection exploit attempt (CVE-2019-15107) Bespoke exploit · hunting SΣP [LLM] Webmin RCE: miniserv/password_change.cgi spawning reverse shell (CVE-2019-15107) Bespoke exploit · alerting DSΣPDDCS [LLM] Vulnerable lodash (CVE-2019-10744 prototype pollution) present in software inventory Bespoke weapon · alerting DSP [LLM] Prototype pollution payload (__proto__ / constructor.prototype) in inbound web requests Bespoke exploit · hunting SΣP [LLM] Vulnerable urllib3 (<= 1.24.2 / CVE-2019-11236) present in software inventory Bespoke weapon · hunting DS [LLM] CRLF / HTTP-header injection in URL query string (urllib3 CVE-2019-11236 PoC shape) Bespoke exploit · hunting SΣP [LLM] jQuery prototype pollution payload (__proto__) in inbound HTTP request (CVE-2019-11358) Bespoke exploit · hunting SΣP [LLM] URL-encoded directory traversal (%2e%2e) against Node 'st' static file server Bespoke exploit · hunting SΣP [LLM] Successful sensitive-file disclosure via st traversal (/etc/passwd, package-lock.json) Bespoke actions · alerting SΣP [LLM] Anonymous access to Kubernetes aggregated API (CVE-2018-1002105 exploit surface) Bespoke exploit · hunting SΣPDDCW [LLM] Zip Slip arbitrary file overwrite by archive-handling runtime (java/python) via path traversal Bespoke exploit · hunting DSΣPDDCS [LLM] Exposure: hosts running Zip Slip-vulnerable Apache Storm / Hadoop (CVE-2018-8008 / CVE-2018-8009) Bespoke exploit · alerting DSP [LLM] Apache Struts web app (java/Tomcat) spawning OS shell or recon — post-exploit RCE (CVE-2017-5638 / CVE-2017-9805) Bespoke exploit · alerting DSΣPDDCS [LLM] Apache Struts OGNL / XStream exploit payload in WAF & web logs (CVE-2017-5638 + CVE-2017-9805) Bespoke exploit · alerting SP [LLM] Dust.js qs type-manipulation RCE payload in web request query string Bespoke exploit · alerting SΣP [LLM] qs prototype-override bypass exploit attempt in HTTP query string (CVE-2017-1000048) Bespoke exploit · alerting SΣP [LLM] ImageMagick binary spawning shell/recon process (ImageTragick CVE-2016-3714 delegate RCE) Bespoke exploit · hunting DSΣPCS [LLM] ImageMagick binary making outbound network connection (ImageTragick URL/HTTPS coder SSRF) Bespoke c2 · hunting DSPCS

Articles citing this technique (2574)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
crit [GHSA / CRITICAL] CVE-2026-64849: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated art-04
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects art-05
high Hacker claims 3.6 million Azure account records stolen from major companies art-06
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection art-08
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit [GHSA / CRITICAL] GHSA-m5w8-4gq2-6f8x: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes tha art-11
crit [GHSA / CRITICAL] CVE-2026-47698: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators art-12
crit [GHSA / CRITICAL] CVE-2026-47686: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE art-13
crit [GHSA / CRITICAL] CVE-2026-71479: New API: Integer overflow in quota billing yields negative charges (self-crediting) art-14
crit [GHSA / CRITICAL] CVE-2026-64859: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation art-15
high Certighost and the Privilege Hiding in Your Certificate Authority art-17
crit [GHSA / CRITICAL] CVE-2026-55158: conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target art-18
high Philips and GE investigating Clop ransomware data theft claims art-22
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access art-23
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
high Microsoft working on Defender patch for ShieldBreak zero-day art-26
crit How QR-code phishing can slip past corporate security measures art-27
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
crit CISA KEV: CVE-2025-62593 — Ray-Project Ray Code Injection Vulnerability art-29
high SafePal data breach impacts 39,798 customers, stolen info for sale art-30
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control art-33
high ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 art-34
crit Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. art-35
crit New Evooo1Bot Linux botnet turns routers into traffic relay nodes art-36
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch art-37
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38
high Top enterprise SCA tools in 2026 art-39
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers art-44
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware art-46
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit art-48
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE art-50
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
high Curiouser and Curiouser art-52
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
med Black Hat USA 2026: Will vulnerability discovery eventually decline in the AI era? art-54
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
high The Model Is the Malware | What Four Agentic Intrusions Tell Defenders art-57
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
crit Dissecting the JWR phishing framework art-60
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
med Control Which Package Registries Your CI Jobs and Developer Machines Use art-65
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One art-66
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning art-69
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside art-70
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws art-71
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access art-72
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations art-73
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code art-74
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access art-75
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS art-76
high The Agent Baseline: 35 Controls, But Where Should You Start? art-77
crit Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack art-78
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client art-80
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands art-81
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit [GHSA / CRITICAL] CVE-2026-73080: SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle art-83
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development art-84
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices art-85
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo art-86
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part art-87
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers art-88
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 art-89
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets art-90
high Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection art-91
crit Kimwolf v7: An Evolution of the Kimwolf Botnet art-92
crit CISA KEV: CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection art-93
crit CISA KEV: CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability art-94
crit CISA KEV: CVE-2026-72898 — Metabase SQL Injection Vulnerability art-95
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications art-96
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise art-97
crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure art-98
crit IT threat evolution in Q2 2026. Non-mobile statistics art-99
high Are AI tutors safe for your kids? art-100
crit Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS art-101
crit [GHSA / CRITICAL] CVE-2026-71851: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chai art-103
crit [GHSA / CRITICAL] CVE-2026-63223: CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules art-104
crit [GHSA / CRITICAL] CVE-2026-63221: CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions art-105
crit [GHSA / CRITICAL] GHSA-wg23-69c2-gjc8: Craft CMS: Passkey login accepts replayed WebAuthn assertions art-106
crit CISA KEV: CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability art-107
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
high Why metaphor may dictate your security strategy art-110
crit [GHSA / CRITICAL] CVE-2026-65600: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware art-111
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit [GHSA / CRITICAL] CVE-2026-71319: Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host art-113
med Who was behind the attack? Possibly nobody art-114
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
crit CISA KEV: CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability art-119
crit ChainDrop supply chain compromise: Anatomy of a self-propagating worm art-120
crit [GHSA / CRITICAL] CVE-2026-70478: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any art-121
crit [GHSA / CRITICAL] CVE-2026-70477: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability art-122
crit 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET art-124
crit [GHSA / CRITICAL] CVE-2026-69264: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without valid art-125
crit [GHSA / CRITICAL] CVE-2026-70470: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE art-126
crit [GHSA / CRITICAL] CVE-2026-69259: Flowise RCE via SQLite Record Manager Node art-127
crit [GHSA / CRITICAL] CVE-2026-69255: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified art-128
crit [GHSA / CRITICAL] CVE-2026-69254: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override art-129
crit [GHSA / CRITICAL] CVE-2026-69251: Flowise RCE via TypeORM DataSource art-130
high The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software art-131
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit How legitimate cloud platforms enable phishers to bypass MFA art-133
high Keyv and friends compromised in active Shai-Hulud supply chain attack art-134
high Evo Continuous Offensive Security Is Here Pentesting Grade Coverage For The 350 Days A Year You Aren't Testing art-136
high A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense art-138
crit Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks art-139
crit CISA KEV: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability art-141
crit CISA KEV: CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability art-142
crit CISA KEV: CVE-2026-9198 — IBM Langflow Code Injection Vulnerability art-143
crit [GHSA / CRITICAL] CVE-2026-69240: Sequelize: SQL Injection (Oracle DB) art-144
crit An analysis of incidents at Brazilian educational institutions art-146
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
high Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It art-148
crit CISA KEV: CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability art-149
crit [GHSA / CRITICAL] CVE-2026-53609: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process- art-150
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit [GHSA / CRITICAL] CVE-2026-52887: NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE art-153
crit [GHSA / CRITICAL] CVE-2026-54725: vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-ser art-154
crit [GHSA / CRITICAL] CVE-2026-52855: Wings exposes node configuration secrets through egg configuration-file templating art-155
crit Anthropic's Fever Dream: Claude's package that stole real keys art-156
crit Network Anomaly Detection in KATA art-159
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
crit [GHSA / CRITICAL] CVE-2025-4318: AWS Amplify Studio UI Component Properties Has an Input Validation Issue art-161
crit Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan art-163
crit [GHSA / CRITICAL] CVE-2026-66066: Active Storage has possible arbitrary file read and remote code execution in Active Storage variant proces art-164
crit You were onto something with “It’s the Climb,” Miley art-165
high ​​​​What’s new in Microsoft Security: July 2026 art-166
crit [GHSA / CRITICAL] CVE-2026-67426: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltr art-167
crit [GHSA / CRITICAL] CVE-2026-67429: Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) art-168
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170
med The Attacker Never Sleeps, Neither Can Your Testing art-173
high Four incident-response decisions from the Hugging Face breach art-175
crit [GHSA / CRITICAL] CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution art-176
crit [GHSA / CRITICAL] CVE-2026-54735: prebid-server's request forgery vulnerability allows for possible host environment data extraction art-177
crit CISA KEV: CVE-2026-20316 — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability art-181
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-182
crit [GHSA / CRITICAL] CVE-2026-54658: @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution art-183
crit [GHSA / CRITICAL] CVE-2026-64863: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite art-184
crit [GHSA / CRITICAL] CVE-2026-62325: goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) art-185
crit [GHSA / CRITICAL] CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construct art-186
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
med The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security art-189
high What Is AI Pentesting and How Does It Work? art-190
crit CISA KEV: CVE-2025-68686 — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability art-191
crit CISA KEV: CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability art-192
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193
crit [GHSA / CRITICAL] CVE-2026-73414: Shescape: Shell injection via unescaped parentheses on Windows with CMD art-194
crit [GHSA / CRITICAL] GHSA-f25v-x6vr-962g: Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password art-195
crit [GHSA / CRITICAL] CVE-2026-73567: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock art-196
crit [GHSA / CRITICAL] CVE-2026-73644: OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check art-197
crit [GHSA / CRITICAL] GHSA-mqhr-6j6h-74p5: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak art-199
crit [GHSA / CRITICAL] CVE-2026-73302: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified art-200
crit [GHSA / CRITICAL] CVE-2026-73300: Budibase: SQL Injection via `multipleStatements: true` art-201
crit [GHSA / CRITICAL] CVE-2026-62379: OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback art-202
crit [GHSA / CRITICAL] CVE-2026-62263: OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass art-203
crit [GHSA / CRITICAL] GHSA-r277-6w6q-xmqw: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Defa art-205
crit [GHSA / CRITICAL] GHSA-w28w-gp39-m4p6: Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Render art-206
crit [GHSA / CRITICAL] CVE-2026-73649: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6p art-207
crit [GHSA / CRITICAL] CVE-2026-59940: seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during d art-208
crit [GHSA / CRITICAL] CVE-2026-59865: Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` art-209
crit [GHSA / CRITICAL] CVE-2026-59864: Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions art-210
crit [GHSA / CRITICAL] GHSA-rjg6-39jm-rgg4: @better-auth/scim: account takeover and stale access via SCIM provider-id collision art-211
crit Don’t swing at everything art-213
crit [GHSA / CRITICAL] CVE-2026-73421: Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated wi art-215
crit [GHSA / CRITICAL] CVE-2026-73420: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypas art-216
crit Russian Global Webmail Espionage art-217
high Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel art-218
high Preview: Cisco Talos at Black Hat USA 2026 art-219
crit [GHSA / CRITICAL] CVE-2026-16723: fastjson has a remote code execution (RCE) vulnerability art-220
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-222
high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-223
high SQL injection isn't dead art-224
high The upgrade trap: when upgrading is the wrong answer to a CVE art-225
crit CISA KEV: CVE-2026-16232 — Check Point SmartConsole Improper Authentication Vulnerability art-226
crit CISA KEV: CVE-2026-50522 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-227
crit [GHSA / CRITICAL] CVE-2026-58443: Gitea: Public-only repository tokens can update private PR head branches art-228
crit [GHSA / CRITICAL] CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task art-229
crit [GHSA / CRITICAL] CVE-2026-20896: Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user vi art-230
crit [GHSA / CRITICAL] CVE-2026-22874: Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter art-231
crit [GHSA / CRITICAL] CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session art-232
crit [GHSA / CRITICAL] CVE-2026-73653: @vitest/browser: Browser Mode provider commands bypass the file-access permission gate art-234
crit [GHSA / CRITICAL] CVE-2026-59891: Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry art-235
crit [GHSA / CRITICAL] CVE-2026-64825: Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding art-236
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters art-237
crit CISA KEV: CVE-2026-60137 — WordPress Core SQL Injection Vulnerability art-238
crit CISA KEV: CVE-2026-0770 — Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability art-239
crit CISA KEV: CVE-2021-27137 — DD-WRT Stack-Based Buffer Overflow Vulnerability art-240
crit [GHSA / CRITICAL] CVE-2026-59873: node-tar: Decompression/parse DoS via unlimited input art-241
crit [GHSA / CRITICAL] CVE-2026-61740: LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status de art-242
crit [GHSA / CRITICAL] CVE-2026-61736: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests art-243
high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-245
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-246
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-247
crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-249
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report art-250
crit [GHSA / CRITICAL] CVE-2026-55579: Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise art-251
crit [GHSA / CRITICAL] CVE-2026-53713: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secr art-252
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
high Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp art-257
high Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners art-258
crit Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories art-259
crit CISA KEV: CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-260
crit CISA KEV: CVE-2026-25089 — Fortinet FortiSandbox OS Command Injection Vulnerability art-261
crit CISA KEV: CVE-2026-39808 — Fortinet FortiSandbox OS Command Injection Vulnerability art-262
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-263
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-265
crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-266
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
crit CISA KEV: CVE-2026-46817 — Oracle E-Business Suite Improper Privilege Management Vulnerability art-268
crit CISA KEV: CVE-2023-4346 — KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulner art-269
crit [GHSA / CRITICAL] GHSA-hgjx-r89m-m7v4: FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file w art-270
crit [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Modu art-271
crit [GHSA / CRITICAL] CVE-2026-54052: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments art-272
crit [GHSA / CRITICAL] CVE-2026-50006: Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTA art-273
crit [GHSA / CRITICAL] CVE-2026-45262: FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesi art-274
high AsyncAPI npm packages backdoored via GitHub Actions art-276
med Forgotten UEFI shims undermining Secure Boot art-277
crit [GHSA / CRITICAL] CVE-2026-52824: Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover art-278
crit CISA KEV: CVE-2026-56155 — Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability art-279
crit CISA KEV: CVE-2026-56164 — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability art-280
crit CISA KEV: CVE-2026-15409 — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability art-281
crit CISA KEV: CVE-2026-15410 — SonicWall SMA1000 Appliances Code Injection Vulnerability art-282
crit [GHSA / CRITICAL] CVE-2026-47677: FacturaScripts: Account takeover of any 2FA-enabled user art-283
high How Aikido Intel detects malware and vulnerabilities first art-284
crit [GHSA / CRITICAL] CVE-2026-61667: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval art-285
crit [GHSA / CRITICAL] CVE-2026-45579: DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input art-286
crit What is a dependency firewall? art-287
crit CISA KEV: CVE-2008-4128 — Cisco IOS Cross-Site Request Forgery Vulnerability art-289
crit jscrambler npm package publishes malicious preinstall binary art-290
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-291
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-292
crit [GHSA / CRITICAL] CVE-2026-61459: mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials art-294
crit [GHSA / CRITICAL] CVE-2026-50551: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content art-295
crit [GHSA / CRITICAL] CVE-2026-54088: File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) art-297
crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-299
crit [GHSA / CRITICAL] CVE-2026-54069: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist art-300
crit [GHSA / CRITICAL] CVE-2026-54072: Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL art-301
crit [GHSA / CRITICAL] CVE-2026-54067: SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() art-302
crit CISA KEV: CVE-2026-56291 — Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability art-303
crit CISA KEV: CVE-2026-48939 — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability art-304
crit [GHSA / CRITICAL] CVE-2026-52778: YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service art-305
crit [GHSA / CRITICAL] CVE-2026-52777: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize art-306
crit [GHSA / CRITICAL] CVE-2026-52766: YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action art-307
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-308
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-309
crit Symlinks Are Still Scary (And Yes, You Can Commit Them to Git) art-311
crit ESET Threat Report H1 2026 art-312
crit CISA KEV: CVE-2026-48908 — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability art-315
crit CISA KEV: CVE-2026-55255 — Langflow Authorization Bypass Through User-Controlled Key Vulnerability art-316
crit CISA KEV: CVE-2026-56290 — Joomlack Page Builder Improper Access Control Vulnerability art-317
crit CISA KEV: CVE-2026-48282 — Adobe ColdFusion Path Traversal Vulnerability art-318
high Predicting MongoDB ObjectId continuously in Rocket.Chat art-319
crit Authentication Bypass in the default configuration phpBB art-320
high Cyber readiness for SMBs: Getting the basics right art-322
high StepSecurity Maintained Actions Are Now Free for Public Repos art-323
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-324
crit Secure Registry now tells you which machine pulled a compromised package art-326
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-327
high Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised art-329
high simonecorsi/mawesome GitHub Action has been compromised art-330
high codfish/semantic-release-action GitHub Action has been compromised art-331
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-332
crit CISA KEV: CVE-2026-45659 — Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability art-334
high Inside the inbox: Why cybercriminals want to break into your email account art-337
med Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? art-338
crit CISA KEV: CVE-2026-48558 — SimpleHelp Authentication Bypass Vulnerability art-339
high npm now freezes high-impact accounts after risky account changes art-340
high Top Koi alternatives in 2026 art-341
med Packagist is now protected by Aikido Intel and other updates to the PHP registry art-343
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high Everybody's shipping code they can't read art-345
med NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence art-346
crit CISA KEV: CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability art-347
crit CISA KEV: CVE-2026-20230 — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability art-348
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-349
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-352
med What nearly 10,000 developer environments reveal about agentic development risk art-354
high When a vendor's breach becomes yours: lessons from the Klue incident art-356
crit CISA KEV: CVE-2025-67038 — Lantronix EDS5000 Code Injection Vulnerability art-357
crit CISA KEV: CVE-2026-34910 — Ubiquiti UniFi OS Improper Input Validation Vulnerability art-358
crit CISA KEV: CVE-2026-34909 — Ubiquiti UniFi OS Path Traversal Vulnerability art-359
crit CISA KEV: CVE-2026-34908 — Ubiquiti UniFi OS Improper Access Control Vulnerability art-360
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-362
high Prevent npm and Python Supply Chain Attacks on Developer Machines with Package Configs art-363
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-364
high The full Snyk AI Security Platform, free for open source maintainers art-367
crit CISA KEV: CVE-2026-20253 — Splunk Enterprise Missing Authentication for Critical Function Vulnerability art-368
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
med From China with tenderness art-371
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high Multiple JetBrains IDE plugins caught stealing AI keys art-374
med FishMonger’s arsenal upgraded: SprySOCKS for Windows art-375
crit CISA KEV: CVE-2026-48907 — Widget Factory Joomla Content Editor Improper Access Control Vulnerability art-376
high EvilTokens: A phishing attack that doesn’t steal your password art-377
med The Government Just Banned an AI Model. An Engineer's Perspective. art-378
crit CISA KEV: CVE-2026-54420 — LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability art-379
crit CISA KEV: CVE-2026-20262 — Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability art-380
med When a Government Pulls an AI Model: What the Fable 5 and Mythos 5 Suspension Means for Security Teams art-381
high 5 Socket security alternatives and why they are better art-383
crit CISA KEV: CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability art-384
high npm v12 delivers one of the biggest security improvements in years art-385
crit OceanLotus: From external espionage to domestic targeting art-388
crit CISA KEV: CVE-2026-10520 — Ivanti Sentry OS Command Injection Vulnerability art-389
high Code is being written everywhere, and the device is the only constant art-390
crit Compromised Rust crate onering performs code exfiltration art-392
high 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums art-394
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-396
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-397
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-398
crit CISA KEV: CVE-2026-11645 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability art-400
crit CISA KEV: CVE-2026-7473 — Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability art-401
crit CISA KEV: CVE-2026-20245 — Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability art-402
crit CISA KEV: CVE-2026-42271 — BerriAI LiteLLM Command Injection Vulnerability art-403
crit CISA KEV: CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability art-404
crit CISA KEV: CVE-2026-28318 — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability art-406
crit Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp art-407
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-408
med Type Level Security: The future of secure AI code generation? art-409
high So You Have an AI Security Budget. Now what? art-410
med The New Security Risks of the Agentic Development Lifecycle art-413
crit CISA KEV: CVE-2026-45247 — Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability art-414
high Why EDR and proxy won’t save you from supply chain malware art-415
high Multiple redhat-cloud-services npm Packages compromised art-416
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-417
high Dev Machine Guard Now Scans Extensions Across Every Modern IDE art-418
high Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection art-421
crit CISA KEV: CVE-2022-0492 — Linux Kernel Improper Authentication Vulnerability art-422
crit CISA KEV: CVE-2025-48595 — Android Framework Integer Overflow Vulnerability art-423
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-425
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-426
crit CISA KEV: CVE-2024-21182 — Oracle WebLogic Server Unspecified Vulnerability art-427
high Fix SCA issues at scale in your terminal with Snyk Remediation Agent in the CLI art-429
med How Relay Network Adopted AI Coding Securely and Built the Foundation for Agentic Development art-430
crit CISA KEV: CVE-2026-0257 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability art-431
high What MDM can't protect on developer machines (and what to do about it) art-432
crit ESET APT Activity Report Q4 2025–Q1 2026 art-433
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
crit CISA KEV: CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability art-439
crit CISA KEV: CVE-2026-45321 — TanStack Unspecified Vulnerability art-440
crit CISA KEV: CVE-2026-8398 — Daemon Tools Lite Embedded Malicious Code Vulnerability art-441
high Why developer machines are now the number one target for supply chain attacks art-442
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-443
crit CISA KEV: CVE-2026-48172 — LiteSpeed cPanel Plugin Privilege Escalation Vulnerability art-444
crit Laravel Lang Supply Chain Advisory art-445
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-447
crit CISA KEV: CVE-2026-9082 — Drupal Core SQL Injection Vulnerability art-450
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-452
crit CISA KEV: CVE-2025-34291 — Langflow Origin Validation Error Vulnerability art-454
crit CISA KEV: CVE-2026-34926 — Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability art-455
high Dev Machine Guard Now Supports Linux art-456
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-457
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-458
crit Webworm: New burrowing techniques art-459
crit CISA KEV: CVE-2008-4250 — Microsoft Windows Buffer Overflow Vulnerability art-461
crit CISA KEV: CVE-2009-1537 — Microsoft DirectX NULL Byte Overwrite Vulnerability art-462
crit CISA KEV: CVE-2009-3459 — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability art-463
crit CISA KEV: CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free Vulnerability art-464
crit CISA KEV: CVE-2010-0806 — Microsoft Internet Explorer Use-After-Free Vulnerability art-465
crit CISA KEV: CVE-2026-41091 — Microsoft Defender Link Following Vulnerability art-466
crit CISA KEV: CVE-2026-45498 — Microsoft Defender Denial of Service Vulnerability art-467
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-468
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-473
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-477
crit CISA KEV: CVE-2026-42897 — Microsoft Exchange Server Cross-Site Scripting Vulnerability art-478
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481
crit CISA KEV: CVE-2026-20182 — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability art-482
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-486
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-488
crit CISA KEV: CVE-2026-42208 — BerriAI LiteLLM SQL Injection Vulnerability art-490
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-492
crit CISA KEV: CVE-2026-6973 — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability art-495
crit CISA KEV: CVE-2026-0300 — Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability art-498
crit Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks art-499
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-501
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-502
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-503
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-504
crit CISA KEV: CVE-2026-31431 — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability art-506
high Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud art-507
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-511
crit CISA KEV: CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability art-512
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-513
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
med Bridging the Gap to Autonomous Fixes: Snyk and Atlassian Unveil Intelligent Remediation for Jira art-516
high Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478) art-517
crit CISA KEV: CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal Vulnerability art-518
crit CISA KEV: CVE-2026-32202 — Microsoft Windows Protection Mechanism Failure Vulnerability art-519
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining art-521
high It's time to treat browser extensions like supply chain attack vectors art-522
crit CISA KEV: CVE-2025-29635 — D-Link DIR-823X Command Injection Vulnerability art-524
crit CISA KEV: CVE-2024-7399 — Samsung MagicINFO 9 Server Path Traversal Vulnerability art-525
crit CISA KEV: CVE-2024-57728 — SimpleHelp Path Traversal Vulnerability art-526
crit CISA KEV: CVE-2024-57726 — SimpleHelp Missing Authorization Vulnerability art-527
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
crit GopherWhisper: A burrow full of malware art-529
med Hardcoding Security into Every Commit: The Future of Snyk Secrets art-530
med JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? art-531
crit CISA KEV: CVE-2026-39987 — Marimo Remote Code Execution Vulnerability art-532
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
crit CISA KEV: CVE-2026-33825 — Microsoft Defender Insufficient Granularity of Access Control Vulnerability art-535
crit New NGate variant hides in a trojanized NFC payment app art-536
crit What the ransom note won’t say art-537
crit CISA KEV: CVE-2026-20122 — Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability art-538
crit CISA KEV: CVE-2026-20133 — Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability art-539
crit CISA KEV: CVE-2025-2749 — Kentico Xperience Path Traversal Vulnerability art-540
crit CISA KEV: CVE-2023-27351 — PaperCut NG/MF Improper Authentication Vulnerability art-541
crit CISA KEV: CVE-2025-48700 — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability art-542
crit CISA KEV: CVE-2026-20128 — Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability art-543
crit CISA KEV: CVE-2025-32975 — Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability art-544
crit CISA KEV: CVE-2024-27199 — JetBrains TeamCity Relative Path Traversal Vulnerability art-545
high Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow art-546
crit CISA KEV: CVE-2026-34197 — Apache ActiveMQ Improper Input Validation Vulnerability art-550
crit CISA KEV: CVE-2009-0238 — Microsoft Office Remote Code Execution art-552
crit CISA KEV: CVE-2026-32201 — Microsoft SharePoint Server Improper Input Validation Vulnerability art-553
crit CISA KEV: CVE-2012-1854 — Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability art-555
crit CISA KEV: CVE-2025-60710 — Microsoft Windows Link Following Vulnerability art-556
crit CISA KEV: CVE-2023-21529 — Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability art-557
crit CISA KEV: CVE-2023-36424 — Microsoft Windows Out-of-Bounds Read Vulnerability art-558
crit CISA KEV: CVE-2020-9715 — Adobe Acrobat Use-After-Free Vulnerability art-559
crit CISA KEV: CVE-2026-21643 — Fortinet FortiClient EMS SQL Injection Vulnerability art-560
crit CISA KEV: CVE-2026-34621 — Adobe Acrobat and Reader Prototype Pollution Vulnerability art-561
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-562
med Governing Security in the Age of Infinite Signal – From Discovery to Control art-565
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-566
high Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack art-567
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
med Dev Machine Guard Is Now Open Source: See What's Really Running on Your Developer Machine art-569
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-571
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-572
crit CISA KEV: CVE-2026-1340 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-573
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-574
crit CISA KEV: CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control Vulnerability art-576
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-577
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-578
high You Patched LiteLLM, But Do You Know Your AI Blast Radius? art-579
crit CISA KEV: CVE-2026-3502 — TrueConf Client Download of Code Without Integrity Check Vulnerability art-580
crit CISA KEV: CVE-2026-5281 — Google Dawn Use-After-Free Vulnerability art-583
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-585
crit CISA KEV: CVE-2026-3055 — Citrix NetScaler Out-of-Bounds Read Vulnerability art-586
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-589
crit CISA KEV: CVE-2025-53521 — F5 BIG-IP Stack-Based Buffer Overflow Vulnerability art-590
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-591
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-592
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-594
high Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised art-595
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-596
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-597
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-598
crit CISA KEV: CVE-2026-33634 — Aquasecurity Trivy Embedded Malicious Code Vulnerability art-600
crit CISA KEV: CVE-2026-33017 — Langflow Code Injection Vulnerability art-603
med Cloud workload security: Mind the gaps art-604
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
crit CISA KEV: CVE-2025-32432 — Craft CMS Code Injection Vulnerability art-608
crit CISA KEV: CVE-2025-54068 — Laravel Livewire Code Injection Vulnerability art-609
crit CISA KEV: CVE-2025-43510 — Apple Multiple Products Improper Locking Vulnerability art-610
crit CISA KEV: CVE-2025-43520 — Apple Multiple Products Classic Buffer Overflow Vulnerability art-611
crit CISA KEV: CVE-2025-31277 — Apple Multiple Products Buffer Overflow Vulnerability art-612
crit EDR killers explained: Beyond the drivers art-613
high AI Is Building Your Attack Surface. Are You Testing It? art-614
crit CISA KEV: CVE-2026-20131 — Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management art-615
crit CISA KEV: CVE-2025-66376 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability art-617
crit CISA KEV: CVE-2026-20963 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-618
med I Read Cursor's Security Agent Prompts, So You Don't Have To art-619
crit Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard art-620
crit CISA KEV: CVE-2025-47813 — Wing FTP Server Information Disclosure Vulnerability art-621
med Face value: What it takes to fool facial recognition art-622
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-623
crit CISA KEV: CVE-2026-3910 — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability art-624
crit CISA KEV: CVE-2026-3909 — Google Skia Out-of-Bounds Write Vulnerability art-625
crit Cyber fallout from the Iran war: What to have on your radar art-626
high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package art-627
crit CISA KEV: CVE-2025-68613 — n8n Improper Control of Dynamically-Managed Code Resources Vulnerability art-628
crit Sednit reloaded: Back in the trenches art-629
crit CISA KEV: CVE-2021-22054 — Omnissa Workspace ONE Server-Side Request Forgery art-630
crit CISA KEV: CVE-2025-26399 — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability art-631
crit CISA KEV: CVE-2026-1603 — Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability art-632
crit How SMBs use threat research and MDR to build a defensive edge art-634
crit CISA KEV: CVE-2017-7921 — Hikvision Multiple Products Improper Authentication Vulnerability art-635
crit CISA KEV: CVE-2021-22681 — Rockwell Multiple Products Insufficient Protected Credentials Vulnerability art-636
crit CISA KEV: CVE-2023-43000 — Apple Multiple products Use-After-Free Vulnerability art-637
crit CISA KEV: CVE-2021-30952 — Apple Multiple Products Integer Overflow or Wraparound Vulnerability art-638
crit CISA KEV: CVE-2023-41974 — Apple iOS and iPadOS Use-After-Free Vulnerability art-639
crit Protecting education: How MDR can tip the balance in favor of schools art-640
med The 89% Problem: How LLMs Are Resurrecting the "Dormant Majority" of Open Source art-641
crit CISA KEV: CVE-2026-22719 — Broadcom VMware Aria Operations Command Injection Vulnerability art-642
crit CISA KEV: CVE-2026-21385 — Qualcomm Multiple Chipsets Memory Corruption Vulnerability art-643
med How StepSecurity Caught a Release Storm in Microsoft’s @types Packages art-644
med Harden Runner Now Supports Windows and macOS GitHub Actions Runners art-645
crit PlugX Meeting Invitation via MSBuild and GDATA art-648
crit CISA KEV: CVE-2022-20775 — Cisco SD-WAN Path Traversal Vulnerability art-649
crit CISA KEV: CVE-2026-20127 — Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability art-650
high The Rise of the AI Security Engineer: A New Discipline for an AI-Native World art-651
crit CISA KEV: CVE-2026-25108 — Soliton Systems K.K FileZen OS Command Injection Vulnerability art-653
high Claude Code Security: A Welcome Evolution in the Remediation Loop art-655
crit CISA KEV: CVE-2025-49113 — RoundCube Webmail Deserialization of Untrusted Data Vulnerability art-657
crit CISA KEV: CVE-2025-68461 — RoundCube Webmail Cross-site Scripting Vulnerability art-658
high How “Clinejection” Turned an AI Bot into a Supply Chain Attack art-661
crit CISA KEV: CVE-2021-22175 — GitLab Server-Side Request Forgery (SSRF) Vulnerability art-663
crit CISA KEV: CVE-2026-22769 — Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability art-664
med Weaving Security into the Flow: New Snyk Studio Capabilities Power the AI Security Fabric art-666
med Securing the Agent Skill Ecosystem: How Snyk and Vercel Are Locking Down the New Software Supply Chain art-667
crit CISA KEV: CVE-2020-7796 — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability art-668
crit CISA KEV: CVE-2024-7694 — TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability art-669
crit CISA KEV: CVE-2008-0015 — Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability art-670
crit CISA KEV: CVE-2026-2441 — Google Chromium CSS Use-After-Free Vulnerability art-671
high 10,000 Open-Source Projects Now Secured by Harden-Runner Community-Tier: A Milestone Three Years in the Making art-672
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
high 2024 in Review: The Evolution of CI/CD Security & What's Next art-674
crit CISA KEV: CVE-2026-1731 — BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability art-677
crit Naming and shaming: How ransomware groups tighten the screws on victims art-678
high Exploitability Isn’t the Answer. Breakability Is. art-679
high The Future of AI Agent Security Is Guardrails art-681
crit CISA KEV: CVE-2026-20700 — Apple Multiple Buffer Overflow Vulnerability art-682
crit CISA KEV: CVE-2024-43468 — Microsoft Configuration Manager SQL Injection Vulnerability art-683
crit CISA KEV: CVE-2025-15556 — Notepad++ Download of Code Without Integrity Check Vulnerability art-684
crit CISA KEV: CVE-2025-40536 — SolarWinds Web Help Desk Security Control Bypass Vulnerability art-685
crit Another npm Supply Chain Attack: The 'is' Package Compromise art-687
high Harden-Runner detection: tj-actions/changed-files action is compromised art-689
high Why Your “Skill Scanner” Is Just False Security (and Maybe Malware) art-694
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-697
crit CISA KEV: CVE-2026-21513 — Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability art-698
crit CISA KEV: CVE-2026-21525 — Microsoft Windows NULL Pointer Dereference Vulnerability art-699
crit CISA KEV: CVE-2026-21510 — Microsoft Windows Shell Protection Mechanism Failure Vulnerability art-700
crit CISA KEV: CVE-2026-21533 — Microsoft Windows Improper Privilege Management Vulnerability art-701
crit CISA KEV: CVE-2026-21519 — Microsoft Windows Type Confusion Vulnerability art-702
crit CISA KEV: CVE-2026-21514 — Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability art-703
high 280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII art-704
crit Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise art-705
crit CISA KEV: CVE-2025-11953 — React Native Community CLI OS Command Injection Vulnerability art-706
crit CISA KEV: CVE-2026-24423 — SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability art-707
high The Prescriptive Path to Operationalizing AI Security art-709
crit CISA KEV: CVE-2021-39935 — GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability art-710
crit CISA KEV: CVE-2025-64328 — Sangoma FreePBX OS Command Injection Vulnerability art-711
crit CISA KEV: CVE-2019-19006 — Sangoma FreePBX Improper Authentication Vulnerability art-712
crit CISA KEV: CVE-2025-40551 — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability art-713
med Snyk Advisor is Reshaping Package Intelligence on Snyk Security Database art-715
crit DynoWiper update: Technical analysis and attribution art-717
crit CISA KEV: CVE-2026-1281 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-718
crit CISA KEV: CVE-2026-24858 — Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability art-722
crit CISA KEV: CVE-2018-14634 — Linux Kernel Integer Overflow Vulnerability art-723
crit CISA KEV: CVE-2025-52691 — SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability art-724
crit CISA KEV: CVE-2026-23760 — SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability art-725
crit CISA KEV: CVE-2026-24061 — GNU InetUtils Argument Injection Vulnerability art-726
crit CISA KEV: CVE-2026-21509 — Microsoft Office Security Feature Bypass Vulnerability art-727
high ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 art-728
crit CISA KEV: CVE-2024-37079 — Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability art-730
crit CISA KEV: CVE-2025-68645 — Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability art-732
crit CISA KEV: CVE-2025-34026 — Versa Concerto Improper Authentication Vulnerability art-733
crit CISA KEV: CVE-2025-31125 — Vite Vitejs Improper Access Control Vulnerability art-734
crit CISA KEV: CVE-2025-54313 — Prettier eslint-config-prettier Embedded Malicious Code Vulnerability art-735
crit CISA KEV: CVE-2026-20045 — Cisco Unified Communications Products Code Injection Vulnerability art-736
high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations art-741
crit CISA KEV: CVE-2026-20805 — Microsoft Windows Information Disclosure Vulnerability art-743
crit CISA KEV: CVE-2025-8110 — Gogs Path Traversal Vulnerability art-744
high Beyond Detection: Building a Resilient Software Supply Chain (Lessons from the Shai-Hulud Post-Mortem) art-746
high Secure by Default: Why Snyk and Augment Code are the New Standard for AI Development art-747
crit CISA KEV: CVE-2009-0556 — Microsoft Office PowerPoint Code Injection Vulnerability art-748
crit CISA KEV: CVE-2025-37164 — Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability art-749
high The Holiday Whisper: Shai-Hulud 3.0 art-751
crit CISA KEV: CVE-2025-14847 — MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability art-752
high Revisiting CVE-2025-50165: A critical flaw in Windows Imaging Component art-754
crit CISA KEV: CVE-2023-52163 — Digiever DS-2105 Pro Missing Authorization Vulnerability art-755
high Evo Adds CycloneDX Support to Give Full AI Visibility art-756
crit CISA KEV: CVE-2025-14733 — WatchGuard Firebox Out of Bounds Write Vulnerability art-757
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
crit CISA KEV: CVE-2025-59374 — ASUS Live Update Embedded Malicious Code Vulnerability art-759
crit CISA KEV: CVE-2025-40602 — SonicWall SMA1000 Missing Authorization Vulnerability art-760
crit CISA KEV: CVE-2025-20393 — Cisco Multiple Products Improper Input Validation Vulnerability art-761
crit CISA KEV: CVE-2025-59718 — Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability art-764
crit CISA KEV: CVE-2025-14611 — Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability art-765
crit CISA KEV: CVE-2025-43529 — Apple Multiple Products Use-After-Free WebKit Vulnerability art-766
crit CISA KEV: CVE-2018-4063 — Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability art-768
crit CISA KEV: CVE-2025-14174 — Google Chromium Out of Bounds Memory Access Vulnerability art-769
high Black Hat Europe 2025: Reputation matters – even in the ransomware economy art-770
med Locks, SOCs and a cat in a box: What Schrödinger can teach us about cybersecurity art-771
crit CISA KEV: CVE-2025-58360 — OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability art-772
med How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science art-775
crit CISA KEV: CVE-2025-6218 — RARLAB WinRAR Path Traversal Vulnerability art-776
crit CISA KEV: CVE-2025-62221 — Microsoft Windows Use After Free Vulnerability art-777
crit CISA KEV: CVE-2022-37055 — D-Link Routers Buffer Overflow Vulnerability art-778
crit CISA KEV: CVE-2025-66644 — Array Networks ArrayOS AG OS Command Injection Vulnerability art-779
crit CISA KEV: CVE-2025-55182 — Meta React Server Components Remote Code Execution Vulnerability art-780
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-782
med Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers art-784
crit CISA KEV: CVE-2021-26828 — OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability art-785
crit CISA KEV: CVE-2025-48633 — Android Framework Information Disclosure Vulnerability art-787
crit CISA KEV: CVE-2025-48572 — Android Framework Privilege Escalation Vulnerability art-788
crit CISA KEV: CVE-2021-26829 — OpenPLC ScadaBR Cross-site Scripting Vulnerability art-792
high Snyk Log Sniffer: AI-Powered Audit Log Insights for Security Leaders art-794
high SHA1-Hulud, npm supply chain incident art-796
crit CISA KEV: CVE-2025-61757 — Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability art-800
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803
crit CISA KEV: CVE-2025-13223 — Google Chromium V8 Type Confusion Vulnerability art-806
crit CISA KEV: CVE-2025-58034 — Fortinet FortiWeb OS Command Injection Vulnerability art-808
crit CISA KEV: CVE-2025-64446 — Fortinet FortiWeb Path Traversal Vulnerability art-809
high Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam art-810
crit CISA KEV: CVE-2025-12480 — Gladinet Triofox Improper Access Control Vulnerability art-812
crit CISA KEV: CVE-2025-62215 — Microsoft Windows Race Condition Vulnerability art-813
crit CISA KEV: CVE-2025-9242 — WatchGuard Firebox Out-of-Bounds Write Vulnerability art-814
high Secure by Design: The Future of Threat Modeling for AI-Native Applications art-815
crit CISA KEV: CVE-2025-21042 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-817
crit CISA KEV: CVE-2025-48703 — CWP Control Web Panel OS Command Injection Vulnerability art-821
crit CISA KEV: CVE-2025-11371 — Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability art-822
crit CISA KEV: CVE-2025-41244 — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability art-823
crit CISA KEV: CVE-2025-24893 — XWiki Platform Eval Injection Vulnerability art-824
crit CISA KEV: CVE-2025-6204 — Dassault Systèmes DELMIA Apriso Code Injection Vulnerability art-825
crit CISA KEV: CVE-2025-6205 — Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability art-826
crit CISA KEV: CVE-2025-54236 — Adobe Commerce and Magento Improper Input Validation Vulnerability art-827
crit CISA KEV: CVE-2025-59287 — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability art-828
med Why We Built Evo — From My Heart art-830
crit CISA KEV: CVE-2025-61932 — Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability art-831
crit CISA KEV: CVE-2022-48503 — Apple Multiple Products Unspecified Vulnerability art-832
crit CISA KEV: CVE-2025-2746 — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability art-833
crit CISA KEV: CVE-2025-2747 — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability art-834
crit CISA KEV: CVE-2025-33073 — Microsoft Windows SMB Client Improper Access Control Vulnerability art-835
crit CISA KEV: CVE-2025-61884 — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability art-836
med Snyk and Cognition partner to enhance security for AI-native development art-838
crit CISA KEV: CVE-2025-54253 — Adobe Experience Manager Forms Code Execution Vulnerability art-839
crit CISA KEV: CVE-2025-47827 — IGEL OS Use of a Key Past its Expiration Date Vulnerability art-842
crit CISA KEV: CVE-2025-24990 — Microsoft Windows Untrusted Pointer Dereference Vulnerability art-843
crit CISA KEV: CVE-2025-59230 — Microsoft Windows Improper Access Control Vulnerability art-844
crit CISA KEV: CVE-2016-7836 — SKYSEA Client View Improper Authentication Vulnerability art-845
crit Phishing Campaign Leveraging the NPM Ecosystem art-846
crit CISA KEV: CVE-2021-43798 — Grafana Path Traversal Vulnerability art-847
crit CISA KEV: CVE-2025-27915 — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability art-848
crit CISA KEV: CVE-2021-22555 — Linux Kernel Heap Out-of-Bounds Write Vulnerability art-849
crit CISA KEV: CVE-2010-3962 — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability art-850
crit CISA KEV: CVE-2021-43226 — Microsoft Windows Privilege Escalation Vulnerability art-851
crit CISA KEV: CVE-2013-3918 — Microsoft Windows Out-of-Bounds Write Vulnerability art-852
crit CISA KEV: CVE-2011-3402 — Microsoft Windows Remote Code Execution Vulnerability art-853
crit CISA KEV: CVE-2010-3765 — Mozilla Multiple Products Remote Code Execution Vulnerability art-854
crit CISA KEV: CVE-2025-61882 — Oracle E-Business Suite Unspecified Vulnerability art-855
crit CISA KEV: CVE-2014-6278 — GNU Bash OS Command Injection Vulnerability art-856
crit CISA KEV: CVE-2017-1000353 — Jenkins Remote Code Execution Vulnerability art-857
crit CISA KEV: CVE-2015-7755 — Juniper ScreenOS Improper Authentication Vulnerability art-858
crit CISA KEV: CVE-2025-21043 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-859
crit CISA KEV: CVE-2025-4008 — Smartbedded Meteobridge Command Injection Vulnerability art-860
crit CISA KEV: CVE-2025-32463 — Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability art-862
crit CISA KEV: CVE-2025-59689 — Libraesva Email Security Gateway Command Injection Vulnerability art-863
crit CISA KEV: CVE-2025-10035 — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability art-864
crit CISA KEV: CVE-2025-20352 — Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability art-865
crit CISA KEV: CVE-2021-21311 — Adminer Server-Side Request Forgery Vulnerability art-866
high Malicious MCP Server on npm postmark-mcp Harvests Emails art-867
crit CISA KEV: CVE-2025-20362 — Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authoriz art-868
crit CISA KEV: CVE-2025-10585 — Google Chromium V8 Type Confusion Vulnerability art-870
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-875
crit CISA KEV: CVE-2025-5086 — Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability art-876
high npm Supply Chain Attack via Open Source maintainer compromise art-878
crit CISA KEV: CVE-2025-38352 — Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability art-880
crit CISA KEV: CVE-2025-48543 — Android Runtime Use-After-Free Vulnerability art-881
crit CISA KEV: CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability art-882
crit CISA KEV: CVE-2023-50224 — TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability art-883
crit CISA KEV: CVE-2025-9377 — TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability art-884
crit CISA KEV: CVE-2020-24363 — TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability art-885
crit CISA KEV: CVE-2025-55177 — Meta Platforms WhatsApp Incorrect Authorization Vulnerability art-886
crit CISA KEV: CVE-2025-57819 — Sangoma FreePBX Authentication Bypass Vulnerability art-887
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-888
crit CISA KEV: CVE-2025-7775 — Citrix NetScaler Memory Overflow Vulnerability art-889
crit CISA KEV: CVE-2025-48384 — Git Link Following Vulnerability art-890
crit CISA KEV: CVE-2024-8068 — Citrix Session Recording Improper Privilege Management Vulnerability art-891
crit CISA KEV: CVE-2024-8069 — Citrix Session Recording Deserialization of Untrusted Data Vulnerability art-892
crit CISA KEV: CVE-2025-43300 — Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability art-893
crit CISA KEV: CVE-2025-54948 — Trend Micro Apex One OS Command Injection Vulnerability art-895
crit CISA KEV: CVE-2025-8876 — N-able N-Central Command Injection Vulnerability art-898
crit CISA KEV: CVE-2025-8875 — N-able N-Central Insecure Deserialization Vulnerability art-899
crit CISA KEV: CVE-2025-8088 — RARLAB WinRAR Path Traversal Vulnerability art-900
crit CISA KEV: CVE-2007-0671 — Microsoft Office Excel Remote Code Execution Vulnerability art-901
crit CISA KEV: CVE-2013-3893 — Microsoft Internet Explorer Resource Management Errors Vulnerability art-902
med Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk art-903
high Snyk Joins CISA's Secure by Design Pledge art-906
crit CISA KEV: CVE-2020-25078 — D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability art-908
crit CISA KEV: CVE-2020-25079 — D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability art-909
crit CISA KEV: CVE-2022-40799 — D-Link DNR-322L Download of Code Without Integrity Check Vulnerability art-910
high Secure at Inception: Introducing New Tools for Securing AI-Native Development art-911
crit CISA KEV: CVE-2023-2533 — PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability art-914
crit CISA KEV: CVE-2025-20337 — Cisco Identity Services Engine Injection Vulnerability art-915
crit CISA KEV: CVE-2025-20281 — Cisco Identity Services Engine Injection Vulnerability art-916
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-917
crit CISA KEV: CVE-2025-2775 — SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability art-918
crit CISA KEV: CVE-2025-2776 — SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability art-919
crit CISA KEV: CVE-2025-6558 — Google Chromium ANGLE and GPU Improper Input Validation Vulnerability art-920
crit CISA KEV: CVE-2025-54309 — CrushFTP Unprotected Alternate Channel Vulnerability art-921
crit CISA KEV: CVE-2025-49704 — Microsoft SharePoint Code Injection Vulnerability art-922
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-924
crit CISA KEV: CVE-2025-53770 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-925
crit CISA KEV: CVE-2025-25257 — Fortinet FortiWeb SQL Injection Vulnerability art-926
crit CISA KEV: CVE-2025-47812 — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability art-927
crit CISA KEV: CVE-2025-5777 — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability art-928
crit CISA KEV: CVE-2019-9621 — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability art-929
crit CISA KEV: CVE-2019-5418 — Rails Ruby on Rails Path Traversal Vulnerability art-930
crit CISA KEV: CVE-2016-10033 — PHPMailer Command Injection Vulnerability art-931
crit CISA KEV: CVE-2014-3931 — Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability art-932
crit CISA KEV: CVE-2025-6554 — Google Chromium V8 Type Confusion Vulnerability art-933
crit CISA KEV: CVE-2025-48928 — TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability art-935
crit CISA KEV: CVE-2025-48927 — TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability art-936
crit CISA KEV: CVE-2025-6543 — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability art-938
med Understanding CRA Compliance: Overcoming Challenges with an Integrated Security Testing Approach art-939
crit CISA KEV: CVE-2019-6693 — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability art-940
crit CISA KEV: CVE-2024-0769 — D-Link DIR-859 Router Path Traversal Vulnerability art-941
crit CISA KEV: CVE-2024-54085 — AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability art-942
crit CISA KEV: CVE-2023-0386 — Linux Kernel Improper Ownership Management Vulnerability art-947
crit CISA KEV: CVE-2023-33538 — TP-Link Multiple Routers Command Injection Vulnerability art-948
crit CISA KEV: CVE-2025-43200 — Apple Multiple Products Unspecified Vulnerability art-949
med Why ANZ Technology Leaders Are Rethinking How AI, Speed, and Security Intersect art-950
high Finding Software Flaws Early in the Development Process Provides Clear ROI art-951
crit CISA KEV: CVE-2025-33053 — Microsoft Windows External Control of File Name or Path Vulnerability art-954
crit CISA KEV: CVE-2025-24016 — Wazuh Server Deserialization of Untrusted Data Vulnerability art-955
crit CISA KEV: CVE-2024-42009 — RoundCube Webmail Cross-Site Scripting Vulnerability art-956
crit CISA KEV: CVE-2025-32433 — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability art-957
crit CISA KEV: CVE-2025-5419 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability art-960
crit CISA KEV: CVE-2025-21479 — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability art-963
crit CISA KEV: CVE-2025-21480 — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability art-964
crit CISA KEV: CVE-2025-27038 — Qualcomm Multiple Chipsets Use-After-Free Vulnerability art-965
crit CISA KEV: CVE-2021-32030 — ASUS Routers Improper Authentication Vulnerability art-967
crit CISA KEV: CVE-2025-3935 — ConnectWise ScreenConnect Improper Authentication Vulnerability art-968
crit CISA KEV: CVE-2025-35939 — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability art-969
crit CISA KEV: CVE-2024-56145 — Craft CMS Code Injection Vulnerability art-970
crit CISA KEV: CVE-2023-39780 — ASUS RT-AX55 Routers OS Command Injection Vulnerability art-971
med Snyk Report shows 88% of CISOs are concerned with current state of U.S. cyber readiness art-977
crit CISA KEV: CVE-2025-4632 — Samsung MagicINFO 9 Server Path Traversal Vulnerability art-978
med Security Testing for Single-Page Applications (SPAs) art-979
crit CISA KEV: CVE-2023-38950 — ZKTeco BioTime Path Traversal Vulnerability art-980
crit CISA KEV: CVE-2024-27443 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-981
crit CISA KEV: CVE-2025-27920 — Srimax Output Messenger Directory Traversal Vulnerability art-982
crit CISA KEV: CVE-2024-11182 — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability art-983
crit CISA KEV: CVE-2025-4428 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-984
crit CISA KEV: CVE-2025-4427 — Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability art-985
crit CISA KEV: CVE-2025-42999 — SAP NetWeaver Deserialization Vulnerability art-986
crit CISA KEV: CVE-2024-12987 — DrayTek Vigor Routers OS Command Injection Vulnerability art-987
crit CISA KEV: CVE-2025-32756 — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability art-988
crit CISA KEV: CVE-2025-32709 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability art-989
crit CISA KEV: CVE-2025-30397 — Microsoft Windows Scripting Engine Type Confusion Vulnerability art-990
crit CISA KEV: CVE-2025-32706 — Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability art-991
crit CISA KEV: CVE-2025-32701 — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability art-992
crit CISA KEV: CVE-2025-30400 — Microsoft Windows DWM Core Library Use-After-Free Vulnerability art-993
crit CISA KEV: CVE-2025-47729 — TeleMessage TM SGNL Hidden Functionality Vulnerability art-995
crit CISA KEV: CVE-2024-11120 — GeoVision Devices OS Command Injection Vulnerability art-997
crit CISA KEV: CVE-2024-6047 — GeoVision Devices OS Command Injection Vulnerability art-998
crit CISA KEV: CVE-2025-27363 — FreeType Out-of-Bounds Write Vulnerability art-999
med Learn About Open Source Security Risks With the New Snyk Learn Learning Path art-1000
crit CISA KEV: CVE-2025-3248 — Langflow Missing Authentication Vulnerability art-1001
crit CISA KEV: CVE-2025-34028 — Commvault Command Center Path Traversal Vulnerability art-1002
crit CISA KEV: CVE-2024-58136 — Yiiframework Yii Improper Protection of Alternate Path Vulnerability art-1003
med Secure AI-Generated Code at Speed with Snyk and ServiceNow art-1004
crit CISA KEV: CVE-2024-38475 — Apache HTTP Server Improper Escaping of Output Vulnerability art-1005
crit CISA KEV: CVE-2023-44221 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-1006
crit CISA KEV: CVE-2025-31324 — SAP NetWeaver Unrestricted File Upload Vulnerability art-1007
crit CISA KEV: CVE-2025-1976 — Broadcom Brocade Fabric OS Code Injection Vulnerability art-1009
crit CISA KEV: CVE-2025-42599 — Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability art-1010
crit CISA KEV: CVE-2025-3928 — Commvault Web Server Unspecified Vulnerability art-1011
crit CISA KEV: CVE-2025-24054 — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability art-1013
crit CISA KEV: CVE-2025-31201 — Apple Multiple Products Arbitrary Read and Write Vulnerability art-1014
crit CISA KEV: CVE-2025-31200 — Apple Multiple Products Memory Corruption Vulnerability art-1015
crit CISA KEV: CVE-2021-20035 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-1017
crit CISA KEV: CVE-2024-53150 — Linux Kernel Out-of-Bounds Read Vulnerability art-1019
crit CISA KEV: CVE-2024-53197 — Linux Kernel Out-of-Bounds Access Vulnerability art-1020
crit CISA KEV: CVE-2025-29824 — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability art-1021
crit CISA KEV: CVE-2025-30406 — Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability art-1022
crit CISA KEV: CVE-2025-31161 — CrushFTP Authentication Bypass Vulnerability art-1023
crit CISA KEV: CVE-2025-22457 — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability art-1024
crit CISA KEV: CVE-2025-24813 — Apache Tomcat Path Equivalence Vulnerability art-1027
crit CISA KEV: CVE-2024-20439 — Cisco Smart Licensing Utility Static Credential Vulnerability art-1028
crit CISA KEV: CVE-2025-2783 — Google Chromium Mojo Sandbox Escape Vulnerability art-1030
crit CISA KEV: CVE-2019-9875 — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability art-1031
crit CISA KEV: CVE-2019-9874 — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability art-1032
crit CISA KEV: CVE-2025-30154 — reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability art-1033
high CVE-2025-29927 Authorization Bypass in Next.js Middleware art-1034
crit CISA KEV: CVE-2017-12637 — SAP NetWeaver Directory Traversal Vulnerability art-1036
crit CISA KEV: CVE-2024-48248 — NAKIVO Backup and Replication Absolute Path Traversal Vulnerability art-1037
crit CISA KEV: CVE-2025-1316 — Edimax IC-7100 IP Camera OS Command Injection Vulnerability art-1038
med Unburdening Developers From Vulnerability Fatigue with Snyk Delta Findings art-1040
crit CISA KEV: CVE-2025-30066 — tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability art-1041
crit CISA KEV: CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1042
crit Reconstructing the TJ Actions Changed Files GitHub Actions Compromise art-1043
crit CISA KEV: CVE-2025-21590 — Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability art-1046
crit CISA KEV: CVE-2025-24201 — Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability art-1047
high Snyk Helps Secure the Golang Bento Project art-1048
crit CISA KEV: CVE-2025-24993 — Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability art-1052
crit CISA KEV: CVE-2025-24991 — Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability art-1053
crit CISA KEV: CVE-2025-24985 — Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability art-1054
crit CISA KEV: CVE-2025-24984 — Microsoft Windows NTFS Information Disclosure Vulnerability art-1055
crit CISA KEV: CVE-2025-24983 — Microsoft Windows Win32k Use-After-Free Vulnerability art-1056
crit CISA KEV: CVE-2025-26633 — Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability art-1057
crit CISA KEV: CVE-2024-13161 — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability art-1058
crit CISA KEV: CVE-2024-13160 — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability art-1059
crit CISA KEV: CVE-2024-13159 — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability art-1060
crit CISA KEV: CVE-2024-57968 — Advantive VeraCore Unrestricted File Upload Vulnerability art-1061
crit CISA KEV: CVE-2025-25181 — Advantive VeraCore SQL Injection Vulnerability art-1062
med Can Snyk Detect JWT Security Issues? art-1065
crit CISA KEV: CVE-2025-22226 — VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability art-1066
crit CISA KEV: CVE-2025-22225 — VMware ESXi Arbitrary Write Vulnerability art-1067
crit CISA KEV: CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability art-1068
crit CISA KEV: CVE-2024-50302 — Linux Kernel Use of Uninitialized Resource Vulnerability art-1069
crit CISA KEV: CVE-2024-4885 — Progress WhatsUp Gold Path Traversal Vulnerability art-1070
crit CISA KEV: CVE-2018-8639 — Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability art-1071
crit CISA KEV: CVE-2022-43769 — Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability art-1072
crit CISA KEV: CVE-2022-43939 — Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability art-1073
crit CISA KEV: CVE-2023-20118 — Cisco Small Business RV Series Routers Command Injection Vulnerability art-1074
med Solving Security Challenges with Snyk Code and Symbolic AI art-1075
crit CISA KEV: CVE-2023-34192 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-1079
crit CISA KEV: CVE-2024-49035 — Microsoft Partner Center Improper Access Control Vulnerability art-1080
crit CISA KEV: CVE-2024-20953 — Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability art-1081
crit CISA KEV: CVE-2017-3066 — Adobe ColdFusion Deserialization Vulnerability art-1082
crit CISA KEV: CVE-2025-24989 — Microsoft Power Pages Improper Access Control Vulnerability art-1083
crit Snyk’s Fetch the Flag CTF is More Than Just a CTF art-1084
crit CISA KEV: CVE-2025-0111 — Palo Alto Networks PAN-OS File Read Vulnerability art-1085
crit CISA KEV: CVE-2025-23209 — Craft CMS Code Injection Vulnerability art-1086
crit CISA KEV: CVE-2025-0108 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability art-1087
crit CISA KEV: CVE-2024-53704 — SonicWall SonicOS SSLVPN Improper Authentication Vulnerability art-1088
crit CISA KEV: CVE-2024-57727 — SimpleHelp Path Traversal Vulnerability art-1089
crit Do not pass GO - Malicious Package Alert art-1090
crit CISA KEV: CVE-2025-24200 — Apple iOS and iPadOS Incorrect Authorization Vulnerability art-1091
crit CISA KEV: CVE-2024-41710 — Mitel SIP Phones Argument Injection Vulnerability art-1092
crit CISA KEV: CVE-2024-40891 — Zyxel DSL CPE OS Command Injection Vulnerability art-1093
crit CISA KEV: CVE-2024-40890 — Zyxel DSL CPE OS Command Injection Vulnerability art-1094
crit CISA KEV: CVE-2025-21418 — Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability art-1095
crit CISA KEV: CVE-2025-21391 — Microsoft Windows Storage Link Following Vulnerability art-1096
crit CISA KEV: CVE-2025-0994 — Trimble Cityworks Deserialization Vulnerability art-1097
med Consolidate Security Findings with Snyk and Google Security Command Center art-1098
crit CISA KEV: CVE-2020-15069 — Sophos XG Firewall Buffer Overflow Vulnerability art-1099
crit CISA KEV: CVE-2020-29574 — CyberoamOS (CROS) SQL Injection Vulnerability art-1100
crit CISA KEV: CVE-2024-21413 — Microsoft Outlook Improper Input Validation Vulnerability art-1101
crit CISA KEV: CVE-2022-23748 — Dante Discovery Process Control Vulnerability art-1102
crit CISA KEV: CVE-2025-0411 — 7-Zip Mark of the Web Bypass Vulnerability art-1103
med Creating SBOMs with the Snyk CLI art-1104
crit CISA KEV: CVE-2024-53104 — Linux Kernel Out-of-Bounds Write Vulnerability art-1105
crit CISA KEV: CVE-2018-19410 — Paessler PRTG Network Monitor Local File Inclusion Vulnerability art-1107
crit CISA KEV: CVE-2018-9276 — Paessler PRTG Network Monitor OS Command Injection Vulnerability art-1108
crit CISA KEV: CVE-2024-29059 — Microsoft .NET Framework Information Disclosure Vulnerability art-1109
crit CISA KEV: CVE-2024-45195 — Apache OFBiz Forced Browsing Vulnerability art-1110
crit CISA KEV: CVE-2025-24085 — Apple Multiple Products Use-After-Free Vulnerability art-1111
crit CISA KEV: CVE-2025-23006 — SonicWall SMA1000 Appliances Deserialization Vulnerability art-1112
crit CISA KEV: CVE-2020-11023 — JQuery Cross-Site Scripting (XSS) Vulnerability art-1115
med Understanding the EU’s Cyber Resilience Act (CRA) art-1116
crit CISA KEV: CVE-2024-50603 — Aviatrix Controllers OS Command Injection Vulnerability art-1118
crit CISA KEV: CVE-2025-21335 — Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability art-1122
crit CISA KEV: CVE-2025-21334 — Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability art-1123
crit CISA KEV: CVE-2025-21333 — Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability art-1124
crit CISA KEV: CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1125
crit CISA KEV: CVE-2023-48365 — Qlik Sense HTTP Tunneling Vulnerability art-1126
crit CISA KEV: CVE-2024-12686 — BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability art-1127
med Securing GenAI Development with Snyk art-1128
crit CISA KEV: CVE-2025-0282 — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability art-1130
crit CISA KEV: CVE-2020-2883 — Oracle WebLogic Server Unspecified Vulnerability art-1131
crit CISA KEV: CVE-2024-55550 — Mitel MiCollab Path Traversal Vulnerability art-1132
crit CISA KEV: CVE-2024-3393 — Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability art-1135
med Did You Make the *Security* Naughty or Nice List This Year? art-1136
crit CISA KEV: CVE-2021-44207 — Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability art-1137
crit CISA KEV: CVE-2024-12356 — BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability art-1138
crit CISA KEV: CVE-2021-40407 — Reolink RLC-410W IP Camera OS Command Injection Vulnerability art-1140
crit CISA KEV: CVE-2019-11001 — Reolink Multiple IP Cameras OS Command Injection Vulnerability art-1141
crit CISA KEV: CVE-2022-23227 — NUUO NVRmini2 Devices Missing Authentication Vulnerability art-1142
crit CISA KEV: CVE-2018-14933 — NUUO NVRmini Devices OS Command Injection Vulnerability art-1143
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1144
crit CISA KEV: CVE-2024-35250 — Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability art-1145
crit CISA KEV: CVE-2024-20767 — Adobe ColdFusion Improper Access Control Vulnerability art-1146
crit CISA KEV: CVE-2024-50623 — Cleo Multiple Products Unrestricted File Upload Vulnerability art-1147
high Snyk’s risk-based approach to prioritization art-1148
high Ultralytics AI Pwn Request Supply Chain Attack art-1149
crit CISA KEV: CVE-2024-49138 — Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability art-1151
med Snyk-Generated SBOMs Now Include License Details for the Open Source Libraries in Your Projects art-1152
crit CISA KEV: CVE-2024-51378 — CyberPanel Incorrect Default Permissions Vulnerability art-1153
med 2024 Open Source Security Report: Slowing Progress and New Challenges for DevSecOps art-1155
crit CISA KEV: CVE-2024-11667 — Zyxel Multiple Firewalls Path Traversal Vulnerability art-1156
crit CISA KEV: CVE-2024-11680 — ProjectSend Improper Authentication Vulnerability art-1157
crit CISA KEV: CVE-2023-45727 — North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability art-1158
med Why a solid DevOps foundation is vital for effective DevSecOps art-1159
med Empowering women in security: The impact of mentorship art-1160
crit CISA KEV: CVE-2023-28461 — Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability art-1162
crit CISA KEV: CVE-2024-21287 — Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability art-1164
crit CISA KEV: CVE-2024-44309 — Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability art-1165
crit CISA KEV: CVE-2024-44308 — Apple Multiple Products Code Execution Vulnerability art-1166
crit CISA KEV: CVE-2024-38813 — VMware vCenter Server Privilege Escalation Vulnerability art-1167
crit CISA KEV: CVE-2024-38812 — VMware vCenter Server Heap-Based Buffer Overflow Vulnerability art-1168
crit CISA KEV: CVE-2024-9474 — Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability art-1171
crit CISA KEV: CVE-2024-0012 — Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability art-1172
crit CISA KEV: CVE-2024-1212 — Progress Kemp LoadMaster OS Command Injection Vulnerability art-1173
high Understanding command injection vulnerabilities in Go art-1174
crit CISA KEV: CVE-2024-9465 — Palo Alto Networks Expedition SQL Injection Vulnerability art-1175
crit CISA KEV: CVE-2024-9463 — Palo Alto Networks Expedition OS Command Injection Vulnerability art-1176
med How ASPM boosts visibility to manage application risk art-1178
crit CISA KEV: CVE-2021-26086 — Atlassian Jira Server and Data Center Path Traversal Vulnerability art-1180
crit CISA KEV: CVE-2014-2120 — Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability art-1181
crit CISA KEV: CVE-2021-41277 — Metabase GeoJSON API Local File Inclusion Vulnerability art-1182
crit CISA KEV: CVE-2024-43451 — Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability art-1183
crit CISA KEV: CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability art-1184
crit CISA KEV: CVE-2019-16278 — Nostromo nhttpd Directory Traversal Vulnerability art-1185
crit CISA KEV: CVE-2024-51567 — CyberPanel Incorrect Default Permissions Vulnerability art-1186
crit CISA KEV: CVE-2024-43093 — Android Framework Privilege Escalation Vulnerability art-1187
crit CISA KEV: CVE-2024-5910 — Palo Alto Networks Expedition Missing Authentication Vulnerability art-1188
crit CISA KEV: CVE-2024-8956 — PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability art-1189
high Lottie Player npm package compromised for crypto wallet theft art-1191
crit CISA KEV: CVE-2024-37383 — RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability art-1195
crit CISA KEV: CVE-2024-20481 — Cisco ASA and FTD Denial-of-Service Vulnerability art-1196
crit CISA KEV: CVE-2024-47575 — Fortinet FortiManager Missing Authentication Vulnerability art-1198
crit CISA KEV: CVE-2024-38094 — Microsoft SharePoint Deserialization Vulnerability art-1201
crit CISA KEV: CVE-2024-9537 — ScienceLogic SL1 Unspecified Vulnerability art-1202
crit CISA KEV: CVE-2024-40711 — Veeam Backup and Replication Deserialization Vulnerability art-1206
crit CISA KEV: CVE-2024-28987 — SolarWinds Web Help Desk Hardcoded Credential Vulnerability art-1208
crit CISA KEV: CVE-2024-9680 — Mozilla Firefox Use-After-Free Vulnerability art-1209
crit CISA KEV: CVE-2024-30088 — Microsoft Windows Kernel TOCTOU Race Condition Vulnerability art-1210
med Foundations of trust: Securing the future of AI-generated code art-1212
crit CISA KEV: CVE-2024-9380 — Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability art-1214
crit CISA KEV: CVE-2024-9379 — Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability art-1215
crit CISA KEV: CVE-2024-23113 — Fortinet Multiple Products Format String Vulnerability art-1216
crit CISA KEV: CVE-2024-43573 — Microsoft Windows MSHTML Platform Spoofing Vulnerability art-1218
crit CISA KEV: CVE-2024-43572 — Microsoft Windows Management Console Remote Code Execution Vulnerability art-1219
crit CISA KEV: CVE-2024-43047 — Qualcomm Multiple Chipsets Use-After-Free Vulnerability art-1220
high The mysterious supply chain concern of string-width-cjs npm package art-1221
crit CISA KEV: CVE-2024-45519 — Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability art-1222
med Proactive AppSec continuous vulnerability management for developers and security teams art-1224
crit CISA KEV: CVE-2024-29824 — Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability art-1225
med Going beyond reachability to prioritize what matters most art-1226
crit CISA KEV: CVE-2019-0344 — SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability art-1227
crit CISA KEV: CVE-2020-15415 — DrayTek Multiple Vigor Routers OS Command Injection Vulnerability art-1228
crit CISA KEV: CVE-2023-25280 — D-Link DIR-820 Router OS Command Injection Vulnerability art-1229
high Zero-day RCE vulnerability found in CUPS - Common UNIX Printing System art-1230
med Promise queues and batching concurrent tasks in Deno art-1232
high Identifying insecure C Code with Valgrind and fixing with Snyk Code art-1233
crit CISA KEV: CVE-2024-7593 — Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability art-1234
crit CISA KEV: CVE-2024-8963 — Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability art-1236
crit CISA KEV: CVE-2020-14644 — Oracle WebLogic Server Remote Code Execution Vulnerability art-1238
crit CISA KEV: CVE-2022-21445 — Oracle ADF Faces Deserialization of Untrusted Data Vulnerability art-1239
crit CISA KEV: CVE-2020-0618 — Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability art-1240
crit CISA KEV: CVE-2024-27348 — Apache HugeGraph-Server Improper Access Control Vulnerability art-1241
med Meet Snyk for Government: Our developer security solution with FedRAMP ATO art-1242
crit CISA KEV: CVE-2014-0502 — Adobe Flash Player Double Free Vulnerablity art-1243
crit CISA KEV: CVE-2013-0648 — Adobe Flash Player Code Execution Vulnerability art-1244
crit CISA KEV: CVE-2013-0643 — Adobe Flash Player Incorrect Default Permissions Vulnerability art-1245
crit CISA KEV: CVE-2014-0497 — Adobe Flash Player Integer Underflow Vulnerablity art-1246
high Want to avoid a data breach? Employ secrets detection art-1247
crit CISA KEV: CVE-2024-6670 — Progress WhatsUp Gold SQL Injection Vulnerability art-1248
crit CISA KEV: CVE-2024-43461 — Microsoft Windows MSHTML Platform Spoofing Vulnerability art-1249
crit CISA KEV: CVE-2024-8190 — Ivanti Cloud Services Appliance OS Command Injection Vulnerability art-1250
crit CISA KEV: CVE-2024-38217 — Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability art-1251
crit CISA KEV: CVE-2024-38014 — Microsoft Windows Installer Improper Privilege Management Vulnerability art-1252
crit CISA KEV: CVE-2024-38226 — Microsoft Publisher Protection Mechanism Failure Vulnerability art-1253
crit CISA KEV: CVE-2024-40766 — SonicWall SonicOS Improper Access Control Vulnerability art-1255
crit CISA KEV: CVE-2017-1000253 — Linux Kernel PIE Stack Buffer Corruption Vulnerability art-1256
crit CISA KEV: CVE-2016-3714 — ImageMagick Improper Input Validation Vulnerability art-1257
high What you should know about PHP code security art-1258
crit CISA KEV: CVE-2024-7262 — Kingsoft WPS Office Path Traversal Vulnerability art-1261
crit CISA KEV: CVE-2021-20124 — Draytek VigorConnect Path Traversal Vulnerability art-1262
crit CISA KEV: CVE-2021-20123 — Draytek VigorConnect Path Traversal Vulnerability art-1263
high The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant art-1264
crit CISA KEV: CVE-2024-7965 — Google Chromium V8 Inappropriate Implementation Vulnerability art-1265
crit CISA KEV: CVE-2024-38856 — Apache OFBiz Incorrect Authorization Vulnerability art-1267
med A developer’s best friend: Lessons learned from our canine companions about AI code security art-1269
crit CISA KEV: CVE-2024-7971 — Google Chromium V8 Type Confusion Vulnerability art-1270
crit CISA KEV: CVE-2024-39717 — Versa Director Dangerous File Type Upload Vulnerability art-1271
med Three trends shaping software supply chain security today art-1272
crit CISA KEV: CVE-2021-31196 — Microsoft Exchange Server Information Disclosure Vulnerability art-1273
crit CISA KEV: CVE-2022-0185 — Linux Kernel Heap-Based Buffer Overflow Vulnerability art-1274
crit CISA KEV: CVE-2021-33045 — Dahua IP Camera Authentication Bypass Vulnerability art-1275
crit CISA KEV: CVE-2021-33044 — Dahua IP Camera Authentication Bypass Vulnerability art-1276
crit CISA KEV: CVE-2024-23897 — Jenkins Command Line Interface (CLI) Path Traversal Vulnerability art-1277
crit CISA KEV: CVE-2024-28986 — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability art-1279
med Vulnerabilities in NodeJS C/C++ add-on extensions art-1281
crit CISA KEV: CVE-2024-38107 — Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability art-1283
crit CISA KEV: CVE-2024-38106 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-1284
crit CISA KEV: CVE-2024-38193 — Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability art-1285
crit CISA KEV: CVE-2024-38213 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1286
crit CISA KEV: CVE-2024-38178 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability art-1287
crit CISA KEV: CVE-2024-38189 — Microsoft Project Remote Code Execution Vulnerability art-1288
high A security expert’s view on Gartner’s generative AI insights - Part 2 art-1289
crit CISA KEV: CVE-2024-32113 — Apache OFBiz Path Traversal Vulnerability art-1290
crit CISA KEV: CVE-2024-36971 — Android Kernel Remote Code Execution Vulnerability art-1291
crit CISA KEV: CVE-2018-0824 — Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability art-1294
crit A denial of service Regex breaks FastAPI security art-1296
crit CISA KEV: CVE-2024-37085 — VMware ESXi Authentication Bypass Vulnerability art-1298
crit CISA KEV: CVE-2023-45249 — Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability art-1299
crit CISA KEV: CVE-2024-5217 — ServiceNow Incomplete List of Disallowed Inputs Vulnerability art-1300
crit CISA KEV: CVE-2024-4879 — ServiceNow Improper Input Validation Vulnerability art-1301
crit CISA KEV: CVE-2024-39891 — Twilio Authy Information Disclosure Vulnerability art-1302
crit CISA KEV: CVE-2012-4792 — Microsoft Internet Explorer Use-After-Free Vulnerability art-1303
med 10 Dimensions of Python Static Analysis art-1306
crit CISA KEV: CVE-2022-22948 — VMware vCenter Server Incorrect Default File Permissions Vulnerability art-1307
crit CISA KEV: CVE-2024-28995 — SolarWinds Serv-U Path Traversal Vulnerability art-1308
crit CISA KEV: CVE-2024-34102 — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability art-1309
crit CISA KEV: CVE-2024-36401 — OSGeo GeoServer GeoTools Eval Injection Vulnerability art-1310
high A stepping stone towards holistic application risk and compliance management of the Digital Operational Resiliency Act (DORA) art-1312
crit CISA KEV: CVE-2024-23692 — Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability art-1314
crit CISA KEV: CVE-2024-38080 — Microsoft Windows Hyper-V Privilege Escalation Vulnerability art-1315
crit CISA KEV: CVE-2024-38112 — Microsoft Windows MSHTML Platform Spoofing Vulnerability art-1316
crit CISA KEV: CVE-2024-20399 — Cisco NX-OS Command Injection Vulnerability art-1317
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1319
crit CISA KEV: CVE-2020-13965 — Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability art-1320
crit CISA KEV: CVE-2022-2586 — Linux Kernel Use-After-Free Vulnerability art-1321
crit CISA KEV: CVE-2022-24816 — OSGeo GeoServer JAI-EXT Code Injection Vulnerability art-1322
med Finding and fixing exposed hardcoded secrets in your GitHub project with Snyk art-1323
med Why ASPM is the future of AppSec: Key points from our newest whitepaper art-1325
med Automate security controls from development to production on Google Cloud art-1326
crit CISA KEV: CVE-2024-4358 — Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability art-1330
crit CISA KEV: CVE-2024-26169 — Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability art-1331
crit CISA KEV: CVE-2024-32896 — Android Pixel Privilege Escalation Vulnerability art-1332
high Essential Node.js backend examples for developers in 2024 art-1334
crit CISA KEV: CVE-2024-4577 — PHP-CGI OS Command Injection Vulnerability art-1335
crit CISA KEV: CVE-2024-4610 — Arm Mali GPU Kernel Driver Use-After-Free Vulnerability art-1336
med Securing next-gen development: Lessons from Trust Bank and TASConnect art-1339
crit CISA KEV: CVE-2017-3506 — Oracle WebLogic Server OS Command Injection Vulnerability art-1342
crit CISA KEV: CVE-2024-1086 — Linux Kernel Use-After-Free Vulnerability art-1344
crit CISA KEV: CVE-2024-24919 — Check Point Quantum Security Gateways Information Disclosure Vulnerability art-1345
med 10 modern Node.js runtime features to start using in 2024 art-1346
crit CISA KEV: CVE-2024-4978 — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability art-1347
med Fastify plugins as building blocks for a backend Node.js API art-1348
crit CISA KEV: CVE-2024-5274 — Google Chromium V8 Type Confusion Vulnerability art-1349
crit CISA KEV: CVE-2020-17519 — Apache Flink Improper Access Control Vulnerability art-1350
med Preventing broken access control in express Node.js applications art-1351
crit CISA KEV: CVE-2024-4947 — Google Chromium V8 Type Confusion Vulnerability art-1354
crit CISA KEV: CVE-2023-43208 — NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability art-1355
crit CISA KEV: CVE-2024-4761 — Google Chromium V8 Out-of-Bounds Memory Write Vulnerability art-1356
crit CISA KEV: CVE-2021-40655 — D-Link DIR-605 Router Information Disclosure Vulnerability art-1357
crit CISA KEV: CVE-2014-100005 — D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability art-1358
med Symmetric vs. asymmetric encryption: Practical Python examples art-1359
crit CISA KEV: CVE-2024-30040 — Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability art-1360
crit CISA KEV: CVE-2024-30051 — Microsoft DWM Core Library Privilege Escalation Vulnerability art-1361
crit CISA KEV: CVE-2024-4671 — Google Chromium Visuals Use-After-Free Vulnerability art-1363
med Integrating Snyk Code SAST results in your ServiceNow workflows art-1366
high Snyk AppRisk Pro: A holistic approach to application risk management art-1368
crit CISA KEV: CVE-2023-7028 — GitLab Community and Enterprise Editions Improper Access Control Vulnerability art-1369
crit CISA KEV: CVE-2024-29988 — Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability art-1372
med 360 degrees of application security with Snyk art-1373
crit CISA KEV: CVE-2024-4040 — CrushFTP VFS Sandbox Escape Vulnerability art-1374
crit CISA KEV: CVE-2024-20359 — Cisco ASA and FTD Privilege Escalation Vulnerability art-1375
crit CISA KEV: CVE-2024-20353 — Cisco ASA and FTD Denial of Service Vulnerability art-1376
crit CISA KEV: CVE-2022-38028 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-1379
high Building an npm package compatible with ESM and CJS in 2024 art-1380
high How SAS secures their AI-generated code art-1384
crit CISA KEV: CVE-2024-3400 — Palo Alto Networks PAN-OS Command Injection Vulnerability art-1385
high Nine Docker pro tips for Node.js developers art-1386
crit CISA KEV: CVE-2024-3273 — D-Link Multiple NAS Devices Command Injection Vulnerability art-1387
high Exploiting HTTP/2 CONTINUATION frames for DoS attacks art-1389
crit CISA KEV: CVE-2024-29748 — Android Pixel Privilege Escalation Vulnerability art-1390
crit CISA KEV: CVE-2024-29745 — Android Pixel Information Disclosure Vulnerability art-1391
crit The XZ backdoor CVE-2024-3094 art-1392
med Securing your SBOM on Google Cloud art-1393
med How Snyk ensures safe adoption of AI art-1394
crit CISA KEV: CVE-2023-24955 — Microsoft SharePoint Server Code Injection Vulnerability art-1395
crit CISA KEV: CVE-2019-7256 — Nice Linear eMerge E3-Series OS Command Injection Vulnerability art-1396
crit CISA KEV: CVE-2021-44529 — Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability art-1397
crit CISA KEV: CVE-2023-48788 — Fortinet FortiClient EMS SQL Injection Vulnerability art-1398
med Snyk's AppSec dream team art-1400
high Snyk users don't have to worry about NVD delays art-1401
high GitHub “besieged” by malware repositories and repo confusion: Why you'll be ok art-1402
med AppSec Maturity Models art-1403
crit CISA KEV: CVE-2024-27198 — JetBrains TeamCity Authentication Bypass Vulnerability art-1404
crit Snyk Learn and the NIST Cybersecurity Framework (CSF) art-1405
crit CISA KEV: CVE-2024-23225 — Apple Multiple Products Memory Corruption Vulnerability art-1406
crit CISA KEV: CVE-2024-23296 — Apple Multiple Products Memory Corruption Vulnerability art-1407
crit CISA KEV: CVE-2023-21237 — Android Pixel Information Disclosure Vulnerability art-1409
crit CISA KEV: CVE-2021-36380 — Sunhillo SureLine OS Command Injection Vulnerablity art-1410
crit CISA KEV: CVE-2024-21338 — Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability art-1412
high Defense in Depth art-1415
crit CISA KEV: CVE-2023-29360 — Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability art-1416
med 5 Node.js security code snippets every backend developer should know art-1417
crit CISA KEV: CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass Vulnerability art-1419
high Preventing server-side request forgery in Node.js applications art-1421
high Preventing SQL injection attacks in Node.js art-1422
crit CISA KEV: CVE-2020-3259 — Cisco ASA and FTD Information Disclosure Vulnerability art-1423
crit CISA KEV: CVE-2024-21410 — Microsoft Exchange Server Privilege Escalation Vulnerability art-1424
med Reporting AppSec risk up to your CISO art-1427
crit CISA KEV: CVE-2024-21412 — Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability art-1428
crit CISA KEV: CVE-2024-21351 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1429
crit CISA KEV: CVE-2023-43770 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability art-1431
crit CISA KEV: CVE-2024-21762 — Fortinet FortiOS Out-of-Bound Write Vulnerability art-1432
crit CISA KEV: CVE-2023-4762 — Google Chromium V8 Type Confusion Vulnerability art-1434
crit CISA KEV: CVE-2022-48618 — Apple Multiple Products Memory Corruption Vulnerability art-1436
crit CISA KEV: CVE-2024-21893 — Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability art-1437
crit CISA KEV: CVE-2023-22527 — Atlassian Confluence Data Center and Server Template Injection Vulnerability art-1439
high The 4 best DevSecOps tools for a secure DevOps workflow art-1440
crit CISA KEV: CVE-2024-23222 — Apple Multiple Products WebKit Type Confusion Vulnerability art-1441
crit CISA KEV: CVE-2023-34048 — VMware vCenter Server Out-of-Bounds Write Vulnerability art-1443
crit New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends art-1444
high Understanding and mitigating the Jinja2 XSS vulnerability (CVE-2024-22195) art-1445
crit CISA KEV: CVE-2023-35082 — Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability art-1446
crit CISA KEV: CVE-2024-0519 — Google Chromium V8 Out-of-Bounds Memory Access Vulnerability art-1447
crit CISA KEV: CVE-2023-6549 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability art-1448
crit CISA KEV: CVE-2023-6548 — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability art-1449
med Snyk welcomes Helios, accelerating our ASPM vision with runtime insights art-1450
crit CISA KEV: CVE-2018-15133 — Laravel Deserialization of Untrusted Data Vulnerability art-1451
crit CISA KEV: CVE-2023-29357 — Microsoft SharePoint Server Privilege Escalation Vulnerability art-1453
crit CISA KEV: CVE-2023-46805 — Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability art-1454
crit CISA KEV: CVE-2023-23752 — Joomla! Improper Access Control Vulnerability art-1456
crit CISA KEV: CVE-2016-20017 — D-Link DSL-2750B Devices Command Injection Vulnerability art-1457
crit CISA KEV: CVE-2023-41990 — Apple Multiple Products Code Execution Vulnerability art-1458
crit CISA KEV: CVE-2023-27524 — Apache Superset Insecure Default Initialization of Resource Vulnerability art-1459
crit CISA KEV: CVE-2023-29300 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1460
crit CISA KEV: CVE-2023-38203 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1461
med Build and deploy a Node.js security scanning API to Platformatic Cloud art-1462
high Kroger’s approach to supply chain security art-1463
crit Krampus delivers an end-of-year Struts vulnerability art-1464
crit CISA KEV: CVE-2023-7101 — Spreadsheet::ParseExcel Remote Code Execution Vulnerability art-1465
crit CISA KEV: CVE-2023-7024 — Google Chromium WebRTC Heap Buffer Overflow Vulnerability art-1466
med Command injection in Python: examples and prevention art-1469
crit CISA KEV: CVE-2023-49897 — FXC AE1021, AE1021PE OS Command Injection Vulnerability art-1470
crit CISA KEV: CVE-2023-47565 — QNAP VioStor NVR OS Command Injection Vulnerability art-1471
med Common SAML vulnerabilities and how to remediate them art-1473
crit Vulnerability disclosure: Which comes first, the security bug in PHP or the CVE? art-1474
med Three reasons to invest in an ASPM solution in 2024 art-1479
crit CISA KEV: CVE-2023-6448 — Unitronics Vision PLC and HMI Insecure Default Password Vulnerability art-1481
crit CISA KEV: CVE-2023-41266 — Qlik Sense Path Traversal Vulnerability art-1482
crit CISA KEV: CVE-2023-41265 — Qlik Sense HTTP Tunneling Vulnerability art-1483
med Code injection in Python: examples and prevention art-1484
crit CISA KEV: CVE-2023-33107 — Qualcomm Multiple Chipsets Integer Overflow Vulnerability art-1487
crit CISA KEV: CVE-2023-33106 — Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability art-1488
crit CISA KEV: CVE-2023-33063 — Qualcomm Multiple Chipsets Use-After-Free Vulnerability art-1489
crit CISA KEV: CVE-2022-22071 — Qualcomm Multiple Chipsets Use-After-Free Vulnerability art-1490
crit CISA KEV: CVE-2023-42917 — Apple Multiple Products WebKit Memory Corruption Vulnerability art-1493
crit CISA KEV: CVE-2023-42916 — Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability art-1494
high Snyk Fetch the Flag CTF 2023 writeup: Off the SETUID art-1495
med Snyk Fetch the Flag CTF 2023 writeup: Protect The Environment art-1497
crit CISA KEV: CVE-2023-6345 — Google Skia Integer Overflow Vulnerability art-1498
crit CISA KEV: CVE-2023-49103 — ownCloud graphapi Information Disclosure Vulnerability art-1499
crit Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools art-1506
med File encryption in Python: An in-depth exploration of symmetric and asymmetric techniques art-1507
crit CISA KEV: CVE-2023-4911 — GNU C Library Buffer Overflow Vulnerability art-1510
high Snyk Apps now GA: An easy, standardized, and secure framework for building custom integrations art-1511
crit CISA KEV: CVE-2023-36584 — Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability art-1514
crit CISA KEV: CVE-2023-1671 — Sophos Web Appliance Command Injection Vulnerability art-1515
crit CISA KEV: CVE-2020-2551 — Oracle Fusion Middleware Unspecified Vulnerability art-1516
crit CISA KEV: CVE-2023-36033 — Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability art-1518
crit CISA KEV: CVE-2023-36025 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1519
crit CISA KEV: CVE-2023-36036 — Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability art-1520
crit CISA KEV: CVE-2023-47246 — SysAid Server Path Traversal Vulnerability art-1522
crit CISA KEV: CVE-2023-36844 — Juniper Junos OS EX Series PHP External Variable Modification Vulnerability art-1523
crit CISA KEV: CVE-2023-36845 — Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability art-1524
crit CISA KEV: CVE-2023-36846 — Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability art-1525
crit CISA KEV: CVE-2023-36847 — Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability art-1526
crit CISA KEV: CVE-2023-36851 — Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability art-1527
med Real-time threat protection with Snyk and SentinelOne art-1528
crit CISA KEV: CVE-2023-29552 — Service Location Protocol (SLP) Denial-of-Service Vulnerability art-1532
med Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration art-1533
crit CISA KEV: CVE-2023-22518 — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability art-1534
med Asset-first application security: What is it and how can it help art-1536
high What does Biden's Executive Order on AI safety measures mean for businesses? art-1538
crit CISA KEV: CVE-2023-46604 — Apache ActiveMQ Deserialization of Untrusted Data Vulnerability art-1539
high Dependency injection in Python art-1540
crit CISA KEV: CVE-2023-46748 — F5 BIG-IP Configuration Utility SQL Injection Vulnerability art-1541
high The art of conditional rendering: Tips and tricks for React and Next.js developers art-1543
crit CISA KEV: CVE-2023-5631 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability art-1544
crit Weak Hash vulnerability discovered in crypto-js and crypto-es (CVE-2023-46233 & CVE-2023-46133) art-1545
high Adding Snyk security to Jira and Bitbucket Cloud art-1547
crit CISA KEV: CVE-2023-20273 — Cisco IOS XE Web UI Command Injection Vulnerability art-1552
crit CISA KEV: CVE-2023-4966 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability art-1554
crit CISA KEV: CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation Vulnerability art-1556
med Installing and managing Java on macOS art-1558
high Find and fix HTTP/2 rapid reset zero-day vulnerability CVE-2023-44487 art-1559
high Cybersecurity Venture’s 2023 Software Supply Chain Attack Report art-1561
crit CISA KEV: CVE-2023-21608 — Adobe Acrobat and Reader Use-After-Free Vulnerability art-1562
crit CISA KEV: CVE-2023-20109 — Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability art-1563
crit CISA KEV: CVE-2023-41763 — Microsoft Skype for Business Privilege Escalation Vulnerability art-1564
crit CISA KEV: CVE-2023-36563 — Microsoft WordPad Information Disclosure Vulnerability art-1565
crit CISA KEV: CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability art-1566
crit CISA KEV: CVE-2023-22515 — Atlassian Confluence Data Center and Server Broken Access Control Vulnerability art-1569
crit CISA KEV: CVE-2023-40044 — Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability art-1570
crit CISA KEV: CVE-2023-42824 — Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability art-1571
high High severity vulnerability found in libcurl and curl (CVE-2023-38545) art-1572
crit CISA KEV: CVE-2023-42793 — JetBrains TeamCity Authentication Bypass Vulnerability art-1575
crit CISA KEV: CVE-2023-28229 — Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability art-1576
crit CISA KEV: CVE-2023-4211 — Arm Mali GPU Kernel Driver Use-After-Free Vulnerability art-1578
high Modern VS Code extension development tutorial: Building a secure extension art-1579
crit CISA KEV: CVE-2023-5217 — Google Chromium libvpx Heap Buffer Overflow Vulnerability art-1580
high Critical WebP 0-day security CVE-2023-4863 impacts wider software ecosystem art-1581
crit CISA KEV: CVE-2018-14667 — Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability art-1582
med Signing container images: Comparing Sigstore, Notary, and Docker Content Trust art-1584
crit CISA KEV: CVE-2023-41991 — Apple Multiple Products Improper Certificate Validation Vulnerability art-1585
crit CISA KEV: CVE-2023-41992 — Apple Multiple Products Kernel Privilege Escalation Vulnerability art-1586
crit CISA KEV: CVE-2023-41993 — Apple Multiple Products WebKit Code Execution Vulnerability art-1587
crit CISA KEV: CVE-2023-41179 — Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability art-1589
med Developer-first supply chain security art-1591
crit CISA KEV: CVE-2023-28434 — MinIO Security Feature Bypass Vulnerability art-1592
crit CISA KEV: CVE-2022-22265 — Samsung Mobile Devices Use-After-Free Vulnerability art-1594
crit CISA KEV: CVE-2014-8361 — Realtek SDK Improper Input Validation Vulnerability art-1595
crit CISA KEV: CVE-2017-6884 — Zyxel EMG2926 Routers Command Injection Vulnerability art-1596
crit CISA KEV: CVE-2021-3129 — Laravel Ignition File Upload Vulnerability art-1597
med Modern VS Code extension development: The basics art-1598
crit CISA KEV: CVE-2023-26369 — Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability art-1599
high Security implications of cross-origin resource sharing (CORS) in Node.js art-1600
crit CISA KEV: CVE-2023-35674 — Android Framework Privilege Escalation Vulnerability art-1602
crit CISA KEV: CVE-2023-20269 — Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability art-1603
crit CISA KEV: CVE-2023-4863 — Google Chromium WebP Heap-Based Buffer Overflow Vulnerability art-1604
high A guide to input validation with Spring Boot art-1605
crit CISA KEV: CVE-2023-36761 — Microsoft Word Information Disclosure Vulnerability art-1606
crit CISA KEV: CVE-2023-36802 — Microsoft Streaming Service Proxy Privilege Escalation Vulnerability art-1607
crit CISA KEV: CVE-2023-41064 — Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability art-1609
high Top considerations for addressing risks in the OWASP Top 10 for LLMs art-1610
crit CISA KEV: CVE-2023-33246 — Apache RocketMQ Command Execution Vulnerability art-1612
med Node.js vs. Deno vs. Bun: Performance & JavaScript Runtime Comparison art-1613
med Using JLink to create smaller Docker images for your Spring Boot Java application art-1619
crit CISA KEV: CVE-2023-38831 — RARLAB WinRAR Code Execution Vulnerability art-1621
crit CISA KEV: CVE-2023-32315 — Ignite Realtime Openfire Path Traversal Vulnerability art-1622
crit CISA KEV: CVE-2023-38035 — Ivanti Sentry Authentication Bypass Vulnerability art-1625
crit CISA KEV: CVE-2023-27532 — Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability art-1626
crit CISA KEV: CVE-2023-26359 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1628
high What are AI hallucinations and why should developers care? art-1629
crit CISA KEV: CVE-2023-24489 — Citrix Content Collaboration ShareFile Improper Access Control Vulnerability art-1630
med CodeSecDays conference and more complete security coverage with GitGuardian art-1632
high .NET developers alert: Moq NuGET package exfiltrates user emails from git art-1633
high Manage security issues in Jira with Snyk Security in Jira Cloud art-1634
crit CISA KEV: CVE-2023-38180 — Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability art-1635
med Mitigating DOM clobbering attacks in JavaScript art-1639
crit CISA KEV: CVE-2017-18368 — Zyxel P660HN-T1A Routers Command Injection Vulnerability art-1640
med Software Supply Chain Security Tools: Types, Features & Considerations art-1643
med How Snyk can help secure supply chains per "A Guide to Implementing the Software Bill of Materials (SBOM) for Software Management"’ by Japan art-1645
med Implementing TLS in Kubernetes art-1646
crit CISA KEV: CVE-2023-35081 — Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability art-1647
med Control your role! Kubernetes RBAC explored art-1649
crit CISA KEV: CVE-2023-37580 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-1650
med Snyk's 2023 State of Open Source Security: Supply chain security, AI, and more art-1651
crit CISA KEV: CVE-2023-38606 — Apple Multiple Products Kernel Unspecified Vulnerability art-1652
crit CISA KEV: CVE-2023-35078 — Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability art-1653
crit CISA KEV: CVE-2023-29298 — Adobe ColdFusion Improper Access Control Vulnerability art-1656
crit CISA KEV: CVE-2023-38205 — Adobe ColdFusion Improper Access Control Vulnerability art-1657
high Finding and fixing insecure direct object references in Python art-1659
crit CISA KEV: CVE-2023-3519 — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability art-1660
med Swift deserialization security primer art-1661
high XS leaks: What they are and how to avoid them art-1663
crit CISA KEV: CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability art-1664
crit CISA KEV: CVE-2022-29303 — SolarView Compact Command Injection Vulnerability art-1666
crit CISA KEV: CVE-2023-37450 — Apple Multiple Products WebKit Code Execution Vulnerability art-1667
crit CISA KEV: CVE-2023-32046 — Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability art-1670
crit CISA KEV: CVE-2023-32049 — Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability art-1671
crit CISA KEV: CVE-2023-35311 — Microsoft Outlook Security Feature Bypass Vulnerability art-1672
crit CISA KEV: CVE-2023-36874 — Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability art-1673
crit CISA KEV: CVE-2022-31199 — Netwrix Auditor Insecure Object Deserialization Vulnerability art-1674
crit CISA KEV: CVE-2021-29256 — Arm Mali GPU Kernel Driver Use-After-Free Vulnerability art-1675
med Building a security-conscious CI/CD pipeline art-1676
high The importance of verifying webhook signatures art-1677
crit CISA KEV: CVE-2019-17621 — D-Link DIR-859 Router Command Execution Vulnerability art-1678
crit CISA KEV: CVE-2019-20500 — D-Link DWL-2600AP Access Point Command Injection Vulnerability art-1679
crit CISA KEV: CVE-2021-25487 — Samsung Mobile Devices Out-of-Bounds Read Vulnerability art-1680
crit CISA KEV: CVE-2021-25489 — Samsung Mobile Devices Improper Input Validation Vulnerability art-1681
crit CISA KEV: CVE-2021-25394 — Samsung Mobile Devices Race Condition Vulnerability art-1682
crit CISA KEV: CVE-2021-25395 — Samsung Mobile Devices Race Condition Vulnerability art-1683
crit CISA KEV: CVE-2021-25371 — Samsung Mobile Devices Unspecified Vulnerability art-1684
crit CISA KEV: CVE-2021-25372 — Samsung Mobile Devices Improper Boundary Check Vulnerability art-1685
high Using insecure npm package manager defaults to steal your macOS keyboard shortcuts art-1686
crit CISA KEV: CVE-2023-32434 — Apple Multiple Products Integer Overflow Vulnerability art-1690
crit CISA KEV: CVE-2023-32435 — Apple Multiple Products WebKit Memory Corruption Vulnerability art-1691
crit CISA KEV: CVE-2023-32439 — Apple Multiple Products WebKit Type Confusion Vulnerability art-1692
crit CISA KEV: CVE-2023-20867 — VMware Tools Authentication Bypass Vulnerability art-1693
crit CISA KEV: CVE-2023-27992 — Zyxel Multiple NAS Devices Command Injection Vulnerability art-1694
crit CISA KEV: CVE-2023-20887 — Vmware Aria Operations for Networks Command Injection Vulnerability art-1697
crit CISA KEV: CVE-2020-35730 — Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability art-1698
crit CISA KEV: CVE-2020-12641 — Roundcube Webmail Remote Code Execution Vulnerability art-1699
crit CISA KEV: CVE-2021-44026 — Roundcube Webmail SQL Injection Vulnerability art-1700
crit CISA KEV: CVE-2016-9079 — Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability art-1701
crit CISA KEV: CVE-2016-0165 — Microsoft Win32k Privilege Escalation Vulnerability art-1702
crit SnakeYaml 2.0: Solving the unsafe deserialization vulnerability art-1703
high The SecurityManager is getting removed in Java: What that means for you art-1707
med Snyk named a Leader, placed highest in Strategy category in The Forrester Wave: Software Composition Analysis (SCA), Q2 2023 report art-1709
crit CISA KEV: CVE-2023-27997 — Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability art-1710
med Snyk welcomes Enso: Enabling security leaders to scale their AppSec program with ASPM art-1712
med Reduce risk to your supply chain with a software bill of materials (SBOM) art-1714
med SnykLaunch June ‘23: Insights and DeepCode AI enable faster fixes and prioritization art-1715
med What can you do with an enriched SBOM? A parlay quickstart guide art-1716
crit CISA KEV: CVE-2023-3079 — Google Chromium V8 Type Confusion Vulnerability art-1718
med A day in the life of an ethical hacker art-1720
high Ethical hacking techniques art-1721
crit CISA KEV: CVE-2023-33009 — Zyxel Multiple Firewalls Buffer Overflow Vulnerability art-1722
crit CISA KEV: CVE-2023-33010 — Zyxel Multiple Firewalls Buffer Overflow Vulnerability art-1723
crit CISA KEV: CVE-2023-34362 — Progress MOVEit Transfer SQL Injection Vulnerability art-1724
high Ethical Hacking: Top Tools art-1725
high A quick primer on LDAP injection art-1726
crit CISA KEV: CVE-2023-28771 — Zyxel Multiple Firewalls OS Command Injection Vulnerability art-1727
crit CISA KEV: CVE-2023-2868 — Barracuda Networks ESG Appliance Improper Input Validation Vulnerability art-1730
crit Data loss prevention for developers art-1733
crit CISA KEV: CVE-2023-32409 — Apple Multiple Products WebKit Sandbox Escape Vulnerability art-1737
crit CISA KEV: CVE-2023-28204 — Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability art-1738
crit CISA KEV: CVE-2023-32373 — Apple Multiple Products WebKit Use-After-Free Vulnerability art-1739
crit CISA KEV: CVE-2004-1464 — Cisco IOS Denial-of-Service Vulnerability art-1741
crit CISA KEV: CVE-2016-6415 — Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability art-1742
crit CISA KEV: CVE-2023-21492 — Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability art-1743
med Snyk and ServiceNow collaborate on new SBOM solution art-1748
crit CISA KEV: CVE-2023-25717 — Multiple Ruckus Wireless Products CSRF and RCE Vulnerability art-1750
crit CISA KEV: CVE-2021-3560 — Red Hat Polkit Incorrect Authorization Vulnerability art-1751
crit CISA KEV: CVE-2014-0196 — Linux Kernel Race Condition Vulnerability art-1752
crit CISA KEV: CVE-2010-3904 — Linux Kernel Improper Input Validation Vulnerability art-1753
crit CISA KEV: CVE-2015-5317 — Jenkins User Interface (UI) Information Disclosure Vulnerability art-1754
crit CISA KEV: CVE-2016-3427 — Oracle Java SE and JRockit Unspecified Vulnerability art-1755
med Snyk named to CNBC 2023 Disruptor 50 List art-1758
high Secure JavaScript URL validation art-1759
crit CISA KEV: CVE-2023-29336 — Microsoft Win32K Privilege Escalation Vulnerability art-1760
high Three considerations for building an effective security program art-1764
med Security implications of HTTP response headers art-1766
crit CISA KEV: CVE-2023-1389 — TP-Link Archer AX-21 Command Injection Vulnerability art-1769
crit CISA KEV: CVE-2021-45046 — Apache Log4j2 Deserialization of Untrusted Data Vulnerability art-1770
crit CISA KEV: CVE-2023-21839 — Oracle WebLogic Server Unspecified Vulnerability art-1771
crit Lessons from OpenSSL vulnerabilities part 2: Finding and fixing supply chain vulnerabilities art-1772
crit API Security Guide art-1774
crit CISA KEV: CVE-2023-28432 — MinIO Information Disclosure Vulnerability art-1777
crit CISA KEV: CVE-2023-27350 — PaperCut MF/NG Improper Access Control Vulnerability art-1778
crit CISA KEV: CVE-2023-2136 — Google Chrome Skia Integer Overflow Vulnerability art-1779
crit Lessons from OpenSSL vulnerabilities part 1: Preparing your supply chain for the next critical vulnerability art-1781
crit CISA KEV: CVE-2017-6742 — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability art-1782
crit Preventing insecure deserialization in Node.js art-1783
crit CISA KEV: CVE-2019-8526 — Apple macOS Use-After-Free Vulnerability art-1784
crit CISA KEV: CVE-2023-2033 — Google Chromium V8 Type Confusion Vulnerability art-1785
crit CISA KEV: CVE-2023-20963 — Android Framework Privilege Escalation Vulnerability art-1789
crit CISA KEV: CVE-2023-29492 — Novi Survey Insecure Deserialization Vulnerability art-1790
crit CISA KEV: CVE-2023-28252 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability art-1793
med New IaC security workshop from Snyk, HashiCorp, and AWS at KubeCon Europe 2023 and on-demand art-1795
crit CISA KEV: CVE-2023-28205 — Apple Multiple Products WebKit Use-After-Free Vulnerability art-1796
crit CISA KEV: CVE-2023-28206 — Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability art-1797
crit CISA KEV: CVE-2021-27876 — Veritas Backup Exec Agent File Access Vulnerability art-1798
crit CISA KEV: CVE-2021-27877 — Veritas Backup Exec Agent Improper Authentication Vulnerability art-1799
crit CISA KEV: CVE-2021-27878 — Veritas Backup Exec Agent Command Execution Vulnerability art-1800
crit CISA KEV: CVE-2019-1388 — Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability art-1801
crit CISA KEV: CVE-2023-26083 — Arm Mali GPU Kernel Driver Information Disclosure Vulnerability art-1802
med Timing out synchronous functions with regex art-1803
high How Snyk uses AI in developer security art-1806
high SnykLaunch April '23: C/C++ expansion, cloud and IaC updates, custom container security, new integrations, and more art-1809
crit CISA KEV: CVE-2022-27926 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-1812
high Data leak in the Netherlands: What developers should learn from this art-1814
crit CISA KEV: CVE-2013-3163 — Microsoft Internet Explorer Memory Corruption Vulnerability art-1815
crit CISA KEV: CVE-2017-7494 — Samba Remote Code Execution Vulnerability art-1816
crit CISA KEV: CVE-2022-42948 — Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability art-1817
crit CISA KEV: CVE-2022-39197 — Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability art-1818
crit CISA KEV: CVE-2021-30900 — Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability art-1819
crit CISA KEV: CVE-2022-38181 — Arm Mali GPU Kernel Driver Use-After-Free Vulnerability art-1820
crit CISA KEV: CVE-2023-0266 — Linux Kernel Use-After-Free Vulnerability art-1821
crit CISA KEV: CVE-2022-3038 — Google Chromium Network Service Use-After-Free Vulnerability art-1822
crit CISA KEV: CVE-2022-22706 — Arm Mali GPU Kernel Driver Unspecified Vulnerability art-1823
high Avoiding mass assignment vulnerabilities in Node.js art-1825
high Securing the web (forward) art-1826
crit The rising trend of malicious packages in open source ecosystems art-1827
med PulseMeter Report: Software supply chains art-1828
high Securing the digital future: Reviewing the Biden-Harris administration's National Cybersecurity Strategy art-1829
high The Docker project turns 10! Looking back at a decade of containers art-1830
high New language-specific Snyk Top 10 for open source vulnerabilities art-1831
crit CISA KEV: CVE-2023-26360 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1833
crit CISA KEV: CVE-2023-23397 — Microsoft Office Outlook Privilege Escalation Vulnerability art-1834
crit CISA KEV: CVE-2023-24880 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1835
crit CISA KEV: CVE-2022-41328 — Fortinet FortiOS Path Traversal Vulnerability art-1836
high Preventing XSS in Django art-1837
crit CISA KEV: CVE-2021-39144 — XStream Remote Code Execution Vulnerability art-1838
crit CISA KEV: CVE-2020-5741 — Plex Media Server Remote Code Execution Vulnerability art-1839
high Comparing Node.js web frameworks: Which is most secure? art-1841
crit CISA KEV: CVE-2022-28810 — Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability art-1842
crit CISA KEV: CVE-2022-33891 — Apache Spark Command Injection Vulnerability art-1843
crit CISA KEV: CVE-2022-35914 — Teclib GLPI Remote Code Execution Vulnerability art-1844
high Mitigating path traversal vulns in Java with Snyk Code art-1845
high Snyk in 30: Developer-first security democast art-1846
high Cybersecurity Hygiene 101 art-1847
high API authentication vulnerability found in Snyk Kubernetes integration (CVE-2023-1065) art-1850
med Node.js multithreading with worker threads: pros and cons art-1851
crit CISA KEV: CVE-2022-36537 — ZK Framework AuUploader Unspecified Vulnerability art-1852
crit Finding YAML Deserialization with Snyk Code art-1853
high The security concerns of a JavaScript sandbox with the Node.js VM module art-1854
med Building Vue 3 components with Tailwind CSS art-1856
crit CISA KEV: CVE-2022-47986 — IBM Aspera Faspex Code Execution Vulnerability art-1857
crit CISA KEV: CVE-2022-41223 — Mitel MiVoice Connect Code Injection Vulnerability art-1858
crit CISA KEV: CVE-2022-40765 — Mitel MiVoice Connect Command Injection Vulnerability art-1859
crit CISA KEV: CVE-2022-46169 — Cacti Command Injection Vulnerability art-1862
med When software isn’t a “supply” art-1864
crit CISA KEV: CVE-2023-21715 — Microsoft Office Publisher Security Feature Bypass Vulnerability art-1865
crit CISA KEV: CVE-2023-23376 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability art-1866
crit CISA KEV: CVE-2023-23529 — Apple Multiple Products WebKit Type Confusion Vulnerability art-1867
crit CISA KEV: CVE-2023-21823 — Microsoft Windows Graphic Component Privilege Escalation Vulnerability art-1868
crit CISA KEV: CVE-2015-2291 — Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability art-1869
crit CISA KEV: CVE-2022-24990 — TerraMaster OS Remote Command Execution Vulnerability art-1870
crit CISA KEV: CVE-2023-0669 — Fortra GoAnywhere MFT Remote Code Execution Vulnerability art-1871
med CSPRNG: Random algorithms need security too! art-1872
crit CISA KEV: CVE-2022-21587 — Oracle E-Business Suite Unspecified Vulnerability art-1877
crit CISA KEV: CVE-2023-22952 — Multiple SugarCRM Products Remote Code Execution Vulnerability art-1878
med Adding security to Nuxt 3 art-1881
crit CISA KEV: CVE-2017-11357 — Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability art-1882
crit Snyk enhances ServiceNow with comprehensive insights into vulnerabilities in open source software art-1883
crit CISA KEV: CVE-2022-47966 — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability art-1884
crit CISA KEV: CVE-2022-44877 — CWP Control Web Panel OS Command Injection Vulnerability art-1886
med New year ushers in new wave of Snyk Technology Alliance Partner Program members art-1887
high Three ways Snyk made software supply chains more secure in 2022 art-1888
high OSPO security evolution: The Kübler-Ross Model of open source art-1889
med Snyk's AppSec journey in 2022 art-1891
crit CISA KEV: CVE-2022-41080 — Microsoft Exchange Server Privilege Escalation Vulnerability art-1892
crit CISA KEV: CVE-2023-21674 — Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability art-1893
med Bolstering Snyk's developer security platform in 2022 art-1894
high Supply chain security incident at CircleCI: Rotate your secrets art-1895
med You should be using HTTP Strict Transport Security (HSTS) headers in your Node.js server art-1897
crit CISA KEV: CVE-2018-5430 — TIBCO JasperReports Server Information Disclosure Vulnerability art-1898
crit CISA KEV: CVE-2018-18809 — TIBCO JasperReports Library Directory Traversal Vulnerability art-1899
med 5 "no experience needed" tips for building secure applications art-1901
med Cloud security updates you need to know from re:Invent 2022 art-1902
high Building an application security battle plan: Home Alone edition art-1905
crit Exploring the Spring Security authorization bypass (CVE-2022-31692) art-1906
high Snyk in 30: Open source security for Atlassian Bitbucket Cloud art-1907
med Top takeaways from re:Invent 2022 art-1908
crit Unsafe deserialization vulnerability in SnakeYaml (CVE-2022-1471) art-1909
crit CISA KEV: CVE-2022-42856 — Apple iOS Type Confusion Vulnerability art-1910
med Azure Bicep security fundamentals art-1911
crit CISA KEV: CVE-2022-42475 — Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability art-1912
crit CISA KEV: CVE-2022-44698 — Microsoft Defender SmartScreen Security Feature Bypass Vulnerability art-1913
crit CISA KEV: CVE-2022-27518 — Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability art-1914
crit CISA KEV: CVE-2022-26500 — Veeam Backup & Replication Remote Code Execution Vulnerability art-1915
crit CISA KEV: CVE-2022-26501 — Veeam Backup & Replication Remote Code Execution Vulnerability art-1916
high Using Snyk reporting for data-driven security art-1918
high Why tool consolidation matters for developer security art-1921
crit CISA KEV: CVE-2022-4262 — Google Chromium V8 Type Confusion Vulnerability art-1923
high Code injection vulnerabilities (CVSSv3 5.8) found in Snyk CLI and IDE plugins art-1925
crit CISA KEV: CVE-2021-35587 — Oracle Fusion Middleware Unspecified Vulnerability art-1929
crit CISA KEV: CVE-2022-4135 — Google Chromium GPU Heap Buffer Overflow Vulnerability art-1930
high Setting up SSL/TLS for Kubernetes Ingress art-1934
med Dependency injection in JavaScript art-1935
high How Atlassian used Snyk to solve Log4Shell art-1937
crit CISA KEV: CVE-2022-41049 — Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability art-1941
med Fetch the Flag CTF 2022 writeup: Disposable Message art-1944
high Fetch the Flag CTF 2022 writeup: Not So Smart Fridge art-1945
high Fetch the Flag CTF 2022 writeup: Treasure Trove art-1947
high Fetch the Flag CTF 2022 writeup: Moongoose art-1948
high Fetch the Flag CTF 2022 writeup: File Explorer art-1950
crit NPM security: preventing supply chain attacks art-1952
crit CISA KEV: CVE-2022-41091 — Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability art-1953
crit CISA KEV: CVE-2022-41073 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-1954
crit CISA KEV: CVE-2022-41125 — Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability art-1955
crit CISA KEV: CVE-2022-41128 — Microsoft Windows Scripting Languages Remote Code Execution Vulnerability art-1956
crit CISA KEV: CVE-2021-25337 — Samsung Mobile Devices Improper Access Control Vulnerability art-1957
crit Key points from Google and Accenture's ransomware white paper art-1958
med A day in the life of a CISO: Chris Hughes of Aquia art-1959
crit Secure Python URL validation art-1960
crit Update: OpenSSL high severity vulnerabilities art-1962
med Ruby on Rails Docker for local development environment art-1963
crit New OpenSSL critical vulnerability: What you need to know art-1968
crit CISA KEV: CVE-2022-3723 — Google Chromium V8 Type Confusion Vulnerability art-1971
crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1972
med Node.js multithreading with worker threads series: worker_threads tutorial art-1973
crit CISA KEV: CVE-2022-42827 — Apple iOS and iPadOS Out-of-Bounds Write Vulnerability art-1975
crit CISA KEV: CVE-2020-3433 — Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability art-1977
crit CISA KEV: CVE-2020-3153 — Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability art-1978
crit CISA KEV: CVE-2018-19323 — GIGABYTE Multiple Products Privilege Escalation Vulnerability art-1979
crit CISA KEV: CVE-2018-19322 — GIGABYTE Multiple Products Code Execution Vulnerability art-1980
crit CISA KEV: CVE-2018-19321 — GIGABYTE Multiple Products Privilege Escalation Vulnerability art-1981
crit CISA KEV: CVE-2018-19320 — GIGABYTE Multiple Products Unspecified Vulnerability art-1982
crit CISA KEV: CVE-2022-41352 — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability art-1986
crit CISA KEV: CVE-2021-3493 — Linux Kernel Privilege Escalation Vulnerability art-1987
high SREs bring ORDER(R) to CHAOS art-1988
crit Reviewing CVE-2022-42889: The arbitrary code execution vulnerability in Apache Commons Text art-1989
med Cloud security fundamentals part 2: Prevention and secure design art-1995
high Improving code quality with linting in Python art-1998
crit CISA KEV: CVE-2022-40684 — Fortinet Multiple Products Authentication Bypass Vulnerability art-2001
crit CISA KEV: CVE-2022-41033 — Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability art-2002
high Container images simplified with Ko art-2004
high Cloud security fundamentals part 1: Know your environment art-2006
crit Command injection vulnerability in Snyk CLI released prior to September 1, 2022 (older than v1.996.0) art-2011
med Choosing the best Node.js Docker image art-2013
crit CISA KEV: CVE-2022-41082 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2014
crit CISA KEV: CVE-2022-36804 — Atlassian Bitbucket Server and Data Center Command Injection Vulnerability art-2015
crit CISA KEV: CVE-2022-3236 — Sophos Firewall Code Injection Vulnerability art-2023
crit CISA KEV: CVE-2022-35405 — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability art-2024
high Avoiding SMTP Injection: A Whitebox primer art-2029
crit CISA KEV: CVE-2022-40139 — Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability art-2030
crit CISA KEV: CVE-2013-6282 — Linux Kernel Improper Input Validation Vulnerability art-2031
crit CISA KEV: CVE-2013-2597 — Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability art-2032
crit CISA KEV: CVE-2013-2596 — Linux Kernel Integer Overflow Vulnerability art-2033
crit CISA KEV: CVE-2013-2094 — Linux Kernel Privilege Escalation Vulnerability art-2034
crit CISA KEV: CVE-2010-2568 — Microsoft Windows Remote Code Execution Vulnerability art-2035
crit CISA KEV: CVE-2022-37969 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability art-2036
crit CISA KEV: CVE-2022-32917 — Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability art-2037
high How Spotify uses Snyk to secure the SDLC art-2038
med How Onna Technologies uses Snyk & Sysdig to secure the SDLC while saving time and money art-2039
crit CISA KEV: CVE-2022-3075 — Google Chromium Mojo Insufficient Data Validation Vulnerability art-2042
crit CISA KEV: CVE-2022-27593 — QNAP Photo Station Externally Controlled Reference Vulnerability art-2043
crit CISA KEV: CVE-2022-26258 — D-Link DIR-820L Remote Code Execution Vulnerability art-2044
crit CISA KEV: CVE-2020-9934 — Apple iOS, iPadOS, and macOS Input Validation Vulnerability art-2045
crit CISA KEV: CVE-2018-7445 — MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability art-2046
crit CISA KEV: CVE-2018-6530 — D-Link Multiple Routers OS Command Injection Vulnerability art-2047
crit CISA KEV: CVE-2018-2628 — Oracle WebLogic Server Unspecified Vulnerability art-2048
crit CISA KEV: CVE-2018-13374 — Fortinet FortiOS and FortiADC Improper Access Control Vulnerability art-2049
crit CISA KEV: CVE-2017-5521 — NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability art-2050
crit CISA KEV: CVE-2011-4723 — D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability art-2051
crit CISA KEV: CVE-2011-1823 — Android OS Privilege Escalation Vulnerability art-2052
high Cloud Security at Blackhat and Defcon 2022 art-2056
crit The npm faker package and the unexpected demise of open source libraries art-2058
crit Solve Hack the Box and other CTF challenges with Snyk art-2059
high Building a secure API with gRPC art-2066
crit CISA KEV: CVE-2022-26352 — dotCMS Unrestricted Upload of File Vulnerability art-2067
crit CISA KEV: CVE-2022-24706 — Apache CouchDB Insecure Default Initialization of Resource Vulnerability art-2068
crit CISA KEV: CVE-2022-24112 — Apache APISIX Authentication Bypass Vulnerability art-2069
crit CISA KEV: CVE-2022-22963 — VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability art-2070
crit CISA KEV: CVE-2022-2294 — WebRTC Heap Buffer Overflow Vulnerability art-2071
crit CISA KEV: CVE-2021-39226 — Grafana Authentication Bypass Vulnerability art-2072
crit CISA KEV: CVE-2021-38406 — Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability art-2073
crit CISA KEV: CVE-2021-31010 — Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability art-2074
crit CISA KEV: CVE-2020-36193 — PEAR Archive_Tar Improper Link Resolution Vulnerability art-2075
crit CISA KEV: CVE-2020-28949 — PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability art-2076
high Rediscovering argument injection when using VCS tools — git and mercurial art-2080
crit How open source C++ code can introduce security risks art-2082
crit CISA KEV: CVE-2022-0028 — Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability art-2084
high The dangers of assert in Python art-2085
crit CISA KEV: CVE-2022-22536 — SAP Multiple Products HTTP Request Smuggling Vulnerability art-2086
crit CISA KEV: CVE-2022-32894 — Apple iOS and macOS Out-of-Bounds Write Vulnerability art-2087
crit CISA KEV: CVE-2022-32893 — Apple iOS and macOS Out-of-Bounds Write Vulnerability art-2088
crit CISA KEV: CVE-2022-2856 — Google Chromium Intents Insufficient Input Validation Vulnerability art-2089
crit CISA KEV: CVE-2022-26923 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability art-2090
crit CISA KEV: CVE-2022-21971 — Microsoft Windows Runtime Remote Code Execution Vulnerability art-2091
crit CISA KEV: CVE-2017-15944 — Palo Alto Networks PAN-OS Remote Code Execution Vulnerability art-2092
high Ruby gem installations can expose you to lockfile injection attacks art-2093
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
crit CISA KEV: CVE-2022-27925 — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability art-2098
crit Controlling your server with a reverse shell attack art-2099
crit CISA KEV: CVE-2022-34713 — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability art-2101
crit CISA KEV: CVE-2022-30333 — RARLAB UnRAR Directory Traversal Vulnerability art-2102
high Securing PHP containers art-2105
high Slidev 101: Coding presentations with Markdown art-2106
crit CISA KEV: CVE-2022-27924 — Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability art-2107
crit CISA KEV: CVE-2022-26138 — Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability art-2111
med Addressing cybersecurity challenges in open source software with the Linux Foundation art-2116
high Improving developer experience with security tools at Pinterest art-2121
crit CISA KEV: CVE-2022-22047 — Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability art-2123
crit Exploring CVE-2022-33980: the Apache Commons configuration RCE vulnerability art-2124
crit CISA KEV: CVE-2022-26925 — Microsoft Windows LSA Spoofing Vulnerability art-2127
crit CISA KEV: CVE-2022-29499 — Mitel MiVoice Connect Data Validation Vulnerability art-2132
crit CISA KEV: CVE-2021-30533 — Google Chromium PopupBlocker Security Bypass Vulnerability art-2133
crit CISA KEV: CVE-2021-4034 — Red Hat Polkit Out-of-Bounds Read and Write Vulnerability art-2134
crit CISA KEV: CVE-2021-30983 — Apple iOS and iPadOS Buffer Overflow Vulnerability art-2135
crit CISA KEV: CVE-2020-3837 — Apple Multiple Products Memory Corruption Vulnerability art-2136
crit CISA KEV: CVE-2020-9907 — Apple Multiple Products Memory Corruption Vulnerability art-2137
crit CISA KEV: CVE-2019-8605 — Apple Multiple Products Use-After-Free Vulnerability art-2138
crit CISA KEV: CVE-2018-4344 — Apple Multiple Products Memory Corruption Vulnerability art-2139
crit CISA KEV: CVE-2022-30190 — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability art-2144
crit CISA KEV: CVE-2021-38163 — SAP NetWeaver Unrestricted File Upload Vulnerability art-2146
crit CISA KEV: CVE-2016-2386 — SAP NetWeaver SQL Injection Vulnerability art-2147
crit CISA KEV: CVE-2016-2388 — SAP NetWeaver Information Disclosure Vulnerability art-2148
crit CISA KEV: CVE-2019-7195 — QNAP Photo Station Path Traversal Vulnerability art-2151
crit CISA KEV: CVE-2019-7194 — QNAP Photo Station Path Traversal Vulnerability art-2152
crit CISA KEV: CVE-2019-7193 — QNAP QTS Improper Input Validation Vulnerability art-2153
crit CISA KEV: CVE-2019-7192 — QNAP Photo Station Improper Access Control Vulnerability art-2154
crit CISA KEV: CVE-2019-5825 — Google Chromium V8 Out-of-Bounds Write Vulnerability art-2155
crit CISA KEV: CVE-2019-15271 — Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability art-2156
crit CISA KEV: CVE-2018-6065 — Google Chromium V8 Integer Overflow Vulnerability art-2157
crit CISA KEV: CVE-2018-4990 — Adobe Acrobat and Reader Double Free Vulnerability art-2158
crit CISA KEV: CVE-2018-17480 — Google Chromium V8 Out-of-Bounds Write Vulnerability art-2159
crit CISA KEV: CVE-2018-17463 — Google Chromium V8 Remote Code Execution Vulnerability art-2160
crit CISA KEV: CVE-2017-6862 — NETGEAR Multiple Devices Buffer Overflow Vulnerability art-2161
crit CISA KEV: CVE-2017-5070 — Google Chromium V8 Type Confusion Vulnerability art-2162
crit CISA KEV: CVE-2017-5030 — Google Chromium V8 Memory Corruption Vulnerability art-2163
crit CISA KEV: CVE-2016-5198 — Google Chromium V8 Out-of-Bounds Memory Vulnerability art-2164
crit CISA KEV: CVE-2016-1646 — Google Chromium V8 Out-of-Bounds Read Vulnerability art-2165
crit CISA KEV: CVE-2013-1331 — Microsoft Office Buffer Overflow Vulnerability art-2166
crit CISA KEV: CVE-2012-5054 — Adobe Flash Player Integer Overflow Vulnerability art-2167
crit CISA KEV: CVE-2012-4969 — Microsoft Internet Explorer Use-After-Free Vulnerability art-2168
crit CISA KEV: CVE-2012-1889 — Microsoft XML Core Services Memory Corruption Vulnerability art-2169
crit CISA KEV: CVE-2012-0767 — Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability art-2170
crit CISA KEV: CVE-2012-0754 — Adobe Flash Player Memory Corruption Vulnerability art-2171
crit CISA KEV: CVE-2012-0151 — Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability art-2172
crit CISA KEV: CVE-2011-2462 — Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability art-2173
crit CISA KEV: CVE-2011-0609 — Adobe Flash Player Unspecified Vulnerability art-2174
crit CISA KEV: CVE-2010-2883 — Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability art-2175
crit CISA KEV: CVE-2010-2572 — Microsoft PowerPoint Buffer Overflow Vulnerability art-2176
crit CISA KEV: CVE-2010-1297 — Adobe Flash Player Memory Corruption Vulnerability art-2177
crit CISA KEV: CVE-2009-4324 — Adobe Acrobat and Reader Use-After-Free Vulnerability art-2178
crit CISA KEV: CVE-2009-3953 — Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability art-2179
crit CISA KEV: CVE-2009-1862 — Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability art-2180
crit CISA KEV: CVE-2009-0563 — Microsoft Office Buffer Overflow Vulnerability art-2181
crit CISA KEV: CVE-2009-0557 — Microsoft Office Object Record Corruption Vulnerability art-2182
crit CISA KEV: CVE-2008-0655 — Adobe Acrobat and Reader Unspecified Vulnerability art-2183
crit CISA KEV: CVE-2007-5659 — Adobe Acrobat and Reader Buffer Overflow Vulnerability art-2184
crit CISA KEV: CVE-2006-2492 — Microsoft Word Malformed Object Pointer Vulnerability art-2185
high Safer together: Snyk and CISPA collaborate for the greater good art-2186
crit CISA KEV: CVE-2022-26134 — Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability art-2188
crit CISA KEV: CVE-2019-3010 — Oracle Solaris Privilege Escalation Vulnerability art-2192
crit CISA KEV: CVE-2016-3393 — Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability art-2193
crit CISA KEV: CVE-2016-7256 — Microsoft Windows Open Type Font Remote Code Execution Vulnerability art-2194
crit CISA KEV: CVE-2016-1010 — Adobe Flash Player and AIR Integer Overflow Vulnerability art-2195
crit CISA KEV: CVE-2016-0984 — Adobe Flash Player and AIR Use-After-Free Vulnerability art-2196
crit CISA KEV: CVE-2016-0034 — Microsoft Silverlight Runtime Remote Code Execution Vulnerability art-2197
crit CISA KEV: CVE-2015-0310 — Adobe Flash Player ASLR Bypass Vulnerability art-2198
crit CISA KEV: CVE-2015-0016 — Microsoft Windows TS WebProxy Directory Traversal Vulnerability art-2199
crit CISA KEV: CVE-2015-0071 — Microsoft Internet Explorer ASLR Bypass Vulnerability art-2200
crit CISA KEV: CVE-2015-2360 — Microsoft Win32k Privilege Escalation Vulnerability art-2201
crit CISA KEV: CVE-2015-2425 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2202
crit CISA KEV: CVE-2015-1769 — Microsoft Windows Mount Manager Privilege Escalation Vulnerability art-2203
crit CISA KEV: CVE-2015-4495 — Mozilla Firefox Security Feature Bypass Vulnerability art-2204
crit CISA KEV: CVE-2015-8651 — Adobe Flash Player Integer Overflow Vulnerability art-2205
crit CISA KEV: CVE-2015-6175 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2206
crit CISA KEV: CVE-2015-1671 — Microsoft Windows Remote Code Execution Vulnerability art-2207
crit CISA KEV: CVE-2014-4148 — Microsoft Windows Remote Code Execution Vulnerability art-2208
crit CISA KEV: CVE-2014-8439 — Adobe Flash Player Dereferenced Pointer Vulnerability art-2209
crit CISA KEV: CVE-2014-4123 — Microsoft Internet Explorer Privilege Escalation Vulnerability art-2210
crit CISA KEV: CVE-2014-0546 — Adobe Reader and Acrobat Sandbox Bypass Vulnerability art-2211
crit CISA KEV: CVE-2014-2817 — Microsoft Internet Explorer Privilege Escalation Vulnerability art-2212
crit CISA KEV: CVE-2014-4077 — Microsoft IME Japanese Privilege Escalation Vulnerability art-2213
crit CISA KEV: CVE-2014-3153 — Linux Kernel Privilege Escalation Vulnerability art-2214
crit CISA KEV: CVE-2013-7331 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2215
crit CISA KEV: CVE-2013-3993 — IBM InfoSphere BigInsights Invalid Input Vulnerability art-2216
crit CISA KEV: CVE-2013-3896 — Microsoft Silverlight Information Disclosure Vulnerability art-2217
crit CISA KEV: CVE-2013-2423 — Oracle JRE Unspecified Vulnerability art-2218
crit CISA KEV: CVE-2013-0431 — Oracle JRE Sandbox Bypass Vulnerability art-2219
crit CISA KEV: CVE-2013-0422 — Oracle JRE Remote Code Execution Vulnerability art-2220
crit CISA KEV: CVE-2013-0074 — Microsoft Silverlight Double Dereference Vulnerability art-2221
crit CISA KEV: CVE-2012-1710 — Oracle Fusion Middleware Unspecified Vulnerability art-2222
crit CISA KEV: CVE-2010-1428 — Red Hat JBoss Information Disclosure Vulnerability art-2223
crit CISA KEV: CVE-2010-0840 — Oracle JRE Unspecified Vulnerability art-2224
crit CISA KEV: CVE-2010-0738 — Red Hat JBoss Authentication Bypass Vulnerability art-2225
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2226
crit CISA KEV: CVE-2018-8611 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2227
crit CISA KEV: CVE-2018-19953 — QNAP NAS File Station Cross-Site Scripting Vulnerability art-2228
crit CISA KEV: CVE-2018-19949 — QNAP NAS File Station Command Injection Vulnerability art-2229
crit CISA KEV: CVE-2018-19943 — QNAP NAS File Station Cross-Site Scripting Vulnerability art-2230
crit CISA KEV: CVE-2017-0147 — Microsoft Windows SMBv1 Information Disclosure Vulnerability art-2231
crit CISA KEV: CVE-2017-0022 — Microsoft XML Core Services Information Disclosure Vulnerability art-2232
crit CISA KEV: CVE-2017-0005 — Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability art-2233
crit CISA KEV: CVE-2017-0149 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2234
crit CISA KEV: CVE-2017-0210 — Microsoft Internet Explorer Privilege Escalation Vulnerability art-2235
crit CISA KEV: CVE-2017-8291 — Artifex Ghostscript Type Confusion Vulnerability art-2236
crit CISA KEV: CVE-2017-8543 — Microsoft Windows Search Remote Code Execution Vulnerability art-2237
crit CISA KEV: CVE-2017-18362 — Kaseya VSA SQL Injection Vulnerability art-2238
crit CISA KEV: CVE-2016-0162 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2239
crit CISA KEV: CVE-2016-3351 — Microsoft Internet Explorer and Edge Information Disclosure Vulnerability art-2240
crit CISA KEV: CVE-2016-4655 — Apple iOS Information Disclosure Vulnerability art-2241
crit CISA KEV: CVE-2016-4656 — Apple iOS Memory Corruption Vulnerability art-2242
crit CISA KEV: CVE-2016-4657 — Apple iOS Webkit Memory Corruption Vulnerability art-2243
crit CISA KEV: CVE-2016-6366 — Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability art-2244
crit CISA KEV: CVE-2016-6367 — Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability art-2245
crit CISA KEV: CVE-2016-3298 — Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability art-2246
crit CISA KEV: CVE-2022-20821 — Cisco IOS XR Open Port Vulnerability art-2247
crit CISA KEV: CVE-2021-1048 — Android Kernel Use-After-Free Vulnerability art-2248
crit CISA KEV: CVE-2021-0920 — Android Kernel Race Condition Vulnerability art-2249
crit CISA KEV: CVE-2021-30883 — Apple Multiple Products Memory Corruption Vulnerability art-2250
crit CISA KEV: CVE-2020-1027 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2251
crit CISA KEV: CVE-2020-0638 — Microsoft Update Notification Manager Privilege Escalation Vulnerability art-2252
crit CISA KEV: CVE-2019-7286 — Apple Multiple Products Memory Corruption Vulnerability art-2253
crit CISA KEV: CVE-2019-7287 — Apple iOS Memory Corruption Vulnerability art-2254
crit CISA KEV: CVE-2019-0676 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2255
crit CISA KEV: CVE-2019-5786 — Google Chrome Blink Use-After-Free Vulnerability art-2256
crit CISA KEV: CVE-2019-0703 — Microsoft Windows SMB Information Disclosure Vulnerability art-2257
crit CISA KEV: CVE-2019-0880 — Microsoft Windows Privilege Escalation Vulnerability art-2258
crit CISA KEV: CVE-2019-13720 — Google Chrome WebAudio Use-After-Free Vulnerability art-2259
crit CISA KEV: CVE-2019-11707 — Mozilla Firefox and Thunderbird Type Confusion Vulnerability art-2260
crit CISA KEV: CVE-2019-11708 — Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability art-2261
crit CISA KEV: CVE-2019-8720 — WebKitGTK Memory Corruption Vulnerability art-2262
crit CISA KEV: CVE-2019-18426 — WhatsApp Cross-Site Scripting Vulnerability art-2263
crit CISA KEV: CVE-2019-1385 — Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability art-2264
crit CISA KEV: CVE-2019-1130 — Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability art-2265
crit CISA KEV: CVE-2018-5002 — Adobe Flash Player Stack-based Buffer Overflow Vulnerability art-2266
crit CISA KEV: CVE-2018-8589 — Microsoft Win32k Privilege Escalation Vulnerability art-2267
high How LiveRamp used Snyk to remediate Log4Shell art-2269
med Cloud security challenges art-2270
crit CISA KEV: CVE-2022-30525 — Zyxel Multiple Firewalls OS Command Injection Vulnerability art-2273
crit CISA KEV: CVE-2022-22947 — VMware Spring Cloud Gateway Code Injection Vulnerability art-2274
crit CISA KEV: CVE-2022-1388 — F5 BIG-IP Missing Authentication Vulnerability art-2277
crit 3 Jedi-inspired lessons to level up your JavaScript security art-2286
crit CISA KEV: CVE-2021-1789 — Apple Multiple Products Type Confusion Vulnerability art-2288
crit CISA KEV: CVE-2019-8506 — Apple Multiple Products Type Confusion Vulnerability art-2289
crit CISA KEV: CVE-2014-4113 — Microsoft Win32k Privilege Escalation Vulnerability art-2290
crit CISA KEV: CVE-2014-0322 — Microsoft Internet Explorer Use-After-Free Vulnerability art-2291
crit CISA KEV: CVE-2014-0160 — OpenSSL Information Disclosure Vulnerability art-2292
med Building Docker images in Kubernetes art-2294
crit Targeted npm dependency confusion attack caught red-handed art-2296
high Under the C: A glance at C/C++ vulnerabilities in Python land art-2298
med Generating fake security data with Python and faker-security art-2303
crit CISA KEV: CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability art-2305
crit CISA KEV: CVE-2022-26904 — Microsoft Windows User Profile Service Privilege Escalation Vulnerability art-2306
crit CISA KEV: CVE-2022-21919 — Microsoft Windows User Profile Service Privilege Escalation Vulnerability art-2307
crit CISA KEV: CVE-2022-0847 — Linux Kernel Privilege Escalation Vulnerability art-2308
crit CISA KEV: CVE-2021-41357 — Microsoft Win32k Privilege Escalation Vulnerability art-2309
crit CISA KEV: CVE-2021-40450 — Microsoft Win32k Privilege Escalation Vulnerability art-2310
crit CISA KEV: CVE-2019-1003029 — Jenkins Script Security Plugin Sandbox Bypass Vulnerability art-2311
crit Modernizing SAST rules maintenance to catch vulnerabilities faster art-2316
crit CISA KEV: CVE-2018-6882 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-2317
crit CISA KEV: CVE-2019-3568 — WhatsApp VOIP Stack Buffer Overflow Vulnerability art-2318
crit CISA KEV: CVE-2022-22718 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-2319
high An unintimidating introduction to the dark arts of C/C++ vulnerabilities art-2320
crit CISA KEV: CVE-2022-22960 — VMware Multiple Products Privilege Escalation Vulnerability art-2321
crit CISA KEV: CVE-2022-1364 — Google Chromium V8 Type Confusion Vulnerability art-2322
crit CISA KEV: CVE-2019-3929 — Crestron Multiple Products Command Injection Vulnerability art-2323
crit CISA KEV: CVE-2019-16057 — D-Link DNS-320 Remote Code Execution Vulnerability art-2324
crit CISA KEV: CVE-2018-7841 — Schneider Electric U.motion Builder SQL Injection Vulnerability art-2325
crit CISA KEV: CVE-2016-4523 — Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability art-2326
crit CISA KEV: CVE-2014-0780 — InduSoft Web Studio NTWebServer Directory Traversal Vulnerability art-2327
crit CISA KEV: CVE-2010-5330 — Ubiquiti AirOS Command Injection Vulnerability art-2328
crit CISA KEV: CVE-2007-3010 — Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability art-2329
crit CISA KEV: CVE-2022-22954 — VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability art-2330
crit CISA KEV: CVE-2022-24521 — Microsoft Windows CLFS Driver Privilege Escalation Vulnerability art-2332
crit CISA KEV: CVE-2018-7602 — Drupal Core Remote Code Execution Vulnerability art-2333
crit CISA KEV: CVE-2018-20753 — Kaseya VSA Remote Code Execution Vulnerability art-2334
crit CISA KEV: CVE-2015-5123 — Adobe Flash Player Use-After-Free Vulnerability art-2335
crit CISA KEV: CVE-2015-5122 — Adobe Flash Player Use-After-Free Vulnerability art-2336
crit CISA KEV: CVE-2015-3113 — Adobe Flash Player Heap-Based Buffer Overflow Vulnerability art-2337
crit CISA KEV: CVE-2015-2502 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2338
crit CISA KEV: CVE-2015-0313 — Adobe Flash Player Use-After-Free Vulnerability art-2339
crit CISA KEV: CVE-2015-0311 — Adobe Flash Player Remote Code Execution Vulnerability art-2340
crit CISA KEV: CVE-2014-9163 — Adobe Flash Player Stack-Based Buffer Overflow Vulnerability art-2341
high Improving GraphQL security with static analysis and Snyk Code art-2342
crit CISA KEV: CVE-2022-23176 — WatchGuard Firebox and XTM Privilege Escalation Vulnerability art-2343
crit CISA KEV: CVE-2021-42287 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability art-2344
crit CISA KEV: CVE-2021-42278 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability art-2345
crit CISA KEV: CVE-2021-39793 — Google Pixel Out-of-Bounds Write Vulnerability art-2346
crit CISA KEV: CVE-2021-27852 — Checkbox Survey Deserialization of Untrusted Data Vulnerability art-2347
crit CISA KEV: CVE-2021-22600 — Linux Kernel Privilege Escalation Vulnerability art-2348
crit CISA KEV: CVE-2020-2509 — QNAP Network-Attached Storage (NAS) Command Injection Vulnerability art-2349
crit CISA KEV: CVE-2017-11317 — Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability art-2350
crit Spring4Shell extends to Glassfish and Payara: same vulnerability, new exploit art-2351
crit Getting started with React Native security art-2352
crit CISA KEV: CVE-2021-3156 — Sudo Heap-Based Buffer Overflow Vulnerability art-2354
crit CISA KEV: CVE-2021-31166 — Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability art-2355
crit CISA KEV: CVE-2017-0148 — Microsoft SMBv1 Server Remote Code Execution Vulnerability art-2356
med Snyk Open Source adds C/C++ security scanning for unmanaged dependencies art-2357
crit Exploring 3 types of directory traversal vulnerabilities in C/C++ art-2359
crit CISA KEV: CVE-2022-22965 — Spring Framework JDK 9+ Remote Code Execution Vulnerability art-2360
crit CISA KEV: CVE-2022-22675 — Apple macOS Out-of-Bounds Write Vulnerability art-2361
crit CISA KEV: CVE-2022-22674 — Apple macOS Out-of-Bounds Read Vulnerability art-2362
crit CISA KEV: CVE-2021-45382 — D-Link Multiple Routers Remote Code Execution Vulnerability art-2363
crit Alert: LaughTilYouCry ransomware sabotages npm package (with puns) art-2365
crit Spring4Shell: The zero-day RCE in the Spring Framework explained art-2366
crit Spring4Shell: What we know about the Java RCE vulnerability art-2368
crit CISA KEV: CVE-2022-26871 — Trend Micro Apex Central Arbitrary File Upload Vulnerability art-2369
crit CISA KEV: CVE-2022-1040 — Sophos Firewall Authentication Bypass Vulnerability art-2370
crit CISA KEV: CVE-2021-34484 — Microsoft Windows User Profile Service Privilege Escalation Vulnerability art-2371
crit CISA KEV: CVE-2021-28799 — QNAP NAS Improper Authorization Vulnerability art-2372
crit CISA KEV: CVE-2021-21551 — Dell dbutil Driver Insufficient Access Control Vulnerability art-2373
crit CISA KEV: CVE-2018-10562 — Dasan GPON Routers Command Injection Vulnerability art-2374
high Using the Snyk Vulnerability Database to find projects for The Big Fix art-2375
high Building a secure GraphQL API with Node.js art-2376
high Meet (and join) our newest Snyk Ambassadors! art-2377
crit CISA KEV: CVE-2022-1096 — Google Chromium V8 Type Confusion Vulnerability art-2378
crit CISA KEV: CVE-2022-0543 — Debian-specific Redis Server Lua Sandbox Escape Vulnerability art-2379
crit CISA KEV: CVE-2021-38646 — Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability art-2380
crit CISA KEV: CVE-2021-34486 — Microsoft Windows Event Tracing Privilege Escalation Vulnerability art-2381
crit CISA KEV: CVE-2021-26085 — Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability art-2382
crit CISA KEV: CVE-2021-20028 — SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability art-2383
crit CISA KEV: CVE-2019-7483 — SonicWall SMA100 Directory Traversal Vulnerability art-2384
crit CISA KEV: CVE-2018-8440 — Microsoft Windows Privilege Escalation Vulnerability art-2385
crit CISA KEV: CVE-2018-8406 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability art-2386
crit CISA KEV: CVE-2018-8405 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability art-2387
crit CISA KEV: CVE-2017-0213 — Microsoft Windows Privilege Escalation Vulnerability art-2388
crit CISA KEV: CVE-2017-0059 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2389
crit CISA KEV: CVE-2017-0037 — Microsoft Edge and Internet Explorer Type Confusion Vulnerability art-2390
crit CISA KEV: CVE-2016-7201 — Microsoft Edge Memory Corruption Vulnerability art-2391
crit CISA KEV: CVE-2016-7200 — Microsoft Edge Memory Corruption Vulnerability art-2392
crit CISA KEV: CVE-2016-0189 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2393
crit CISA KEV: CVE-2016-0151 — Microsoft Windows CSRSS Security Feature Bypass Vulnerability art-2394
crit CISA KEV: CVE-2016-0040 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2395
crit CISA KEV: CVE-2015-2426 — Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability art-2396
crit CISA KEV: CVE-2015-2419 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2397
crit CISA KEV: CVE-2015-1770 — Microsoft Office Uninitialized Memory Use Vulnerability art-2398
crit CISA KEV: CVE-2013-3660 — Microsoft Win32k Privilege Escalation Vulnerability art-2399
crit CISA KEV: CVE-2013-2729 — Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability art-2400
crit CISA KEV: CVE-2013-2551 — Microsoft Internet Explorer Use-After-Free Vulnerability art-2401
crit CISA KEV: CVE-2013-2465 — Oracle Java SE Unspecified Vulnerability art-2402
crit CISA KEV: CVE-2013-1690 — Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability art-2403
crit CISA KEV: CVE-2012-5076 — Oracle Java SE Sandbox Bypass Vulnerability art-2404
crit CISA KEV: CVE-2012-2539 — Microsoft Word Remote Code Execution Vulnerability art-2405
crit CISA KEV: CVE-2012-2034 — Adobe Flash Player Memory Corruption Vulnerability art-2406
crit CISA KEV: CVE-2012-0518 — Oracle Fusion Middleware Unspecified Vulnerability art-2407
crit CISA KEV: CVE-2011-2005 — Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability art-2408
crit CISA KEV: CVE-2010-4398 — Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability art-2409
crit CISA KEV: CVE-2022-26318 — WatchGuard Firebox and XTM Appliances Arbitrary Code Execution art-2410
crit CISA KEV: CVE-2022-26143 — MiCollab, MiVoice Business Express Access Control Vulnerability art-2411
crit CISA KEV: CVE-2022-21999 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-2412
crit CISA KEV: CVE-2021-42237 — Sitecore XP Remote Command Execution Vulnerability art-2413
crit CISA KEV: CVE-2021-22941 — Citrix ShareFile Improper Access Control Vulnerability art-2414
crit CISA KEV: CVE-2020-9377 — D-Link DIR-610 Devices Remote Command Execution art-2415
crit CISA KEV: CVE-2020-9054 — Zyxel Multiple NAS Devices OS Command Injection Vulnerability art-2416
crit CISA KEV: CVE-2020-7247 — OpenSMTPD Remote Code Execution Vulnerability art-2417
crit CISA KEV: CVE-2020-5410 — VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability art-2418
crit CISA KEV: CVE-2020-25223 — Sophos SG UTM Remote Code Execution Vulnerability art-2419
crit CISA KEV: CVE-2020-2506 — QNAP Helpdesk Improper Access Control Vulnerability art-2420
crit CISA KEV: CVE-2020-2021 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability art-2421
crit CISA KEV: CVE-2020-1956 — Apache Kylin OS Command Injection Vulnerability art-2422
crit CISA KEV: CVE-2020-1631 — Juniper Junos OS Path Traversal Vulnerability art-2423
crit CISA KEV: CVE-2019-6340 — Drupal Core Remote Code Execution Vulnerability art-2424
crit CISA KEV: CVE-2019-2616 — Oracle BI Publisher Unauthorized Access Vulnerability art-2425
crit CISA KEV: CVE-2019-16920 — D-Link Multiple Routers Command Injection Vulnerability art-2426
crit CISA KEV: CVE-2019-15107 — Webmin Command Injection Vulnerability art-2427
crit CISA KEV: CVE-2019-12991 — Citrix SD-WAN and NetScaler Command Injection Vulnerability art-2428
crit CISA KEV: CVE-2019-12989 — Citrix SD-WAN and NetScaler SQL Injection Vulnerability art-2429
crit CISA KEV: CVE-2019-11043 — PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability art-2430
crit CISA KEV: CVE-2019-10068 — Kentico Xperience Deserialization of Untrusted Data Vulnerability art-2431
crit CISA KEV: CVE-2019-1003030 — Jenkins Matrix Project Plugin Remote Code Execution Vulnerability art-2432
crit CISA KEV: CVE-2019-0903 — Microsoft GDI Remote Code Execution Vulnerability art-2433
crit CISA KEV: CVE-2018-8414 — Microsoft Windows Shell Remote Code Execution Vulnerability art-2434
crit CISA KEV: CVE-2018-8373 — Microsoft Scripting Engine Memory Corruption Vulnerability art-2435
crit CISA KEV: CVE-2018-6961 — VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability art-2436
crit CISA KEV: CVE-2018-14839 — LG N1A1 NAS Remote Command Execution Vulnerability art-2437
crit CISA KEV: CVE-2018-1273 — VMware Tanzu Spring Data Commons Property Binder Vulnerability art-2438
crit CISA KEV: CVE-2018-11138 — Quest KACE System Management Appliance Remote Command Execution Vulnerability art-2439
crit CISA KEV: CVE-2018-0147 — Cisco Secure Access Control System Java Deserialization Vulnerability art-2440
crit CISA KEV: CVE-2018-0125 — Cisco VPN Routers Remote Code Execution Vulnerability art-2441
crit CISA KEV: CVE-2017-6334 — NETGEAR DGN2200 Devices OS Command Injection Vulnerability art-2442
crit CISA KEV: CVE-2017-6316 — Citrix Multiple Products Remote Code Execution Vulnerability art-2443
crit CISA KEV: CVE-2017-3881 — Cisco IOS and IOS XE Remote Code Execution Vulnerability art-2444
crit CISA KEV: CVE-2017-12617 — Apache Tomcat Remote Code Execution Vulnerability art-2445
crit CISA KEV: CVE-2017-12615 — Apache Tomcat on Windows Remote Code Execution Vulnerability art-2446
crit CISA KEV: CVE-2017-0146 — Microsoft Windows SMB Remote Code Execution Vulnerability art-2447
crit CISA KEV: CVE-2016-7892 — Adobe Flash Player Use-After-Free Vulnerability art-2448
crit CISA KEV: CVE-2016-4171 — Adobe Flash Player Remote Code Execution Vulnerability art-2449
crit CISA KEV: CVE-2016-1555 — NETGEAR Multiple WAP Devices Command Injection Vulnerability art-2450
crit CISA KEV: CVE-2016-11021 — D-Link DCS-930L Devices OS Command Injection Vulnerability art-2451
crit CISA KEV: CVE-2016-10174 — NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability art-2452
crit CISA KEV: CVE-2016-0752 — Ruby on Rails Directory Traversal Vulnerability art-2453
crit CISA KEV: CVE-2015-4068 — Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability art-2454
crit CISA KEV: CVE-2015-3035 — TP-Link Multiple Archer Devices Directory Traversal Vulnerability art-2455
crit CISA KEV: CVE-2015-1427 — Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability art-2456
crit CISA KEV: CVE-2015-1187 — D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability art-2457
crit CISA KEV: CVE-2015-0666 — Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability art-2458
crit CISA KEV: CVE-2014-6332 — Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability art-2459
crit CISA KEV: CVE-2014-6324 — Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability art-2460
crit CISA KEV: CVE-2014-6287 — Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability art-2461
crit CISA KEV: CVE-2014-3120 — Elasticsearch Remote Code Execution Vulnerability art-2462
crit CISA KEV: CVE-2014-0130 — Ruby on Rails Directory Traversal Vulnerability art-2463
crit CISA KEV: CVE-2013-5223 — D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability art-2464
crit CISA KEV: CVE-2013-4810 — HP Multiple Products Remote Code Execution Vulnerability art-2465
crit CISA KEV: CVE-2013-2251 — Apache Struts Improper Input Validation Vulnerability art-2466
crit CISA KEV: CVE-2012-1823 — PHP-CGI Query String Parameter Vulnerability art-2467
crit CISA KEV: CVE-2010-4345 — Exim Privilege Escalation Vulnerability art-2468
crit CISA KEV: CVE-2010-4344 — Exim Heap-Based Buffer Overflow Vulnerability art-2469
crit CISA KEV: CVE-2010-3035 — Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability art-2470
crit CISA KEV: CVE-2010-2861 — Adobe ColdFusion Directory Traversal Vulnerability art-2471
crit CISA KEV: CVE-2009-2055 — Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability art-2472
crit CISA KEV: CVE-2009-1151 — phpMyAdmin Remote Code Execution Vulnerability art-2473
crit CISA KEV: CVE-2009-0927 — Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability art-2474
crit CISA KEV: CVE-2005-2773 — HP OpenView Network Node Manager Remote Code Execution Vulnerability art-2475
high How Snyk helps satisfy White House cybersecurity recommendations art-2477
crit Protestware is trending in open source: 4 different types and their impact art-2480
high dompdf security alert: RCE vulnerability found in popular PHP PDF library art-2481
high Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine art-2482
crit CISA KEV: CVE-2020-5135 — SonicWall SonicOS Buffer Overflow Vulnerability art-2485
crit CISA KEV: CVE-2019-1405 — Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability art-2486
crit CISA KEV: CVE-2019-1322 — Microsoft Windows Privilege Escalation Vulnerability art-2487
crit CISA KEV: CVE-2019-1315 — Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability art-2488
crit CISA KEV: CVE-2019-1253 — Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability art-2489
crit CISA KEV: CVE-2019-1132 — Microsoft Win32k Privilege Escalation Vulnerability art-2490
crit CISA KEV: CVE-2019-1129 — Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability art-2491
crit CISA KEV: CVE-2019-1069 — Microsoft Task Scheduler Privilege Escalation Vulnerability art-2492
crit CISA KEV: CVE-2019-1064 — Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability art-2493
crit CISA KEV: CVE-2019-0841 — Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability art-2494
crit CISA KEV: CVE-2019-0543 — Microsoft Windows Privilege Escalation Vulnerability art-2495
crit CISA KEV: CVE-2018-8120 — Microsoft Win32k Privilege Escalation Vulnerability art-2496
crit CISA KEV: CVE-2017-0101 — Microsoft Windows Transaction Manager Privilege Escalation Vulnerability art-2497
crit CISA KEV: CVE-2016-3309 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2498
crit CISA KEV: CVE-2015-2546 — Microsoft Win32k Memory Corruption Vulnerability art-2499
high Build a software bill of materials (SBOM) for open source supply chain security art-2500
high "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) art-2501
high Celebrating amazing open source innovation from Ukraine art-2504
high Simplifying container security with Snyk’s security expertise art-2505
crit CISA KEV: CVE-2022-26486 — Mozilla Firefox Use-After-Free Vulnerability art-2508
crit CISA KEV: CVE-2022-26485 — Mozilla Firefox Use-After-Free Vulnerability art-2509
crit CISA KEV: CVE-2021-21973 — VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability art-2510
crit CISA KEV: CVE-2020-8218 — Pulse Connect Secure Code Injection Vulnerability art-2511
crit CISA KEV: CVE-2019-11581 — Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability art-2512
crit CISA KEV: CVE-2017-6077 — NETGEAR DGN2200 Remote Code Execution Vulnerability art-2513
crit CISA KEV: CVE-2016-6277 — NETGEAR Multiple Routers Remote Code Execution Vulnerability art-2514
crit CISA KEV: CVE-2013-0631 — Adobe ColdFusion Information Disclosure Vulnerability art-2515
crit CISA KEV: CVE-2013-0629 — Adobe ColdFusion Directory Traversal Vulnerability art-2516
crit CISA KEV: CVE-2013-0625 — Adobe ColdFusion Authentication Bypass Vulnerability art-2517
crit CISA KEV: CVE-2009-3960 — Adobe BlazeDS Information Disclosure Vulnerability art-2518
med Adding Container and IaC security to the Snyk plugin for Jetbrains art-2519
crit CISA KEV: CVE-2022-20708 — Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability art-2522
crit CISA KEV: CVE-2022-20703 — Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability art-2523
crit CISA KEV: CVE-2022-20701 — Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability art-2524
crit CISA KEV: CVE-2022-20700 — Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability art-2525
crit CISA KEV: CVE-2022-20699 — Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability art-2526
crit CISA KEV: CVE-2021-41379 — Microsoft Windows Installer Privilege Escalation Vulnerability art-2527
crit CISA KEV: CVE-2020-1938 — Apache Tomcat Improper Privilege Management Vulnerability art-2528
crit CISA KEV: CVE-2020-11899 — Treck TCP/IP stack Out-of-Bounds Read Vulnerability art-2529
crit CISA KEV: CVE-2019-16928 — Exim Out-of-bounds Write Vulnerability art-2530
crit CISA KEV: CVE-2019-1652 — Cisco Small Business Routers Improper Input Validation Vulnerability art-2531
crit CISA KEV: CVE-2019-1297 — Microsoft Excel Remote Code Execution Vulnerability art-2532
crit CISA KEV: CVE-2018-8581 — Microsoft Exchange Server Privilege Escalation Vulnerability art-2533
crit CISA KEV: CVE-2018-8298 — ChakraCore Scripting Engine Type Confusion Vulnerability art-2534
crit CISA KEV: CVE-2018-0180 — Cisco IOS Software Denial-of-Service Vulnerability art-2535
crit CISA KEV: CVE-2018-0179 — Cisco IOS Software Denial-of-Service Vulnerability art-2536
crit CISA KEV: CVE-2018-0175 — Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability art-2537
crit CISA KEV: CVE-2018-0174 — Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability art-2538
crit CISA KEV: CVE-2018-0173 — Cisco IOS and IOS XE Software Improper Input Validation Vulnerability art-2539
crit CISA KEV: CVE-2018-0172 — Cisco IOS and IOS XE Software Improper Input Validation Vulnerability art-2540
crit CISA KEV: CVE-2018-0167 — Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability art-2541
crit CISA KEV: CVE-2018-0161 — Cisco IOS Software Resource Management Errors Vulnerability art-2542
crit CISA KEV: CVE-2018-0159 — Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability art-2543
crit CISA KEV: CVE-2018-0158 — Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability art-2544
crit CISA KEV: CVE-2018-0156 — Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability art-2545
crit CISA KEV: CVE-2018-0155 — Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability art-2546
crit CISA KEV: CVE-2018-0154 — Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability art-2547
crit CISA KEV: CVE-2018-0151 — Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability art-2548
crit CISA KEV: CVE-2017-8540 — Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability art-2549
crit CISA KEV: CVE-2017-6744 — Cisco IOS Software SNMP Remote Code Execution Vulnerability art-2550
crit CISA KEV: CVE-2017-6743 — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability art-2551
crit CISA KEV: CVE-2017-6740 — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability art-2552
crit CISA KEV: CVE-2017-6739 — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability art-2553
crit CISA KEV: CVE-2017-6738 — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability art-2554
crit CISA KEV: CVE-2017-6737 — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability art-2555
crit CISA KEV: CVE-2017-6736 — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability art-2556
crit CISA KEV: CVE-2017-6663 — Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability art-2557
crit CISA KEV: CVE-2017-6627 — Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability art-2558
crit CISA KEV: CVE-2017-12319 — Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability art-2559
crit CISA KEV: CVE-2017-12240 — Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability art-2560
crit CISA KEV: CVE-2017-12238 — Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability art-2561
crit CISA KEV: CVE-2017-12237 — Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability art-2562
crit CISA KEV: CVE-2017-12235 — Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability art-2563
crit CISA KEV: CVE-2017-12234 — Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability art-2564
crit CISA KEV: CVE-2017-12233 — Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability art-2565
crit CISA KEV: CVE-2017-12232 — Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability art-2566
crit CISA KEV: CVE-2017-12231 — Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability art-2567
crit CISA KEV: CVE-2017-11826 — Microsoft Office Remote Code Execution Vulnerability art-2568
crit CISA KEV: CVE-2017-11292 — Adobe Flash Player Type Confusion Vulnerability art-2569
crit CISA KEV: CVE-2017-0261 — Microsoft Office Use-After-Free Vulnerability art-2570
crit CISA KEV: CVE-2017-0001 — Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability art-2571
crit CISA KEV: CVE-2016-8562 — Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability art-2572
crit CISA KEV: CVE-2016-7855 — Adobe Flash Player Use-After-Free Vulnerability art-2573
crit CISA KEV: CVE-2016-7262 — Microsoft Office Security Feature Bypass Vulnerability art-2574
crit CISA KEV: CVE-2016-7193 — Microsoft Office Memory Corruption Vulnerability art-2575
crit CISA KEV: CVE-2016-5195 — Linux Kernel Race Condition Vulnerability art-2576
crit CISA KEV: CVE-2016-4117 — Adobe Flash Player Arbitrary Code Execution Vulnerability art-2577
crit CISA KEV: CVE-2016-1019 — Adobe Flash Player Arbitrary Code Execution Vulnerability art-2578
crit CISA KEV: CVE-2016-0099 — Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability art-2579
crit CISA KEV: CVE-2015-7645 — Adobe Flash Player Arbitrary Code Execution Vulnerability art-2580
crit CISA KEV: CVE-2015-5119 — Adobe Flash Player Use-After-Free Vulnerability art-2581
crit CISA KEV: CVE-2015-4902 — Oracle Java SE Integrity Check Vulnerability art-2582
crit CISA KEV: CVE-2015-3043 — Adobe Flash Player Memory Corruption Vulnerability art-2583
crit CISA KEV: CVE-2015-2590 — Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability art-2584
crit CISA KEV: CVE-2015-2545 — Microsoft Office Malformed EPS File Vulnerability art-2585
crit CISA KEV: CVE-2015-2424 — Microsoft PowerPoint Memory Corruption Vulnerability art-2586
crit CISA KEV: CVE-2015-2387 — Microsoft ATM Font Driver Privilege Escalation Vulnerability art-2587
crit CISA KEV: CVE-2015-1701 — Microsoft Win32k Privilege Escalation Vulnerability art-2588
crit CISA KEV: CVE-2015-1642 — Microsoft Office Memory Corruption Vulnerability art-2589
crit CISA KEV: CVE-2014-4114 — Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability art-2590
crit CISA KEV: CVE-2014-0496 — Adobe Reader and Acrobat Use-After-Free Vulnerability art-2591
crit CISA KEV: CVE-2013-5065 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2592
crit CISA KEV: CVE-2013-3897 — Microsoft Internet Explorer Use-After-Free Vulnerability art-2593
crit CISA KEV: CVE-2013-3346 — Adobe Reader and Acrobat Memory Corruption Vulnerability art-2594
crit CISA KEV: CVE-2013-1675 — Mozilla Firefox Information Disclosure Vulnerability art-2595
crit CISA KEV: CVE-2013-1347 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2596
crit CISA KEV: CVE-2013-0641 — Adobe Reader Buffer Overflow Vulnerability art-2597
crit CISA KEV: CVE-2013-0640 — Adobe Reader and Acrobat Memory Corruption Vulnerability art-2598
crit CISA KEV: CVE-2013-0632 — Adobe ColdFusion Authentication Bypass Vulnerability art-2599
crit CISA KEV: CVE-2012-4681 — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability art-2600
crit CISA KEV: CVE-2012-1856 — Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability art-2601
crit CISA KEV: CVE-2012-1723 — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability art-2602
crit CISA KEV: CVE-2012-1535 — Adobe Flash Player Arbitrary Code Execution Vulnerability art-2603
crit CISA KEV: CVE-2012-0507 — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability art-2604
crit CISA KEV: CVE-2011-3544 — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability art-2605
crit CISA KEV: CVE-2011-1889 — Microsoft Forefront TMG Remote Code Execution Vulnerability art-2606
crit CISA KEV: CVE-2011-0611 — Adobe Flash Player Remote Code Execution Vulnerability art-2607
crit CISA KEV: CVE-2010-3333 — Microsoft Office Stack-based Buffer Overflow Vulnerability art-2608
crit CISA KEV: CVE-2010-0232 — Microsoft Windows Kernel Exception Handler Vulnerability art-2609
crit CISA KEV: CVE-2010-0188 — Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability art-2610
crit CISA KEV: CVE-2009-3129 — Microsoft Excel Featheader Record Memory Corruption Vulnerability art-2611
crit CISA KEV: CVE-2009-1123 — Microsoft Windows Improper Input Validation Vulnerability art-2612
crit CISA KEV: CVE-2008-3431 — Oracle VirtualBox Insufficient Input Validation Vulnerability art-2613
crit CISA KEV: CVE-2008-2992 — Adobe Reader and Acrobat Input Validation Vulnerability art-2614
crit CISA KEV: CVE-2004-0210 — Microsoft Windows Privilege Escalation Vulnerability art-2615
crit CISA KEV: CVE-2002-0367 — Microsoft Windows Privilege Escalation Vulnerability art-2616
high Visibly invisible malicious Node.js packages: When configuration niche meets invisible characters art-2620
crit CISA KEV: CVE-2022-24682 — Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability art-2622
crit CISA KEV: CVE-2017-8570 — Microsoft Office Remote Code Execution Vulnerability art-2623
crit CISA KEV: CVE-2017-0222 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2624
crit CISA KEV: CVE-2014-6352 — Microsoft Windows Code Injection Vulnerability art-2625
crit Magento security requires additional patch to fix sanitization vulnerability art-2627
crit CISA KEV: CVE-2022-23131 — Zabbix Frontend Authentication Bypass Vulnerability art-2629
crit CISA KEV: CVE-2022-23134 — Zabbix Frontend Improper Access Control Vulnerability art-2630
high Join The Big Fix: a 24-hour livestream dedicated to fixing security vulnerabilities in your projects art-2631
crit CVE-2022-24086 Vulnerability alert for websites using Magento Ecommerce art-2633
high Using the Snyk Vulnerability database to identify projects for The Big Fix art-2635
high Teaming up with Sysdig to deliver developer and runtime Kubernetes security art-2636
crit Case study: Python RCE vulnerability in Celery art-2637
crit CISA KEV: CVE-2022-24086 — Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability art-2639
crit CISA KEV: CVE-2022-0609 — Google Chromium Animation Use-After-Free Vulnerability art-2640
crit CISA KEV: CVE-2019-0752 — Microsoft Internet Explorer Type Confusion Vulnerability art-2641
crit CISA KEV: CVE-2018-8174 — Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability art-2642
crit CISA KEV: CVE-2018-20250 — WinRAR Absolute Path Traversal Vulnerability art-2643
crit CISA KEV: CVE-2018-15982 — Adobe Flash Player Use-After-Free Vulnerability art-2644
crit CISA KEV: CVE-2017-9841 — PHPUnit Command Injection Vulnerability art-2645
crit CISA KEV: CVE-2014-1761 — Microsoft Word Memory Corruption Vulnerability art-2646
crit CISA KEV: CVE-2013-3906 — Microsoft Graphics Component Memory Corruption Vulnerability art-2647
med Automating Terraform security in Scalr deployments with Regula [Tutorial] art-2648
crit CISA KEV: CVE-2022-22620 — Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability art-2649
high SAST and SCA: Better together with Snyk art-2650
high Lessons learned from the Argo CD zero-day vulnerability (CVE-2022-24348) art-2651
crit CISA KEV: CVE-2021-36934 — Microsoft Windows SAM Local Privilege Escalation Vulnerability art-2653
crit CISA KEV: CVE-2020-0796 — Microsoft SMBv3 Remote Code Execution Vulnerability art-2654
crit CISA KEV: CVE-2018-1000861 — Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability art-2655
crit CISA KEV: CVE-2017-9791 — Apache Struts 1 Improper Input Validation Vulnerability art-2656
crit CISA KEV: CVE-2017-8464 — Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability art-2657
crit CISA KEV: CVE-2017-10271 — Oracle Corporation WebLogic Server Remote Code Execution Vulnerability art-2658
crit CISA KEV: CVE-2017-0263 — Microsoft Win32k Privilege Escalation Vulnerability art-2659
crit CISA KEV: CVE-2017-0262 — Microsoft Office Remote Code Execution Vulnerability art-2660
crit CISA KEV: CVE-2017-0145 — Microsoft SMBv1 Remote Code Execution Vulnerability art-2661
crit CISA KEV: CVE-2017-0144 — Microsoft SMBv1 Remote Code Execution Vulnerability art-2662
crit CISA KEV: CVE-2016-3088 — Apache ActiveMQ Improper Input Validation Vulnerability art-2663
crit CISA KEV: CVE-2015-2051 — D-Link DIR-645 Router Remote Code Execution Vulnerability art-2664
crit CISA KEV: CVE-2015-1635 — Microsoft HTTP.sys Remote Code Execution Vulnerability art-2665
crit CISA KEV: CVE-2015-1130 — Apple OS X Authentication Bypass Vulnerability art-2666
crit CISA KEV: CVE-2014-4404 — Apple OS X Heap-Based Buffer Overflow Vulnerability art-2667
med Using Pulumi to automate the Snyk Kubernetes integration for containers art-2669
high Log4Shell remediation with Snyk by the numbers art-2672
crit CISA KEV: CVE-2022-21882 — Microsoft Win32k Privilege Escalation Vulnerability art-2673
high Analyzing the PwnKit local privilege escalation exploit art-2677
crit CISA KEV: CVE-2022-22587 — Apple Memory Corruption Vulnerability art-2678
crit CISA KEV: CVE-2021-20038 — SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability art-2679
crit CISA KEV: CVE-2020-5722 — Grandstream Networks UCM6200 Series SQL Injection Vulnerability art-2680
crit CISA KEV: CVE-2020-0787 — Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability art-2681
crit CISA KEV: CVE-2017-5689 — Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Es art-2682
crit CISA KEV: CVE-2014-1776 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2683
crit CISA KEV: CVE-2014-6271 — GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability art-2684
crit Stranger Danger: Live hack of how a Log4Shell exploit works art-2688
crit CISA KEV: CVE-2006-1547 — Apache Struts 1 ActionForm Denial-of-Service Vulnerability art-2690
crit CISA KEV: CVE-2012-0391 — Apache Struts 2 Improper Input Validation Vulnerability art-2691
crit CISA KEV: CVE-2018-8453 — Microsoft Win32k Privilege Escalation Vulnerability art-2692
crit CISA KEV: CVE-2021-35247 — SolarWinds Serv-U Improper Input Validation Vulnerability art-2693
crit CISA KEV: CVE-2021-32648 — October CMS Improper Authentication art-2697
crit CISA KEV: CVE-2021-25296 — Nagios XI OS Command Injection art-2698
crit CISA KEV: CVE-2021-25297 — Nagios XI OS Command Injection art-2699
crit CISA KEV: CVE-2021-25298 — Nagios XI OS Command Injection art-2700
crit CISA KEV: CVE-2021-40870 — Aviatrix Controller Unrestricted Upload of File art-2701
crit CISA KEV: CVE-2021-33766 — Microsoft Exchange Server Information Disclosure art-2702
crit CISA KEV: CVE-2021-21975 — VMware Server Side Request Forgery in vRealize Operations Manager API art-2703
crit CISA KEV: CVE-2021-21315 — System Information Library for Node.JS Command Injection art-2704
crit CISA KEV: CVE-2021-22991 — F5 BIG-IP Traffic Management Microkernel Buffer Overflow art-2705
crit CISA KEV: CVE-2020-14864 — Oracle Business Intelligence Enterprise Edition Path Transversal art-2706
crit CISA KEV: CVE-2020-13671 — Drupal core Un-restricted Upload of File art-2707
crit CISA KEV: CVE-2020-11978 — Apache Airflow Command Injection art-2708
crit CISA KEV: CVE-2020-13927 — Apache Airflow's Experimental API Authentication Bypass art-2709
med 8 best Java code review tools for developers art-2711
crit The Secure Developer: 2021 in review art-2714
crit URL confusion vulnerabilities in the wild: Exploring parser inconsistencies art-2715
crit CISA KEV: CVE-2021-22017 — VMware vCenter Server Improper Access Control art-2717
crit CISA KEV: CVE-2021-36260 — Hikvision Improper Input Validation art-2718
crit CISA KEV: CVE-2020-6572 — Google Chrome Media Use-After-Free Vulnerability art-2719
crit CISA KEV: CVE-2019-1458 — Microsoft Win32k Privilege Escalation Vulnerability art-2720
crit CISA KEV: CVE-2013-3900 — Microsoft WinVerifyTrust function Remote Code Execution art-2721
crit CISA KEV: CVE-2019-2725 — Oracle WebLogic Server, Injection art-2722
crit CISA KEV: CVE-2019-9670 — Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference art-2723
crit CISA KEV: CVE-2018-13382 — Fortinet FortiOS and FortiProxy Improper Authorization art-2724
crit CISA KEV: CVE-2018-13383 — Fortinet FortiOS and FortiProxy Out-of-bounds Write art-2725
crit CISA KEV: CVE-2019-1579 — Palo Alto Networks PAN-OS Remote Code Execution Vulnerability art-2726
crit CISA KEV: CVE-2019-10149 — Exim Mail Transfer Agent (MTA) Improper Input Validation art-2727
crit CISA KEV: CVE-2015-7450 — IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. art-2728
crit CISA KEV: CVE-2017-1000486 — Primetek Primefaces Remote Code Execution Vulnerability art-2729
crit CISA KEV: CVE-2019-7609 — Kibana Arbitrary Code Execution art-2730
crit CISA KEV: CVE-2021-27860 — FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit art-2731
crit Open source maintainer pulls the plug on npm packages colors and faker, now what? art-2732
high FTC highlights the importance of securing Log4j and software supply chain art-2733
med Developer security resolutions for 2022 art-2736
med Checking Terraform IaC security in CI/CD with Regula and Bitbucket Pipelines [Tutorial] art-2738
high New Log4j 2.17.1 fixes CVE-2021-44832 remote code execution (but it’s not as bad as it sounds) art-2739
high It takes a community: Responding to open source criticism post-Log4Shell art-2740
high Snyk IaC in 2021: Leading infrastructure as code security for developers art-2741
med Snyk Container in 2021: Shifting container security all the way left art-2742
high Snyk Open Source in 2021: A year of innovation art-2744
high Snyk makes it easier to fix Log4Shell with extended free scans art-2745
high Log4j 2.16 High Severity Vulnerability (CVE-2021-45105) Discovered art-2747
high Find Log4Shell vulnerabilities in your unmanaged and shaded jars with the Snyk CLI art-2748
high Log4j 2.15 vulnerability CVE-2021-45046 upgraded to a critical severity arbitrary code execution art-2749
high Security in context: When is a CVE not a CVE? art-2750
high Log4Shell in a nutshell (for non-developers & non-Java developers) art-2751
crit CISA KEV: CVE-2021-43890 — Microsoft Windows AppX Installer Spoofing Vulnerability art-2752
crit CISA KEV: CVE-2021-4102 — Google Chromium V8 Use-After-Free Vulnerability art-2753
high The Log4j vulnerability and its impact on software supply chain security art-2756
high Find and fix the Log4Shell exploit fast with Snyk art-2757
crit Log4j vulnerability explained: Prevent Log4Shell RCE by updating to version 2.17.1 art-2758
crit CISA KEV: CVE-2021-44515 — Zoho Desktop Central Authentication Bypass Vulnerability art-2760
crit CISA KEV: CVE-2019-13272 — Linux Kernel Improper Privilege Management Vulnerability art-2761
crit CISA KEV: CVE-2021-35394 — Realtek Jungle SDK Remote Code Execution Vulnerability art-2762
crit CISA KEV: CVE-2019-7238 — Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability art-2763
crit CISA KEV: CVE-2019-0193 — Apache Solr DataImportHandler Code Injection Vulnerability art-2764
crit CISA KEV: CVE-2021-44168 — Fortinet FortiOS Arbitrary File Download art-2765
crit CISA KEV: CVE-2017-17562 — Embedthis GoAhead Remote Code Execution Vulnerability art-2766
crit CISA KEV: CVE-2017-12149 — Red Hat JBoss Application Server Remote Code Execution Vulnerability art-2767
crit CISA KEV: CVE-2010-1871 — Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability art-2768
crit CISA KEV: CVE-2020-17463 — Fuel CMS SQL Injection Vulnerability art-2769
crit CISA KEV: CVE-2020-8816 — Pi-Hole AdminLTE Remote Code Execution Vulnerability art-2770
crit CISA KEV: CVE-2019-10758 — MongoDB mongo-express Remote Code Execution Vulnerability art-2771
crit CISA KEV: CVE-2021-44228 — Apache Log4j2 Remote Code Execution Vulnerability art-2772
high Responsible disclosure: CodeCov CEO & CTO share learnings from the breach art-2773
high Snyk Open Source adds beta C/C++ security scanning for unmanaged OSS art-2774
med Java JSON deserialization problems with the Jackson ObjectMapper art-2775
crit CISA KEV: CVE-2020-11261 — Qualcomm Multiple Chipsets Improper Input Validation Vulnerability art-2776
crit CISA KEV: CVE-2018-14847 — MikroTik Router OS Directory Traversal Vulnerability art-2777
crit CISA KEV: CVE-2021-37415 — Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability art-2778
crit CISA KEV: CVE-2021-40438 — Apache HTTP Server-Side Request Forgery (SSRF) art-2779
crit CISA KEV: CVE-2021-44077 — Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability art-2780
med Snyk achieves AWS Security Competency status art-2781
crit CISA KEV: CVE-2021-22204 — ExifTool Remote Code Execution Vulnerability art-2786
crit CISA KEV: CVE-2021-40449 — Microsoft Windows Win32k Privilege Escalation Vulnerability art-2787
crit CISA KEV: CVE-2021-42321 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2788
crit CISA KEV: CVE-2021-42292 — Microsoft Excel Security Feature Bypass art-2789
med Scanning ARM templates for misconfigurations with the Snyk CLI art-2793
high Exploring extensions of dependency confusion attacks via npm package aliasing art-2799
high How and when to use Docker labels / OCI container annotations art-2801
crit JavaScript type confusion: Bypassed input validation (and how to remediate) art-2802
crit CISA KEV: CVE-2021-27104 — Accellion FTA OS Command Injection Vulnerability art-2803
crit CISA KEV: CVE-2021-27102 — Accellion FTA OS Command Injection Vulnerability art-2804
crit CISA KEV: CVE-2021-27101 — Accellion FTA SQL Injection Vulnerability art-2805
crit CISA KEV: CVE-2021-27103 — Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability art-2806
crit CISA KEV: CVE-2021-21017 — Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability art-2807
crit CISA KEV: CVE-2021-28550 — Adobe Acrobat and Reader Use-After-Free Vulnerability art-2808
crit CISA KEV: CVE-2018-4939 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-2809
crit CISA KEV: CVE-2018-15961 — Adobe ColdFusion Unrestricted File Upload Vulnerability art-2810
crit CISA KEV: CVE-2018-4878 — Adobe Flash Player Use-After-Free Vulnerability art-2811
crit CISA KEV: CVE-2020-5735 — Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability art-2812
crit CISA KEV: CVE-2019-2215 — Android Kernel Use-After-Free Vulnerability art-2813
crit CISA KEV: CVE-2017-9805 — Apache Struts Deserialization of Untrusted Data Vulnerability art-2814
crit CISA KEV: CVE-2021-42013 — Apache HTTP Server Path Traversal Vulnerability art-2815
crit CISA KEV: CVE-2019-0211 — Apache HTTP Server Privilege Escalation Vulnerability art-2816
crit CISA KEV: CVE-2016-4437 — Apache Shiro Code Execution Vulnerability art-2817
crit CISA KEV: CVE-2019-17558 — Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability art-2818
crit CISA KEV: CVE-2020-17530 — Apache Struts Remote Code Execution Vulnerability art-2819
crit CISA KEV: CVE-2017-5638 — Apache Struts Remote Code Execution Vulnerability art-2820
crit CISA KEV: CVE-2018-11776 — Apache Struts Remote Code Execution Vulnerability art-2821
crit CISA KEV: CVE-2021-30858 — Apple iOS, iPadOS, macOS Use-After-Free Vulnerability art-2822
crit CISA KEV: CVE-2019-6223 — Apple iOS and macOS Group Facetime Vulnerability art-2823
crit CISA KEV: CVE-2021-30860 — Apple Multiple Products Integer Overflow Vulnerability art-2824
crit CISA KEV: CVE-2020-27930 — Apple Multiple Products Memory Corruption Vulnerability art-2825
crit CISA KEV: CVE-2021-30807 — Apple Multiple Products Memory Corruption Vulnerability art-2826
crit CISA KEV: CVE-2020-27950 — Apple Multiple Products Memory Initialization Vulnerability art-2827
crit CISA KEV: CVE-2020-27932 — Apple Multiple Products Type Confusion Vulnerability art-2828
crit CISA KEV: CVE-2020-9818 — Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability art-2829
crit CISA KEV: CVE-2020-9819 — Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability art-2830
crit CISA KEV: CVE-2021-30762 — Apple iOS WebKit Use-After-Free Vulnerability art-2831
crit CISA KEV: CVE-2021-1782 — Apple Multiple Products Race Condition Vulnerability art-2832
crit CISA KEV: CVE-2021-1870 — Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability art-2833
crit CISA KEV: CVE-2021-1871 — Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability art-2834
crit CISA KEV: CVE-2021-1879 — Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability art-2835
crit CISA KEV: CVE-2021-30661 — Apple Multiple Products WebKit Storage Use-After-Free Vulnerability art-2836
crit CISA KEV: CVE-2021-30666 — Apple iOS WebKit Buffer Overflow Vulnerability art-2837
crit CISA KEV: CVE-2021-30713 — Apple macOS Unspecified Vulnerability art-2838
crit CISA KEV: CVE-2021-30657 — Apple macOS Unspecified Vulnerability art-2839
crit CISA KEV: CVE-2021-30665 — Apple Multiple Products WebKit Memory Corruption Vulnerability art-2840
crit CISA KEV: CVE-2021-30663 — Apple Multiple Products WebKit Integer Overflow Vulnerability art-2841
crit CISA KEV: CVE-2021-30761 — Apple iOS WebKit Memory Corruption Vulnerability art-2842
crit CISA KEV: CVE-2021-30869 — Apple iOS, iPadOS, and macOS Type Confusion Vulnerability art-2843
crit CISA KEV: CVE-2020-9859 — Apple Multiple Products Code Execution Vulnerability art-2844
crit CISA KEV: CVE-2021-20090 — Arcadyan Buffalo Firmware Path Traversal Vulnerability art-2845
crit CISA KEV: CVE-2021-27562 — Arm Trusted Firmware Out-of-Bounds Write Vulnerability art-2846
crit CISA KEV: CVE-2021-28664 — Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability art-2847
crit CISA KEV: CVE-2021-28663 — Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability art-2848
crit CISA KEV: CVE-2019-3398 — Atlassian Confluence Server and Data Center Path Traversal Vulnerability art-2849
crit CISA KEV: CVE-2021-26084 — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability art-2850
crit CISA KEV: CVE-2019-11580 — Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability art-2851
crit CISA KEV: CVE-2019-3396 — Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability art-2852
crit CISA KEV: CVE-2021-42258 — BQE BillQuick Web Suite SQL Injection Vulnerability art-2853
crit CISA KEV: CVE-2020-3452 — Cisco ASA and FTD Read-Only Path Traversal Vulnerability art-2854
crit CISA KEV: CVE-2020-3580 — Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability art-2855
crit CISA KEV: CVE-2021-1497 — Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability art-2856
crit CISA KEV: CVE-2021-1498 — Cisco HyperFlex HX Data Platform Command Injection Vulnerability art-2857
crit CISA KEV: CVE-2018-0171 — Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability art-2858
crit CISA KEV: CVE-2020-3118 — Cisco IOS XR Software Discovery Protocol Format String Vulnerability art-2859
crit CISA KEV: CVE-2020-3566 — Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability art-2860
crit CISA KEV: CVE-2020-3569 — Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability art-2861
crit CISA KEV: CVE-2020-3161 — Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability art-2862
crit CISA KEV: CVE-2019-1653 — Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability art-2863
crit CISA KEV: CVE-2018-0296 — Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability art-2864
crit CISA KEV: CVE-2019-13608 — Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability art-2865
crit CISA KEV: CVE-2020-8193 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability art-2866
crit CISA KEV: CVE-2020-8195 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability art-2867
crit CISA KEV: CVE-2020-8196 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability art-2868
crit CISA KEV: CVE-2019-19781 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability art-2869
crit CISA KEV: CVE-2019-11634 — Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability art-2870
crit CISA KEV: CVE-2020-29557 — D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability art-2871
crit CISA KEV: CVE-2020-25506 — D-Link DNS-320 Device Command Injection Vulnerability art-2872
crit CISA KEV: CVE-2018-15811 — DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability art-2873
crit CISA KEV: CVE-2017-9822 — DotNetNuke (DNN) Remote Code Execution Vulnerability art-2874
crit CISA KEV: CVE-2019-15752 — Docker Desktop Community Edition Privilege Escalation Vulnerability art-2875
crit CISA KEV: CVE-2020-8515 — Multiple DrayTek Vigor Routers Web Management Page Vulnerability art-2876
crit CISA KEV: CVE-2018-7600 — Drupal Core Remote Code Execution Vulnerability art-2877
crit CISA KEV: CVE-2021-22205 — GitLab Community and Enterprise Editions Remote Code Execution Vulnerability art-2878
crit CISA KEV: CVE-2018-6789 — Exim Buffer Overflow Vulnerability art-2879
crit CISA KEV: CVE-2020-8657 — EyesOfNetwork Use of Hard-Coded Credentials Vulnerability art-2880
crit CISA KEV: CVE-2020-8655 — EyesOfNetwork Improper Privilege Management Vulnerability art-2881
crit CISA KEV: CVE-2020-5902 — F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability art-2882
crit CISA KEV: CVE-2021-22986 — F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability art-2883
crit CISA KEV: CVE-2021-35464 — ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability art-2884
crit CISA KEV: CVE-2019-5591 — Fortinet FortiOS Default Configuration Vulnerability art-2885
crit CISA KEV: CVE-2020-12812 — Fortinet FortiOS SSL VPN Improper Authentication Vulnerability art-2886
crit CISA KEV: CVE-2018-13379 — Fortinet FortiOS SSL VPN Path Traversal Vulnerability art-2887
crit CISA KEV: CVE-2020-16010 — Google Chrome for Android UI Heap Buffer Overflow Vulnerability art-2888
crit CISA KEV: CVE-2021-21166 — Google Chromium Race Condition Vulnerability art-2889
crit CISA KEV: CVE-2020-16017 — Google Chrome Use-After-Free Vulnerability art-2890
crit CISA KEV: CVE-2021-37976 — Google Chromium Information Disclosure Vulnerability art-2891
crit CISA KEV: CVE-2020-16009 — Google Chromium V8 Type Confusion Vulnerability art-2892
crit CISA KEV: CVE-2021-30632 — Google Chromium V8 Out-of-Bounds Write Vulnerability art-2893
crit CISA KEV: CVE-2020-16013 — Google Chromium V8 Incorrect Implementation Vulnerabililty art-2894
crit CISA KEV: CVE-2021-30633 — Google Chromium Indexed DB API Use-After-Free Vulnerability art-2895
crit CISA KEV: CVE-2021-21148 — Google Chromium V8 Heap Buffer Overflow Vulnerability art-2896
crit CISA KEV: CVE-2021-37973 — Google Chromium Portals Use-After-Free Vulnerability art-2897
crit CISA KEV: CVE-2021-30551 — Google Chromium V8 Type Confusion Vulnerability art-2898
crit CISA KEV: CVE-2021-37975 — Google Chromium V8 Use-After-Free Vulnerability art-2899
crit CISA KEV: CVE-2020-6418 — Google Chromium V8 Type Confusion Vulnerability art-2900
crit CISA KEV: CVE-2021-30554 — Google Chromium WebGL Use-After-Free Vulnerability art-2901
crit CISA KEV: CVE-2021-21206 — Google Chromium Blink Use-After-Free Vulnerability art-2902
crit CISA KEV: CVE-2021-38000 — Google Chromium Intents Improper Input Validation Vulnerability art-2903
crit CISA KEV: CVE-2021-38003 — Google Chromium V8 Memory Corruption Vulnerability art-2904
crit CISA KEV: CVE-2021-21224 — Google Chromium V8 Type Confusion Vulnerability art-2905
crit CISA KEV: CVE-2021-21193 — Google Chromium Blink Use-After-Free Vulnerability art-2906
crit CISA KEV: CVE-2021-21220 — Google Chromium V8 Improper Input Validation Vulnerability art-2907
crit CISA KEV: CVE-2021-30563 — Google Chromium V8 Type Confusion Vulnerability art-2908
crit CISA KEV: CVE-2020-4430 — IBM Data Risk Manager Directory Traversal Vulnerability art-2909
crit CISA KEV: CVE-2020-4427 — IBM Data Risk Manager Security Bypass Vulnerability art-2910
crit CISA KEV: CVE-2020-4428 — IBM Data Risk Manager Remote Code Execution Vulnerability art-2911
crit CISA KEV: CVE-2019-4716 — IBM Planning Analytics Remote Code Execution Vulnerability art-2912
crit CISA KEV: CVE-2016-3715 — ImageMagick Arbitrary File Deletion Vulnerability art-2913
crit CISA KEV: CVE-2016-3718 — ImageMagick Server-Side Request Forgery (SSRF) Vulnerability art-2914
crit CISA KEV: CVE-2020-15505 — Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability art-2915
crit CISA KEV: CVE-2021-30116 — Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability art-2916
crit CISA KEV: CVE-2020-7961 — Liferay Portal Deserialization of Untrusted Data Vulnerability art-2917
crit CISA KEV: CVE-2021-23874 — McAfee Total Protection (MTP) Improper Privilege Management Vulnerability art-2918
crit CISA KEV: CVE-2021-22506 — Micro Focus Access Manager Information Leakage Vulnerability art-2919
crit CISA KEV: CVE-2021-22502 — Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability art-2920
crit CISA KEV: CVE-2014-1812 — Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability art-2921
crit CISA KEV: CVE-2021-38647 — Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability art-2922
crit CISA KEV: CVE-2016-0167 — Microsoft Win32k Privilege Escalation Vulnerability art-2923
crit CISA KEV: CVE-2020-0878 — Microsoft Edge and Internet Explorer Memory Corruption Vulnerability art-2924
crit CISA KEV: CVE-2021-31955 — Microsoft Windows Kernel Information Disclosure Vulnerability art-2925
crit CISA KEV: CVE-2021-1647 — Microsoft Defender Remote Code Execution Vulnerability art-2926
crit CISA KEV: CVE-2021-33739 — Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability art-2927
crit CISA KEV: CVE-2016-0185 — Microsoft Windows Media Center Remote Code Execution Vulnerability art-2928
crit CISA KEV: CVE-2020-0683 — Microsoft Windows Installer Privilege Escalation Vulnerability art-2929
crit CISA KEV: CVE-2020-17087 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2930
crit CISA KEV: CVE-2021-33742 — Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability art-2931
crit CISA KEV: CVE-2021-31199 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2932
crit CISA KEV: CVE-2021-33771 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2933
crit CISA KEV: CVE-2021-31956 — Microsoft Windows NTFS Privilege Escalation Vulnerability art-2934
crit CISA KEV: CVE-2021-31201 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2935
crit CISA KEV: CVE-2021-31979 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2936
crit CISA KEV: CVE-2020-0938 — Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability art-2937
crit CISA KEV: CVE-2020-17144 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2938
crit CISA KEV: CVE-2020-0986 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2939
crit CISA KEV: CVE-2020-1020 — Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability art-2940
crit CISA KEV: CVE-2021-38645 — Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability art-2941
crit CISA KEV: CVE-2021-34523 — Microsoft Exchange Server Privilege Escalation Vulnerability art-2942
crit CISA KEV: CVE-2017-7269 — Microsoft Windows Server Buffer Overflow Vulnerability art-2943
crit CISA KEV: CVE-2021-36948 — Microsoft Windows Update Medic Service Privilege Escalation Vulnerability art-2944
crit CISA KEV: CVE-2021-38649 — Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability art-2945
crit CISA KEV: CVE-2020-0688 — Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability art-2946
crit CISA KEV: CVE-2017-0143 — Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability art-2947
crit CISA KEV: CVE-2016-7255 — Microsoft Win32k Privilege Escalation Vulnerability art-2948
crit CISA KEV: CVE-2019-0708 — Microsoft Remote Desktop Services Remote Code Execution Vulnerability art-2949
crit CISA KEV: CVE-2021-34473 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2950
crit CISA KEV: CVE-2020-1464 — Microsoft Windows Spoofing Vulnerability art-2951
crit CISA KEV: CVE-2021-1732 — Microsoft Win32k Privilege Escalation Vulnerability art-2952
crit CISA KEV: CVE-2021-34527 — Microsoft Windows Print Spooler Remote Code Execution Vulnerability art-2953
crit CISA KEV: CVE-2021-31207 — Microsoft Exchange Server Security Feature Bypass Vulnerability art-2954
crit CISA KEV: CVE-2019-0803 — Microsoft Win32k Privilege Escalation Vulnerability art-2955
crit CISA KEV: CVE-2020-1040 — Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability art-2956
crit CISA KEV: CVE-2021-28310 — Microsoft Win32k Privilege Escalation Vulnerability art-2957
crit CISA KEV: CVE-2020-1350 — Microsoft Windows DNS Server Remote Code Execution Vulnerability art-2958
crit CISA KEV: CVE-2021-26411 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2959
crit CISA KEV: CVE-2019-0859 — Microsoft Win32k Privilege Escalation Vulnerability art-2960
crit CISA KEV: CVE-2021-40444 — Microsoft MSHTML Remote Code Execution Vulnerability art-2961
crit CISA KEV: CVE-2017-8759 — Microsoft .NET Framework Remote Code Execution Vulnerability art-2962
crit CISA KEV: CVE-2018-8653 — Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability art-2963
crit CISA KEV: CVE-2019-0797 — Microsoft Win32k Privilege Escalation Vulnerability art-2964
crit CISA KEV: CVE-2021-36942 — Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability art-2965
crit CISA KEV: CVE-2019-1215 — Microsoft Windows Privilege Escalation Vulnerability art-2966
crit CISA KEV: CVE-2018-0798 — Microsoft Office Memory Corruption Vulnerability art-2967
crit CISA KEV: CVE-2012-0158 — Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability art-2968
crit CISA KEV: CVE-2015-1641 — Microsoft Office Memory Corruption Vulnerability art-2969
crit CISA KEV: CVE-2021-27085 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2970
crit CISA KEV: CVE-2019-0541 — Microsoft MSHTML Remote Code Execution Vulnerability art-2971
crit CISA KEV: CVE-2017-11882 — Microsoft Office Memory Corruption Vulnerability art-2972
crit CISA KEV: CVE-2020-0674 — Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability art-2973
crit CISA KEV: CVE-2021-27059 — Microsoft Office Remote Code Execution Vulnerability art-2974
crit CISA KEV: CVE-2019-1367 — Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability art-2975
crit CISA KEV: CVE-2017-0199 — Microsoft Office and WordPad Remote Code Execution Vulnerability art-2976
crit CISA KEV: CVE-2020-1380 — Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability art-2977
crit CISA KEV: CVE-2019-1429 — Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability art-2978
crit CISA KEV: CVE-2017-11774 — Microsoft Office Outlook Security Feature Bypass Vulnerability art-2979
crit CISA KEV: CVE-2020-0968 — Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability art-2980
crit CISA KEV: CVE-2020-1472 — Microsoft Netlogon Privilege Escalation Vulnerability art-2981
crit CISA KEV: CVE-2021-26855 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2982
crit CISA KEV: CVE-2021-26858 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2983
crit CISA KEV: CVE-2021-27065 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2984
crit CISA KEV: CVE-2020-1054 — Microsoft Win32k Privilege Escalation Vulnerability art-2985
crit CISA KEV: CVE-2021-1675 — Microsoft Windows Print Spooler Remote Code Execution Vulnerability art-2986
crit CISA KEV: CVE-2021-34448 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability art-2987
crit CISA KEV: CVE-2020-0601 — Microsoft Windows CryptoAPI Spoofing Vulnerability art-2988
crit CISA KEV: CVE-2019-0604 — Microsoft SharePoint Remote Code Execution Vulnerability art-2989
crit CISA KEV: CVE-2020-0646 — Microsoft .NET Framework Remote Code Execution Vulnerability art-2990
crit CISA KEV: CVE-2019-0808 — Microsoft Win32k Privilege Escalation Vulnerability art-2991
crit CISA KEV: CVE-2021-26857 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2992
crit CISA KEV: CVE-2020-1147 — Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability art-2993
crit CISA KEV: CVE-2019-1214 — Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability art-2994
crit CISA KEV: CVE-2016-3235 — Microsoft Office OLE DLL Side Loading Vulnerability art-2995
crit CISA KEV: CVE-2019-0863 — Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability art-2996
crit CISA KEV: CVE-2021-36955 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability art-2997
crit CISA KEV: CVE-2021-38648 — Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability art-2998
crit CISA KEV: CVE-2020-6819 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability art-2999
crit CISA KEV: CVE-2020-6820 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability art-3000
crit CISA KEV: CVE-2019-17026 — Mozilla Firefox And Thunderbird Type Confusion Vulnerability art-3001
crit CISA KEV: CVE-2019-15949 — Nagios XI Remote Code Execution Vulnerability art-3002
crit CISA KEV: CVE-2020-26919 — Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability art-3003
crit CISA KEV: CVE-2019-19356 — Netis WF2419 Devices Remote Code Execution Vulnerability art-3004
crit CISA KEV: CVE-2020-2555 — Oracle Multiple Products Remote Code Execution Vulnerability art-3005
crit CISA KEV: CVE-2012-3152 — Oracle Fusion Middleware Unspecified Vulnerability art-3006
crit CISA KEV: CVE-2020-14871 — Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability art-3007
crit CISA KEV: CVE-2015-4852 — Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability art-3008
crit CISA KEV: CVE-2020-14750 — Oracle WebLogic Server Remote Code Execution Vulnerability art-3009
crit CISA KEV: CVE-2020-14883 — Oracle WebLogic Server Unspecified Vulnerability art-3010
crit CISA KEV: CVE-2020-8644 — PlaySMS Server-Side Template Injection Vulnerability art-3011
crit CISA KEV: CVE-2019-18935 — Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability art-3012
crit CISA KEV: CVE-2021-22893 — Ivanti Pulse Connect Secure Use-After-Free Vulnerability art-3013
crit CISA KEV: CVE-2020-8243 — Ivanti Pulse Connect Secure Code Execution Vulnerability art-3014
crit CISA KEV: CVE-2021-22900 — Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability art-3015
crit CISA KEV: CVE-2021-22894 — Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability art-3016
crit CISA KEV: CVE-2020-8260 — Ivanti Pulse Connect Secure Code Execution Vulnerability art-3017
crit CISA KEV: CVE-2021-22899 — Ivanti Pulse Connect Secure Command Injection Vulnerability art-3018
crit CISA KEV: CVE-2019-11510 — Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability art-3019
crit CISA KEV: CVE-2019-11539 — Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability art-3020
crit CISA KEV: CVE-2021-1906 — Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability art-3021
crit CISA KEV: CVE-2021-1905 — Qualcomm Multiple Chipsets Use-After-Free Vulnerability art-3022
crit CISA KEV: CVE-2020-10221 — rConfig OS Command Injection Vulnerability art-3023
crit CISA KEV: CVE-2021-35395 — Realtek AP-Router SDK Buffer Overflow Vulnerability art-3024
crit CISA KEV: CVE-2017-16651 — Roundcube Webmail File Disclosure Vulnerability art-3025
crit CISA KEV: CVE-2020-11652 — SaltStack Salt Path Traversal Vulnerability art-3026
crit CISA KEV: CVE-2020-11651 — SaltStack Salt Authentication Bypass Vulnerability art-3027
crit CISA KEV: CVE-2020-16846 — SaltStack Salt Shell Injection Vulnerability art-3028
crit CISA KEV: CVE-2018-2380 — SAP Customer Relationship Management (CRM) Path Traversal Vulnerability art-3029
crit CISA KEV: CVE-2010-5326 — SAP NetWeaver Remote Code Execution Vulnerability art-3030
crit CISA KEV: CVE-2016-9563 — SAP NetWeaver XML External Entity (XXE) Vulnerability art-3031
crit CISA KEV: CVE-2020-6287 — SAP NetWeaver Missing Authentication for Critical Function Vulnerability art-3032
crit CISA KEV: CVE-2020-6207 — SAP Solution Manager Missing Authentication for Critical Function Vulnerability art-3033
crit CISA KEV: CVE-2016-3976 — SAP NetWeaver Directory Traversal Vulnerability art-3034
crit CISA KEV: CVE-2019-16256 — SIMalliance Toolbox Browser Command Injection Vulnerability art-3035
crit CISA KEV: CVE-2020-10148 — SolarWinds Orion Authentication Bypass Vulnerability art-3036
crit CISA KEV: CVE-2021-35211 — SolarWinds Serv-U Remote Code Execution Vulnerability art-3037
crit CISA KEV: CVE-2016-3643 — SolarWinds Virtualization Manager Privilege Escalation Vulnerability art-3038
crit CISA KEV: CVE-2020-10199 — Sonatype Nexus Repository Remote Code Execution Vulnerability art-3039
crit CISA KEV: CVE-2021-20021 — SonicWall Email Security Improper Privilege Management Vulnerability art-3040
crit CISA KEV: CVE-2019-7481 — SonicWall SMA100 SQL Injection Vulnerability art-3041
crit CISA KEV: CVE-2021-20016 — SonicWall SSLVPN SMA100 SQL Injection Vulnerability art-3042
crit CISA KEV: CVE-2020-12271 — Sophos SFOS SQL Injection Vulnerability art-3043
crit CISA KEV: CVE-2020-10181 — Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability art-3044
crit CISA KEV: CVE-2017-6327 — Symantec Messaging Gateway Remote Code Execution Vulnerability art-3045
crit CISA KEV: CVE-2019-18988 — TeamViewer Desktop Bypass Remote Login Vulnerability art-3046
crit CISA KEV: CVE-2017-9248 — Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability art-3047
crit CISA KEV: CVE-2021-31755 — Tenda AC11 Router Stack Buffer Overflow Vulnerability art-3048
crit CISA KEV: CVE-2020-10987 — Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability art-3049
crit CISA KEV: CVE-2018-14558 — Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability art-3050
crit CISA KEV: CVE-2018-20062 — ThinkPHP "noneCms" Remote Code Execution Vulnerability art-3051
crit CISA KEV: CVE-2019-9082 — ThinkPHP Remote Code Execution Vulnerability art-3052
crit CISA KEV: CVE-2019-18187 — Trend Micro OfficeScan Directory Traversal Vulnerability art-3053
crit CISA KEV: CVE-2020-8467 — Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability art-3054
crit CISA KEV: CVE-2020-8468 — Trend Micro Multiple Products Content Validation Escape Vulnerability art-3055
crit CISA KEV: CVE-2020-24557 — Trend Micro Multiple Products Improper Access Control Vulnerability art-3056
crit CISA KEV: CVE-2020-8599 — Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability art-3057
crit CISA KEV: CVE-2021-36742 — Trend Micro Multiple Products Improper Input Validation Vulnerability art-3058
crit CISA KEV: CVE-2021-36741 — Trend Micro Multiple Products Improper Input Validation Vulnerability art-3059
crit CISA KEV: CVE-2019-20085 — TVT NVMS-1000 Directory Traversal Vulnerability art-3060
crit CISA KEV: CVE-2020-5849 — Unraid Authentication Bypass Vulnerability art-3061
crit CISA KEV: CVE-2019-16759 — vBulletin PHP Module Remote Code Execution Vulnerability art-3062
crit CISA KEV: CVE-2019-5544 — VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability art-3063
crit CISA KEV: CVE-2020-3992 — VMware ESXi OpenSLP Use-After-Free Vulnerability art-3064
crit CISA KEV: CVE-2020-3950 — VMware Multiple Products Privilege Escalation Vulnerability art-3065
crit CISA KEV: CVE-2021-22005 — VMware vCenter Server File Upload Vulnerability art-3066
crit CISA KEV: CVE-2020-3952 — VMware vCenter Server Information Disclosure Vulnerability art-3067
crit CISA KEV: CVE-2021-21972 — VMware vCenter Server Remote Code Execution Vulnerability art-3068
crit CISA KEV: CVE-2021-21985 — VMware vCenter Server Improper Input Validation Vulnerability art-3069
crit CISA KEV: CVE-2020-4006 — Multiple VMware Products Command Injection Vulnerability art-3070
crit CISA KEV: CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability art-3071
crit CISA KEV: CVE-2020-11738 — WordPress Snap Creek Duplicator Plugin File Download Vulnerability art-3072
crit CISA KEV: CVE-2019-9978 — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability art-3073
crit CISA KEV: CVE-2021-27561 — Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability art-3074
crit CISA KEV: CVE-2021-40539 — Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability art-3075
crit CISA KEV: CVE-2020-10189 — Zoho ManageEngine Desktop Central File Upload Vulnerability art-3076
crit CISA KEV: CVE-2019-8394 — Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability art-3077
crit CISA KEV: CVE-2020-29583 — Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability art-3078
high Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach art-3089
med Securing S3 bucket configuration and access with Snyk & Solvo art-3090
high How Dun & Bradstreet and Shutterstock built successful security champions programs art-3091
med Why the Facebook outage and Twitch breach matter to business leaders art-3093
med Checking AWS AMI IDs in Terraform using Regula and Open Policy Agent art-3100
high Call for nominations: The Snykie awards for Secure Development art-3105
high Snyk Code CLI support now in public beta art-3108
med Snyk sponsoring 2021 Open Source Summit by the Linux Foundation art-3109
high A (soft) introduction to Python dependency management art-3110
high Detect and prevent dependency confusion attacks on npm to maintain supply chain security art-3111
crit Preventing malicious packages and supply chain attacks with Snyk art-3117
high The key to solving the cybersecurity workforce gap: Enlisting the world’s 27 million developers in the fight art-3120
high The 8 best IntelliJ plugins for improving your coding experience art-3121
crit Plugins to put Node.js application security and observability in your IDE art-3125
high How Snyk Social Trends help you fix essential security vulnerabilities art-3127
high Building Java container images using Jib art-3128
high Use Snyk security policies to prioritize fixes more efficiently art-3130
crit Better Ruby Gemfile security: A step-by-step guide using Snyk art-3132
high Getting started with Snyk for secure Python development art-3135
med Four steps for hardening Amazon EKS security art-3142
med How Snyk is normalizing authentication strategies with Gloo Edge art-3143
high Why you should upgrade to Maven version 3.8.1 art-3144
high Managing Node.js Docker images in GitHub Packages using GitHub Actions art-3147
high Hardening Amazon EKS security with RBAC, secure IMDS, and audit logging art-3149
high Talking visibility, scalability, and relationships in secure development with Phil Guimond of ViacomCBS art-3152
high 5 potential risks of open source software art-3156
high You can’t compare SAST tools using only lists, test suites, and benchmarks art-3164
med Advancing SBOM standards: Snyk and SPDX art-3165
high Understanding the software supply chain security requirements in the cybersecurity Executive Order art-3169
crit Snyk uncovers supply chain security vulnerabilities in Visual Studio Code extensions art-3177
med Snyk takes on responsibility for Node.js ecosystem vulnerability disclosure program art-3178
med Prevent cloud misconfigurations in HashiCorp Terraform with Snyk IaC art-3183
high Trend Micro launches Cloud One Open Source Security powered by Snyk art-3186
high SuiteCRM: PHAR deserialization vulnerability to code execution art-3188
high Snyk uncovers malicious code activities in open source supply chain security on the npm registry art-3190
high Why developer-first SAST tools are the future of code security art-3195
high Securing cloud native applications: ActiveCampaign’s VP, Information Security provides perspective art-3202
high Preventing YAML parsing vulnerabilities with snakeyaml in Java art-3211
high Developer driven workflows: Dockerfile image scanning, prioritization, and remediation art-3213
med Defining developer-first container security art-3218
high Docker Hub authentication: Is 2021 the year you enable 2FA on Docker Hub? art-3219
high How I was hacking docker containers by exploiting ImageMagick vulnerabilities art-3221
med 10 Kubernetes Security Context settings you should understand art-3224
med Automating vulnerability monitoring with Snyk, Prometheus and Grafana art-3225
high SolarWinds Orion Security Breach: A Shift In The Software Supply Chain Paradigm art-3227
crit Snyk IaC scanning enhancements include Azure and AWS infrastructure as code art-3230
high AWS vulnerability scanning using the Snyk integration art-3237
med What makes Verdaccio a successful project? art-3240
high Docker for Node.js developers: 5 things you need to know not to fail your security art-3246
crit Cache poisoning in popular open source packages art-3248
crit What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm art-3249
high Securing your Kubernetes application development with Snyk and Tilt art-3250
med What makes Fastify a successful project? art-3257
high Command line tools for containers—using Snyk with Buildah, Podman, and Skopeo art-3265
crit Kernel privilege escalation: how Kubernetes container isolation impacts privilege escalation attacks art-3268
high 10 git aliases for a faster and productive git workflow art-3269
high Cheatsheet: top 10 application security acronyms art-3270
high Command injection: how it works, what are the risks, and how to prevent it art-3274
high DevSecOps tools for open source projects in JavaScript and Node.js art-3275
crit Buffer overflow in Chromium affecting multiple packages art-3276
high Container image formats under the hood art-3280
high RPM Package Manager: RPM package security scanning with Snyk art-3282
med Python Poetry package manager and security integration with software composition analysis tool art-3283
high From zero to security hero: test your GitHub projects for known vulnerabilities art-3284
high GitHub Actions to securely publish npm packages art-3287
high Node.js security: lessons from the Node.js Security Working Group in triaging vulnerabilities art-3290
med Privileged Docker containers—do you really need them? art-3292
crit Regular Expression Denial of Service (REDoS) in UAParser.js art-3297
high SourMint malicious SDK research write up art-3303
high SourMint: iOS remote code execution, Android findings, and community response art-3305
high JHipster security scanning with Snyk art-3307
high Enabling application security management at scale art-3313
crit Arbitrary code execution in Grunt art-3321
med Building a secure Amazon S3 bucket (AWS) art-3330
high New Gartner Market Guide highlights the importance of Software Composition Analysis (SCA) art-3332
high SourMint malicious SDK research writeup art-3336
high Prototype pollution in express-fileupload art-3337
crit Breaking out of message brokers art-3345
high Arbitrary File Write via Archive Extraction (Zip Slip) in go-rpmutils art-3353
high Navigate 3 trends in financial services with DevSecOps art-3355
crit Demystifying HTTP request smuggling art-3358
crit Regular Expression Denial-of-Service in websocket-extensions art-3362
high Checking Helm Charts for security misconfigurations art-3371
crit Why do organizations trust Snyk to win the open source security battle? art-3375
med Using Snyk to implement end-to-end DevSecOps on Microsoft Azure art-3378
med 3 big Amazon S3 vulnerabilities you may be missing art-3384
med Snyk achieves AWS Lambda Ready designation art-3392
high Why did is-promise happen and what can we learn from it art-3394
med Snyk achieves Amazon Linux 2 ready designation art-3398
high Snyk vulnerability disclosure program: what’s going on behind the scenes? art-3402
high Yarn 2 plugins - an introduction art-3403
crit Vulnerable Gradle plugin-publish plugin reveals sensitive information art-3411
high March in review: State of Open Source Security survey, All.The.Talks virtual conference, and more art-3412
med Using UBI images to minimize container vulnerabilities art-3415
high Creating an automated cloud infrastructure testing tool with Terraform and PyTest art-3416
crit Exploring the minimist prototype pollution security vulnerability art-3417
med The State of Open Source Security Survey - 2020 art-3418
high What is a backdoor? Let’s build one with Node.js art-3421
med Fastify Node.js framework improves JSON security thanks to a security report art-3427
crit Ghostcat breach affects all Tomcat versions art-3437
med Security breach leaks the personal data of all 6.5 million Israeli voters art-3441
high Node.js release fixes a critical HTTP security vulnerability art-3444
crit Understanding filesystem takeover vulnerabilities in npm JavaScript package manager art-3463
high Malicious packages found to be typo-squatting in Python Package Index art-3467
high Showing application vulnerabilities in Kubernetes-native tooling art-3474
high Uncharted territory - discovering vulnerabilities in public Helm Charts art-3476
med Security digital transformation with James Kaplan art-3477
high Using third party content securely art-3482
med Angular vs React: security bakeoff 2019 art-3485
high 84% of all websites are impacted by jQuery XSS vulnerabilities art-3487
high JavaScript frameworks security report 2019 art-3489
med A Snyk peek into Node.js and npm’s state of open source security report 2019 art-3494
high Why npm lockfiles can be a security blindspot for injecting malicious modules art-3499
med Modern security leader spotlight: with Marcin Hoppe from Auth0 art-3500
high Everything you wanted to know about addressing security vulnerabilities in Linux-based containers art-3501
crit Sequelize ORM npm library found vulnerable to SQL Injection attacks art-3503
med Mastering Node.js version management and npm registry sources like a pro art-3508
high Code execution back door found in Ruby’s rest-client library art-3509
crit Jackson Deserialization Vulnerability art-3510
high A year-old dormant malicious remote code execution vulnerability discovered in Webmin art-3511
high A technical analysis of the Capital One cloud misconfiguration breach art-3518
crit Staying ahead of security vulnerabilities with security patches art-3519
high PCI standards open source security requirements — how to comply? art-3525
crit Concerns of supply-chain attacks amplify as remote code execution was found in Ruby gem strong_password art-3529
crit Snyk research team discovers severe prototype pollution security vulnerabilities affecting all versions of lodash art-3530
high Serverless is great, but what about the security of my AWS Lambda functions and their dependencies? art-3531
high Yet another malicious package found in npm, targeting cryptocurrency wallets art-3533
high npm passes the 1 millionth package milestone! What can we learn? art-3537
high Java Top 10 Security Vulnerabilities Disclosed [2019 - List] art-3539
high Scoring security vulnerabilities 101: Introducing CVSS for CVEs art-3542
high CRLF injection found in popular Python dependency, urllib3 art-3543
med Understanding Amazon S3 security and compliance on AWS art-3545
high A Denial of Service vulnerability discovered in the Axios JavaScript package - affecting all versions of the popular HTTP client art-3546
med Add a SECURITY.md file to your Azure Repos art-3550
high Azure Repos enriched with DevSecOps capabilities art-3556
med 190,000 users affected by Docker Hub’s security breach. Now what? art-3558
med The top two most popular Docker base images each have over 500 vulnerabilities art-3561
high Take actions to improve security in your Docker images art-3563
high After three years of silence, a new jQuery prototype pollution vulnerability emerges once again art-3564
med Securing Bitbucket Cloud with Snyk art-3567
high Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem art-3568
high Snyking in - regular expression denial of service vulnerability exploit in the ms package art-3571
high ReDoS vulnerabilities in npm spikes by 143% and XSS continues to grow art-3577
high Open source maintainers want to be secure, but 70% lack skills art-3580
med Top ten most popular docker images each contain at least 30 vulnerabilities art-3582
high Snyking in - Directory traversal vulnerability exploit in the st package art-3583
crit A serious security flaw in runC can result in root privilege escalation in Docker and Kubernetes art-3587
high Scanning Docker images for key binaries - going beyond package managers art-3589
high How even quick Node.js async functions can block the Event-Loop art-3593
med Severe security vulnerability in Bower’s zip archive extraction art-3594
med Snyk CLI drops support for Node.js 4 (Argon) art-3596
high Snyk - Your Next Career Move! art-3598
high 2018 Year in Review art-3600
high Critical Arbitrary Code Execution Vulnerability Found in Kubernetes art-3601
high Codefresh + Snyk = ship fast and securely art-3605
high Faster & improved tests for JavaScript lockfile based projects art-3606
high A post-mortem of the malicious event-stream backdoor art-3607
high Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months art-3608
med JVM Ecosystem report 2018 - About your Platform and Application art-3612
crit Behind the disclosure: the Zip Slip vulnerability art-3622
high Container vulnerability management for developers art-3627
high The most common vulnerabilities in Maven Central and npm art-3628
med JavaScript and Node.js Security – The Common Pitfalls art-3635
high Attacking an FTP Client: MGETting more than you bargained for art-3636
med Snyk is Now Integrated with Chrome’s Lighthouse art-3637
high Python Mocking 101: Fake it before you make it art-3643
med Where do security patches come from? art-3646
med npm Shrinkwrap reloaded: Locking npm Deps with Package-Lock and Yarn.Lock art-3648
high Using the Snyk API to find and fix vulnerabilities art-3650
med Bower is dead, long live npm. And Yarn. And webpack. art-3651
med 77% of 433,000 sites use vulnerable JavaScript libraries art-3652
high Launching the State of Open Source Security Survey art-3658
high Open source vulnerabilities tripped Equifax, how can you defend yourself? art-3660
med Snyk and Atlassian, Sitting in a Tree art-3661
crit XSS Attacks: The Next Wave art-3664
med Bitbucket Server Integration in Beta art-3665
high Snyk is available on the GOV.UK Digital Marketplace! art-3666
high Which of the OWASP Top 10 Caused the World’s Biggest Data Breaches? art-3667
high Serverless Security implications—from infra to OWASP art-3669
high Maven support is here! art-3670
high Continuously secure all apps with unlimited Snyk projects art-3671
high Type Manipulation: Escaping Template Sandboxes art-3673
low Fixing a Prototype Override Protection Bypass Vulnerability in qs art-3675
high Differences in version handling between RubyGems and npm art-3686
med Launching serverless Snyk art-3689
high Yarn is Micro Secure art-3691
med Enriching bitHound with Snyk art-3699
high HTTPS Adoption *doubled* this year art-3700
high Fixing `marked` XSS vulnerability art-3706
med Architecting a Serverless web application in AWS art-3707
high Mitigating ImageMagick vulnerabilities in Node.js art-3708
high Free vulnerability testing and monitoring for public GitHub projects art-3709
high Exploiting Buffer art-3710
high Using Node.js event loop for timing attacks art-3713
high Keeping your open source credentials closed art-3714
med Launching Snyk art-3715
high A CEO's guide to Emacs art-3716
high Immutable infrastructure: Networks art-3718