T1190Exploit Public-Facing Application
T1190 — Exploit Public-Facing Application is a MITRE ATT&CK technique in the Initial Access tactic. Clankerusecase tracks 487 detection use cases covering it and 2549 threat-intel articles citing it.
Initial Access
487Use cases
2549Articles
0Sub-techniques
1Tactic
Use cases covering this technique (487)
Authentication not detected on admin API endpoint Excessive resource consumption of third-party API JWT authentication bypass attempt Local File Inclusion (LFI) exploited Spring4Shell RCE attempts (CVE-2022-22963) AWS S3 bucket ACL / policy made public Command injection exploited (WAF detection) Distributed credential-stuffing campaign Log4Shell RCE attempts (CVE-2021-44228) SQL injection exploited (WAF detection) SSRF exploited (WAF detection) Asset exposure — vulnerability matches article CVE(s) [WEEKLY] AI-Agent Server (PraisonAI/MCP) Spawns OS Shell or Recon LOLBin — Unauthenticated RCE Exploitation [WEEKLY] AI/LLM Agent Framework Runtime Spawning Shell, Recon, or Egress Child Process [WEEKLY] AI/LLM Framework Web Service Spawns Shell or Network Tool (Agent-Framework Unauthenticated RCE) [WEEKLY] Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) [WEEKLY] Developer/AI tooling runtime spawns shell or egress LOLBin (unauth RCE post-expl) [WEEKLY] Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint [WEEKLY] Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request [WEEKLY] Internet-Exposed AI Agent/LLM Service Spawns Shell or LOLBin After Inbound Connection [WEEKLY] Internet-facing server process spawns interpreter then beacons to first-seen external host within 5 minutes [WEEKLY] Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) [WEEKLY] Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution [WEEKLY] Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress [WEEKLY] Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) [WEEKLY] Public-Facing App Runtime Spawns Shell, LOLBin, or Container-Control Tool [WEEKLY] Self-hosted application service spawns shell or SSH within seconds of inbound unauthenticated API write [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain [WEEKLY] Service-process parent spawns subprocess containing CLI-argument-injection tokens [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host [WEEKLY] Web-Facing Service Process Writes to RCE/Persistence Paths (Path-Traversal File-Write) [WEEKLY] Web-Server Process Post-Exploit Anchor: Plugin/Extension RCE Leading to Shell Spawn or Webroot Script Drop Cisco IOS XE Request Platform Package Describe Shell Pattern Cisco IOS XE WebUI Login From IOSd Local Port Cisco IOS XE WebUI Programmatic Configuration CrushFTP Server Side Template Injection Ivanti VTM New Account Creation Ollama Possible RCE via Model Loading Ollama Suspicious Prompt Injection Jailbreak PTC Windchill Gateway Command Execution PTC Windchill GW READY OK Probe Suspicious Java Classes Cisco NVM - Webserver Download From File Sharing Website ConnectWise ScreenConnect Path Traversal ConnectWise ScreenConnect Path Traversal Windows SACL Detect Exchange Web Shell Exchange PowerShell Abuse via SSRF Java Writing JSP File Linux Suspicious React or Next.js Child Process Living Off The Land Detection Log4Shell CVE-2021-44228 Exploitation MOVEit Certificate Store Access Failure MOVEit Empty Key Fingerprint Authentication Attempt MS Exchange Mailbox Replication service writing Active Server Pages Outbound Network Connection from Java Using Default Ports PaperCut NG Suspicious Behavior Debug Log Web or Application Server Spawning a Shell Windows Identify PowerShell Web Access IIS Pool Windows Metasploit Confluence Plugin Execution Windows MOVEit Transfer Writing ASPX Windows PaperCut NG Spawn Shell Windows SharePoint Spinstall0 Webshell File Creation Windows Shell or Script Execution From IIS Directory Windows Shell Process from CrushFTP Windows Suspicious React or Next.js Child Process Windows TeamCity Payload Execution from Temp Directory Windows TeamCity Plugin Installed Windows Unusual File Creation in Confluence Directory Windows WSUS Spawning Shell WinRM Spawning a Process Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity Cisco SD-WAN - Low Frequency Rogue Peer Cisco SD-WAN - Peering Activity Cisco Secure Firewall - High Priority Intrusion Classification Cisco Secure Firewall - Lumma Stealer Activity Cisco Secure Firewall - Oracle E-Business Suite Correlation Cisco Secure Firewall - Oracle E-Business Suite Exploitation Cisco Secure Firewall - React Server Components RCE Attempt Cisco Secure Firewall - Static Tundra Smart Install Abuse Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity Cisco Smart Install Oversized Packet Detection Cisco Smart Install Port Discovery and Status Detect Outbound LDAP Traffic Detect Zerologon via Zeek F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint Adobe ColdFusion Access Control Bypass Adobe ColdFusion Unauthenticated Arbitrary File Read Cisco IOS XE Implant Access Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure Citrix ADC and Gateway Unauthorized Data Disclosure Citrix ADC Exploitation CVE-2023-3519 Citrix ShareFile Exploitation CVE-2023-24489 Confluence CVE-2023-22515 Trigger Vulnerability Confluence Data Center and Server Privilege Escalation Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527 Confluence Unauthenticated Remote Code Execution CVE-2022-26134 ConnectWise ScreenConnect Authentication Bypass CrushFTP Authentication Bypass Exploitation Detect F5 TMUI RCE CVE-2020-5902 Exploit Public Facing Application via Apache Commons Text Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 Fortinet Appliance Auth bypass HTTP Duplicated Header HTTP Rapid POST with Mixed Status Codes HTTP Request to Reserved Name on IIS Server Hunting for Log4Shell Ivanti Connect Secure Command Injection Attempts Ivanti Connect Secure SSRF in SAML Component Ivanti Connect Secure System Information Access via Auth Bypass Ivanti EPM SQL Injection Remote Code Execution Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082 Java Class File download by Java User Agent Jenkins Arbitrary File Read CVE-2024-23897 JetBrains TeamCity Authentication Bypass CVE-2024-27198 JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 JetBrains TeamCity RCE Attempt Juniper Networks Remote Code Execution Exploit Detection Log4Shell JNDI Payload Injection Attempt Log4Shell JNDI Payload Injection with Outbound Connection Nginx ConnectWise ScreenConnect Authentication Bypass PaperCut NG Remote Web Access Attempt ProxyShell ProxyNotShell Behavior Detected SAP NetWeaver Visual Composer Exploitation Attempt Spring4Shell Payload URL Request SQL Injection with Long URLs Tomcat Session Deserialization Attempt Tomcat Session File Upload Attempt VMWare Aria Operations Exploit Attempt VMware Server Side Template Injection Hunt VMware Workspace ONE Freemarker Server-side Template Injection Web JSP Request via URL Web Remote ShellServlet Access Web Spring4Shell HTTP Request Class Module Web Spring Cloud Function FunctionRouter Windows Exchange Autodiscover SSRF Abuse Windows IIS Server PSWA Console Access Windows SharePoint Spinstall0 GET Request Windows SharePoint ToolPane Endpoint Exploitation Attempt WordPress Bricks Builder plugin RCE WS FTP Remote Code Execution Ivanti Sentry Authentication Bypass Linux Java Spawning Shell Splunk Enterprise Windows Deserialization File Partition Splunk RCE via Serialized Session Payload Splunk Unauthenticated Log Injection Web Service Log Windows Java Spawning Shells [LLM] Vulnerable on-prem Exchange OWA exposed to CVE-2026-42897 (TA488 half-click XSS) [LLM] Cisco FMC www account runs package_info.pl on staged /var/tmp/license.tmp (CVE-2026-20316/20079) [LLM] Exposed Rails apps vulnerable to Active Storage libvips file-read (CVE-2026-66066) [LLM] Unauthenticated image-upload burst to Rails Active Storage endpoints (CVE-2026-66066 delivery) [LLM] JFrog Artifactory zero-day chain (CVE-2026-65617 et al.) — vulnerable version present [LLM] JFrog Artifactory service process spawning a shell or downloader (RCE exploitation) [LLM] Artifactory host egress to public internet (package-registry sandbox escape) [LLM] Prebid-server SSRF payload in OpenRTB2 auction request parameters [LLM] Prebid-server outbound requests to internal ranges / internal host fan-out (SSRF) [LLM] Prebid-server SSRF filter-bypass via encoded internal host in request [LLM] Ruflo MCP bridge unauthenticated tools/call terminal_execute (RufRoot CVE-2026-59726) [LLM] Ruflo AgentDB memory poisoning via MCP pattern-store write [LLM] Inbound network access to Ruflo bridge (3001) / MongoDB (27017) from public source [LLM] Exposure hunt: vCenter auth-bypass + directory-traversal RCE (CVE-2026-59309 / CVE-2026-59310) [LLM] Inbound OT-segment connections from CyberAv3ngers infrastructure (185.82.73.160/28, 135.136.1.133) [LLM] Internet-sourced access to OT/ICS PLCs on EtherNet/IP, Modbus & S7comm ports [LLM] Vulnerable Rockwell/Allen-Bradley MicroLogix PLCs exposed to campaign CVEs [LLM] Coordinated fan-out from CyberAv3ngers infrastructure across multiple OT sites [LLM] Check Point mgmt server contact from CVE-2026-16232 exploitation source IPs [LLM] Check Point SmartConsole admin login via forged application token (CVE-2026-16232) [LLM] JFrog Artifactory zero-day cluster (CVE-2026-659xx) exposure — pre-7.161.15 with Anonymous Access [LLM] Gitea diffpatch endpoint abused twice for add/add hook-drop (CVE-2026-60004) [LLM] Gitea git process spawning shell / network tool via planted hook (CVE-2026-60004 RCE) [LLM] Git server-side hook file written (hooks/post-index-change) - CVE-2026-60004 persistence [LLM] Vulnerable Gitea version exposed to CVE-2026-60004 (pre-1.27.1) [LLM] Vulnerable @hypequery/clickhouse dependency present (< 2.0.2, CVE-2026-54658) [LLM] @hypequery/clickhouse SQLi: backslash-quote escape bypass in web/API request parameters [LLM] ClickHouse query_log shows injected SQL from @hypequery escapeValue bypass [LLM] ClickHouse SQL syntax-error spike from @hypequery/clickhouse injection probing [LLM] goshs WebDAV --no-delete bypass: blocked DELETE followed by successful MOVE on same path [LLM] WebDAV MOVE/COPY write-verb succeeds against goshs artifact server (Overwrite:T destination clobber) [LLM] Vulnerable goshs SFTP launch: empty-credential basic-auth (-b 'user:' / ':pass') with -sftp and no -fkf [LLM] JFrog Artifactory SSRF egress to non-registry destinations (internet escape) [LLM] Anonymous access to Artifactory Terraform/Cargo/Ansible remote repositories [LLM] JFrog Artifactory service process spawning a shell or network tool (RCE) [LLM] vBulletin CVE-2026-61511 pre-auth RCE via ajax/render/pagenav template request [LLM] vBulletin web-server process (php-fpm/apache/nginx) spawning OS shell after CVE-2026-61511 [LLM] Anomalous Host header on Poweradmin OIDC/SAML/logout endpoints (CVE-2026-54588) [LLM] Host header fuzzing burst against Poweradmin auth endpoints from single source [LLM] Spike of AADSTS50011 redirect_uri mismatch at IdP (poisoned Poweradmin callback) [LLM] Self-hosted JFrog Artifactory exposed to OpenAI-credited zero-days CVE-2026-65618/65923/66018 [LLM] Inbound DHCPv6 to odhcpd (UDP 547) from non-link-local source — CVE-2026-53921 exploit reach [LLM] LuCI luci-app-commands / ddns command injection with shell metacharacters — root RCE [LLM] cgi-io path traversal reading root files — CVE-2026-62947 [LLM] Vulnerable TeamCity On-Premises exposed to CVE-2026-63077 (unauth agent-polling RCE) [LLM] TeamCity server (java) process spawning an OS command interpreter — CVE-2026-63077 RCE [LLM] Inbound connections from Arista-attributed VeloCloud Orchestrator attacker IPs (CVE-2026-16812) [LLM] vBulletin CVE-2026-61511 pre-auth RCE via operator-laden pagenav[pagenumber] to ajax/render/pagenav [LLM] vBulletin web-server process (php-fpm/httpd/w3wp) spawning OS shell — CVE-2026-61511 post-exploitation [LLM] Unpatched vBulletin instances exposed to CVE-2026-61511 [LLM] Fastjson 1.x CVE-2026-16723 exploit payload in inbound JSON (@type + nested JAR / /proc/self/fd) [LLM] Spring Boot Java process spawning shell/LOLBin child (Fastjson RCE execution) [LLM] Java (fat-JAR) outbound fetch of remote JAR / SSRF egress to public IP (CVE-2026 [LLM] GitLab Puma/Ruby worker (running as git) spawns shell or network tool — Oj .ipynb RCE landing [LLM] Outbound reverse-shell egress from GitLab Ruby/Puma worker as git — Oj RCE connect-back [LLM] Cl0p hex-named JSP web shell dropped under /Windchill/login/ (CVE-2026-12569) [LLM] PTC Windchill Java/Tomcat web tier spawning OS command shell (web shell RCE) [LLM] Pheditor forced-password-change auth bypass — POST to pheditor.php [LLM] Web-server / PHP process writes new .php file under webroot (post-Pheditor webshell drop) [LLM] Budibase REST query published to PUBLIC role (unauth cred-leak enabler) [LLM] Stacked SQL-injection payload against Budibase datasource query API (multipleStatements) [LLM] MySQL server (mysqld) writes exfil file via SELECT INTO OUTFILE on Budibase DB host [LLM] OpenAM /authservice CustomCallback ClassName XML — CVE-2026-62379 pre-auth Class.forName RCE [LLM] OpenAM/Tomcat java process spawning shell or LOLBin — CVE-2026-62379 post-exploitation [LLM] OpenAM WebAuthn pre-auth Java deserialization payload to /json/authenticate (CVE-2026-62263) [LLM] OpenAM/Tomcat Java process spawning a shell — post-deserialization RCE (CVE-2026-62263) [LLM] Node.js host process spawning OS shell (Nunjucks SSTI child_process.execSync RCE) [LLM] Vulnerable @prompty/core package present in node_modules (GHSA-w28w-gp39-m4p6 exposure) [LLM] Velocity.js SSTI RCE payload (constructor.constructor→child_process) in HTTP request [LLM] Node.js process spawning shell / recon binary (velocityjs SSTI RCE execution) [LLM] Vulnerable seroval (<=1.5.2) / TanStack Start (<1.167.30) exposure to CVE-2026-59940 deserialization RCE [LLM] NodeBB admin-panel access via homepage-setting authorization bypass (first-seen admin API) [LLM] NodeBB translation-token template-injection XSS in web request URI [LLM] NodeBB ActivityPub private-message disclosure via unsigned GET enumeration [LLM] Unauthenticated NodeBB ActivityPub category-outbox private-content disclosure [LLM] NodeBB federation actor spoofing — new peer POSTing to ActivityPub inbox (CVE-2026-58593 / vote inflation) [LLM] Vulnerable stock Redis version exposed (6.2.22/7.4.9/8.6.4/8.8.0 — July 2026 RESTORE RCE) [LLM] redis-server spawns a shell/interpreter (system() from Redis RCE chain) [LLM] Auth.js fail-open exploited: protected routes served 200/302 during an active auth-error window [LLM] Unpatched Zimbra Collaboration exposed to CVE-2025-66376 (Void Blizzard target) [LLM] wp2shell SQLi via author__not_in REST parameter (CVE-2026-60137) [LLM] Gitea PR-update endpoint enumeration across multiple repositories (CVE-2026-58443) [LLM] Vulnerable Gitea Docker version exposed to CVE-2026-20896 (auth bypass) [LLM] Gitea webhook/migration SSRF reaching cloud metadata endpoints (IMDS / Azure WireServer) [LLM] Gitea process egress to SSRF allow-list bypass internal ranges (CGNAT / 172.32.0.0/11) [LLM] Vulnerable Gitea version exposed to CVE-2026-22874 SSRF (pre-1.26.4) [LLM] Vitest Browser Mode / test API (node.exe) accepting inbound connections on 63315/51204 from non-loopback host [LLM] MSSQL sqlservr.exe spawning OS shell via xp_cmdshell (XEntry Team) [LLM] LightRAG destructive document ops post-bypass (DELETE /documents, clear_cache, unauth upload) [LLM] WordPress wp2shell batch REST API pre-auth RCE exploitation (CVE-2026-63030/60137) [LLM] Web server daemon (php-fpm/apache/nginx/w3wp) spawning a shell or network tool — wp2shell post-exploit code execution [LLM] Siemens RUGGEDCOM ROX II devices exposed to CVE-2025-40947/48/49 (firmware < V2.17.1) [LLM] Pheditor terminal RCE: web-server/PHP process spawns shell (CVE-2026-55579) [LLM] Pheditor file-upload abuse: web-server process writes new .php webshell [LLM] Pheditor default-credential exploitation traffic: POST to /pheditor.php from external source [LLM] EnvoyExtensionPolicy Lua with double-slash path traversal to secrets (CVE-2026-53713) [LLM] EnvoyExtensionPolicy Lua invoking os/io/debug file primitives [LLM] Anomalous EnvoyExtensionPolicy submitter / suspicious policy name [LLM] Vulnerable Envoy Gateway version exposed to CVE-2026-53713 [LLM] Unauthenticated access to MantisBT admin/install.php on a production host (CVE-2026-52847) [LLM] Credential-phishing form injection via reflected XSS in MantisBT install.php (CVE-2026-52881) [LLM] Meta open-redirect injection via reflected XSS in MantisBT install.php (CVE-2026-52881) [LLM] Broad reflected HTML/XSS payload tokens in MantisBT install.php query string [LLM] MantisBT self-registration (signup.php) followed by SOAP replay to mantisconnect.php from same source [LLM] FacturaScripts upload endpoint: path-traversal sequence in multipart filename [LLM] FacturaScripts: PHP/.htaccess web-shell written into web-served Dinamic/Assets or node_modules [LLM] FacturaScripts RCE chain: .htaccess handler-remap override plus payload drop in same asset dir [LLM] n8n-MCP vulnerable multi-tenant config exposure (ENABLE_MULTI_TENANT without version-tool mitigation) [LLM] Anyquery server mode bound to all interfaces (exposed unauthenticated MySQL port) [LLM] Inbound connection to Anyquery listener from a public IP [LLM] Anyquery process writing files to cron/webroot/SSH persistence paths (ATTACH DATABASE AFW) [LLM] ATTACH DATABASE statement targeting persistence paths in Anyquery query logs [LLM] FacturaScripts CVE-2026-45262 SQLi: parenthesis-bypass in REST API filter[] key [LLM] FacturaScripts filter[] SQLi column-count / schema enumeration (burst probing) [LLM] Kimai authenticated session activity with no preceding form-login POST (forged remember-me cookie) [LLM] Kimai forged Symfony login-link request (user+expires+hash signed URL) to super_admin [LLM] DIRAC FileCatalog checkDataset SQL injection carrying Python eval gadget (CVE-2026-61667) [LLM] DIRAC FileCatalog service Python process spawns shell or recon binary (eval RCE) [LLM] DIRAC ReqManager service (CVE-2026-45579) spawning a shell or recon/egress binary [LLM] File Browser hook-auth pre-auth RCE: filebrowser spawns shell/recon commands (CVE-2026-54088) [LLM] FileBrowser reverse-proxy bypass: direct external access to exposed port 8085 [LLM] FileBrowser instance configured with auth.method=proxy (exploitable-config exposure) [LLM] Authorizer /authorize implicit-flow token leak to off-origin redirect_uri (CVE-2026-54072) [LLM] Authorizer unauthenticated /graphql client_id reconnaissance (CVE-2026-54072 pre-exploit) [LLM] Authorizer /authorize redirect_uri iteration — multiple distinct targets from one source [LLM] Spike in Authorizer /authorize 302 redirects to off-origin hosts (bulk token exfiltration) [LLM] YesWiki Bazar CalcField eval() RCE — dangerous PHP functions in form-save request [LLM] YesWiki CalcField ReDoS/stack-overflow DoS — deeply nested parentheses payload [LLM] YesWiki post-RCE — php-fpm/apache spawns Unix shell or recon binary (www-data) [LLM] YesWiki CalcField exploit attempts — PHP parse/fatal errors from CalcField.php in syslog [LLM] YesWiki BazarImportAction object-injection exploit request (CVE-2026-52777) [LLM] Base64 PHP-serialized-object payload in importfiche POST body [LLM] YesWiki web-server process spawning an OS shell (deserialization RCE outcome) [LLM] YesWiki unauthenticated erasespamedcomments page-deletion invocation (CVE-2026-52766) [LLM] Unpatched Ruckus/ASUS edge devices exposed to UAT-7810 exploit CVEs [LLM] Nuclio CronJob container args carry injected shell (CVE-2026-52831 header/body OS command injection) [LLM] SSRF via Better Auth SSO provider registration to internal endpoints (CVE-2026-53513) [LLM] Better Auth OIDC discovery probe followed by token/registration endpoint access (CVE-2026-53512/53513 recon) [LLM] EGroupware CVE-2026-27823 arbitrary file read via importexport download path traversal [LLM] EGroupware header.inc.php overwritten by web process (CVE-2026-27823 RCE persistence) [LLM] 9router credential dump via GET /api/settings/database (CVE-2026-55500) [LLM] 9router export-then-import chain from same source (CVE-2026-55500 takeover) [LLM] 9router token brute-force burst against /api/settings/database (CVE-2026-55500) [LLM] Cypher injection primitives in Langroid LLM prompt / inbound HTTP input [LLM] Neo4j executes attacker-primitive Cypher (apoc.*, dbms.*, LOAD CSV) via query.log [LLM] Neo4j server outbound egress to public IP (LOAD CSV / apoc.load SSRF) [LLM] Rocket.Chat Livechat file-upload ID enumeration sweep (ObjectId harvest) [LLM] Rocket.Chat anonymous Livechat visitor bootstrap chained to file-upload access [LLM] Rocket.Chat file-upload request carrying Livechat auth params (IDOR signature) [LLM] Twig SSTI markers in request-controlled fields against Craft/Formie public forms [LLM] Active Twig RCE gadget strings in Craft/Formie HTTP request inputs [LLM] Craft/PHP/IIS web worker spawning a command shell (Formie SSTI RCE outcome) [LLM] Forged unsigned (alg:none) JWT Bearer token reaching Apache Camel route (CVE-2026-53913) [LLM] Vulnerable camel-keycloak version exposed (CVE-2026-53913 affected range) [LLM] Apache Camel DNS SSRF: inbound HTTP request carrying dns.server / dns.name control headers [LLM] Apache Camel gridfs.* control-header injection inbound (CVE-2026-48204 exploit) [LLM] phpBB CVE-2026-48611 auth bypass via login_link auth_provider=apache [LLM] phpBB CVE-2026-48611 post-exploit ACP access from exploiting IP [LLM] HTTP Basic Authorization header sent to phpBB login_link endpoint [LLM] 9router unauthenticated MCP / cli-tools route RCE via process spawn — CVE-2026-46339 [LLM] GravitLauncher LaunchServer secret read via unauth path traversal (ecdsa_id/legacySalt/LaunchServer.json) [LLM] LaunchServer path-traversal exploit signature: request-target without leading slash / %2e%2e on port 9274 [LLM] fast-mcp-telegram traversal token in request URL (URL-auth middleware) CVE-2026-52830 [LLM] Unauthenticated POST to 9router /api/tunnel/tailscale-install (CVE-2026-59800 auth bypass) [LLM] Web-server process writes PHP file into Mautic config/cache/media/logs (zip-slip landing) [LLM] Mautic campaign import ZIP upload — POST to campaign import endpoint [LLM] Mautic Twig SSTI RCE: PHP/web process spawns OS shell (CVE-2026-9558) [LLM] Weaponized Twig theme written under Mautic themes/ by web process (CVE-2026-9558) [LLM] Affected zebrad (<= v4.4.1) exposure to P2SH sigop consensus-split (CVE-2026-52735) [LLM] zebrad node process execution at vulnerable version (CVE-2026-52735) [LLM] CVE-2026-50027 unauthenticated write to mcp-memory-service /api/documents/upload [LLM] CVE-2026-50027 auth-bypass fingerprint: 401 on /api/memories then 200 on /api/documents from same source [LLM] CVE-2026-50027 full exploit chain: probe, write, bulk-read, delete from one source in 15m [LLM] Web shell execution: web server process spawning command interpreters [LLM] Ghost x-ghost-preview cache-poisoning header in inbound HTTP requests (CVE-2026-53943) [LLM] Unauthenticated x-ghost-preview request to cached Ghost frontend (CVE-2026-53943 precondition) [LLM] Ghost x-ghost-preview request carrying XSS payload markers (CVE-2026-53943 execution) [LLM] Rancher Manager assets vulnerable to CVE-2026-41052 (PSA privilege-escalation exposure) [LLM] Rancher /v3/import authImage YAML injection via URL-encoded newlines (CVE-2026-44939) [LLM] Rancher /v3/import registration-token enumeration or cross-source reuse [LLM] FortiGate jsconsole / loopback admin login (CVE-2024-55591 auth-bypass exploitation) [LLM] Exposed phpBB instances vulnerable to CVE-2026-48611 / 48612 / 29199 auth bypass [LLM] phpBB ACP access from a source IP with no prior login (CVE-2026-48611 session hijack) [LLM] phpBB password-reset host-header poisoning (CVE-2026-29199) [LLM] phpBB OAuth account-binding CSRF via cross-site request to /user/oauth/authenticate/ (CVE-2026-48612) [LLM] Thymeleaf SpEL tab-character sandbox bypass payload in HTTP request (CVE-2026-40478) [LLM] Java/Tomcat process writes .jsp webshell file to disk (CVE-2026-40478 post-exploit drop) [LLM] Java/Tomcat process spawns OS command interpreter (post-Thymeleaf SSTI RCE) [LLM] Qinglong CVE-2026-3965 auth bypass via /open/user/init credential reset [LLM] Qinglong CVE-2026-4047 case-mismatch auth bypass via /aPi/system/command-run [LLM] Mailcow Autodiscover endpoint receives unauthenticated XSS payload (GHSA-f9xf-vc72-rcgm) [LLM] Mailcow login with HTML/JS injected into X-Real-IP header (GHSA-jprq-w83q-q62h) [LLM] Hoppscotch device-login open redirect token theft via localhost.* / sslip.io bypass [LLM] Hoppscotch Mock Server stored XSS via GraphQL updateRESTUserRequest content-type override [LLM] Hoppscotch cross-team request injection via moveRequest GraphQL with null nextRequestID [LLM] BodySnatcher (CVE-2025-12420) ServiceNow Virtual Agent bot/integration exploit [LLM] BodySnatcher (CVE-2025-12420) — Hardcoded 'servicenowexternalagent' Token Observed in HTTP Traffic [LLM] ServiceNow Virtual Agent Invocation of Hidden AIA-Agent Invoker AutoChat Topic (CVE-2025-12420) [LLM] Vulnerable react-server-dom-* package versions (CVE-2025-55182) in workload inventory [LLM] Node.js process spawning interactive shell — suspected post-exploit RCE on Next.js / RSC server [LLM] Anomalous POST to Next.js Server Action / RSC endpoint with 5xx error clustering [LLM] Next.js CVE-2025-29927 middleware bypass via x-middleware-subrequest header [LLM] Apache Spark CVE-2022-33891 doAs command injection — shell spawned by Spark JVM running 'id -Gn' with metacharacters [LLM] ImageMagick 'convert -resize' command injection via sh -c in Go web app [LLM] Inbound UDP/631 (CUPS IPP discovery) from external network [LLM] Linux assets with vulnerable CUPS packages and external exposure (CVE-2024-47175/76/77/076) [LLM] Log4Shell JNDI exploitation string in inbound HTTP requests (CVE-2021-44228) [LLM] Log4Shell outbound JNDI callback from Java process to LDAP/RMI (CVE-2021-44228) [LLM] Spring4Shell classLoader payload in inbound HTTP request (CVE-2022-22965) [LLM] Spring4Shell JSP webshell drop by Tomcat/Java into webapps (CVE-2022-22965) [LLM] Exposure: hosts running python-multipart ≤0.0.6 / FastAPI ≤0.109.0 vulnerable to CVE-2024-24762 ReDoS [LLM] Vulnerable HTTP/2 server inventory: CONTINUATION flood CVE cluster (CVE-2024-27316 et al.) [LLM] HTTP/2 server crash-loop on internet-facing host (CONTINUATION flood DoS exploitation signal) [LLM] Web-app runtime egress to AWS IMDS endpoint (169.254.169.254) — SSRF credential theft [LLM] Boolean-tautology SQL injection against Node.js/Express search endpoint [LLM] Vulnerable Jinja2 < 3.1.3 inventory pivot for CVE-2024-22195 (xmlattr XSS) [LLM] Jinja2 xmlattr XSS exploitation attempt in HTTP request parameters (CVE-2024-22195) [LLM] Struts CVE-2023-50164 path-traversal upload — HTTP exploit attempt [LLM] Tomcat/Java process writes .jsp/.jspx webshell into webapp directory [LLM] Tomcat/Java process spawns OS shell or LOLBin (post-webshell RCE) [LLM] PHP web-server process initiating outbound TCP (fsockopen reverse shell to attacker) [LLM] PHP CLI dev server (php -S) spawning a shell or child interpreter (proc_open php -a) [LLM] Browser extension folder write at vulnerable React DevTools 4.27.8 / Vue.js devtools 6.5.0 [LLM] Curl invoked with SOCKS5-hostname resolution (CVE-2023-38545 exploit precondition) [LLM] Vulnerable libcurl/curl version present on host (CVE-2023-38545) [LLM] Hosts exposed to libwebp heap overflow CVE-2023-4863 / CVE-2023-5129 (TVM) [LLM] Vulnerable SnakeYAML <2.0 present (CVE-2022-1471 unsafe deserialization) [LLM] JVM (java/javaw) spawning OS command interpreter — SnakeYAML gadget RCE outcome [LLM] JVM outbound fetch of remote class/JAR to public host — URLClassLoader gadget [LLM] node-serialize / serialize-to-js deserialization RCE payload marker `_$$ND_FUNC$$_` in web request [LLM] Node.js process spawning a command interpreter (deserialization RCE child_process exec) [LLM] Ruby/Rails app server spawning a Unix shell (post-deserialization RCE) [LLM] Exposure hunt: hosts running Spring Security vulnerable to CVE-2022-31692 forward/include auth bypass [LLM] SnakeYAML deserialization gadget tags in HTTP request (CVE-2022-1471) [LLM] Java process (java.exe/javaw.exe) spawning OS command shell — SnakeYAML RCE [LLM] Java process outbound LDAP/RMI to fetch remote class — SnakeYAML JNDI gadget [LLM] Pistache CVE-2022-26068 path traversal reading /etc/passwd via /doc/../ [LLM] Pistache binary theft via /doc/../../proc/self/exe path traversal [LLM] curl --path-as-is traversal command exfiltrating /proc/self/exe or /etc/passwd [LLM] URL-encoded directory traversal (%2e%2e) against node 'st' static-file route (CVE-2014-3744) [LLM] Vulnerable OpenSSL 3.0.0–3.0.6 exposure (CVE-2022-3602 / CVE-2022-3786, 'SpookySSL') [LLM] Text4Shell (CVE-2022-42889) Commons Text interpolation payloads in inbound web requests [LLM] Java/JVM spawning OS shell after Text4Shell (CVE-2022-42889) script-engine RCE [LLM] Git argument injection via --upload-pack option spawned by web-app runtime [LLM] Mercurial argument injection via --config alias/hooks or --debugger from app runtime [LLM] git/hg spawning a shell as child of a web-app runtime (argument-injection RCE evidence) [LLM] Server application runtime spawning shell with /dev/tcp redirection (RCE to reverse shell) [LLM] Apache Commons Configuration interpolation RCE payload in HTTP requests (CVE-2022-33980) [LLM] Java (ProcessBuilder) spawning shell/LOLBin child — Commons Config interpolation RCE [LLM] Java process fetching first-seen external URL/DNS — Commons Config url/dns lookup (CVE-2022-33980) [LLM] Prototype pollution attempt via __proto__ in URL query string (CVE-2021-23682, litespeed.js/appwrite) [LLM] Node.js web process overwriting application .js service file (GraphQL path-traversal file write) [LLM] Spring4Shell classLoader property injection via dirContext.docBase (Glassfish/Payara/Tomcat) [LLM] Web path-traversal arbitrary file read via '../' in static-file URL (Crow CVE-2021-23514) [LLM] Arbitrary file write via '../' in upload 'name' parameter (Mongoose CVE-2022-25299) [LLM] Spring4Shell (CVE-2022-22965) classLoader pipeline injection / JSP webshell call in web logs [LLM] Tomcat/Java JVM spawning command shell (Spring4Shell webshell command execution) [LLM] Spring4Shell (CVE-2022-22965) exploit: class.module.classLoader ClassLoader manipulation in HTTP request [LLM] Tomcat/Java writes JSP webshell into webapps (Spring4Shell post-exploit drop) [LLM] Java/Tomcat spawns command shell or download tool (Spring4Shell RCE execution) [LLM] Outbound connection to Spring4Shell Mirai staging IPs (107.174.133.167 / 194.31.98.186) [LLM] HTTP request to executable PHP inside dompdf font cache (CVE-2022-28368 RCE trigger) [LLM] Magento CVE-2022-24086/24087 TrojanOrders checkout exploitation from known attacker IP [LLM] Magento webshell drop (health_check.php / pub-media PHP) written by web-server process [LLM] Magento php-fpm/web-server spawning shell or download utility (CVE-2022-24086 RCE) [LLM] Outbound or inbound connection to TrojanOrders C2/source IP 45.134.20.11 [LLM] Magento CVE-2022-24086 template-directive injection in web requests (getTemplateFilter RCE) [LLM] Magento web process (w3wp/php-fpm/php-cgi) spawning OS shell — CVE-2022-24086 RCE [LLM] Network activity involving CVE-2022-24086 attacker IP 45.134.20.11 [LLM] Celery worker (Python) spawning a shell — CVE-2021-23727 stored command injection [LLM] Hosts running Celery < 5.2.2 vulnerable to CVE-2021-23727 [LLM] Log4Shell JNDI lookup string in inbound web request (CVE-2021-44228 exploitation) [LLM] Java/Tomcat application server spawning command shell or netcat (Log4Shell RCE) [LLM] Java process making outbound LDAP/RMI callout to public host (JNDI egress) [LLM] Log4j logging configuration file modified (CVE-2021-44832 JDBC Appender precondition) [LLM] Java process outbound LDAP/RMI egress (CVE-2021-44832 remote JNDI data source load) [LLM] Vulnerable Apache Log4j inventory exposed to CVE-2021-44832 (pre-2.17.1/2.12.4/2.3.2) [LLM] Log4j CVE-2021-45046 JNDI localhost-bypass payload (${jndi:...127.0.0.1#...}) in web requests [LLM] Log4Shell RCE execution: java/javaw spawning a shell or LOLBin [LLM] Log4Shell JNDI class fetch: java process outbound to LDAP/RMI ports [LLM] Exposure: hosts running Log4j versions vulnerable to CVE-2021-45046 [LLM] Log4Shell JNDI lookup injection string in HTTP requests / process cmdline (${jndi:ldap}) [LLM] Java process making outbound LDAP/RMI connection (Log4Shell second-stage class fetch) [LLM] Java/Tomcat process spawning OS shell (Log4Shell Runtime.exec post-exploitation) [LLM] Log4Shell JNDI lookup string in inbound HTTP request (URI / User-Agent / headers) [LLM] Java (java.exe/javaw.exe) spawning shell or LOLBin — Log4Shell post-exploitation [LLM] Java process outbound to LDAP/RMI/DNS callback port — Log4Shell JNDI fetch [LLM] Log4Shell JNDI lookup string in inbound web request (CVE-2021-44228 exploitation) [LLM] Java process outbound LDAP/RMI to public IP (Log4Shell JNDI callback) [LLM] Java/Tomcat process spawning shell, curl or wget (Log4Shell RCE follow-on) [LLM] Prototype pollution / type-confusion payload in web request (__proto__, constructor[prototype]) [LLM] CVE-2020-9484 Tomcat session deserialization: JSESSIONID path-traversal in HTTP request [LLM] Tomcat/Java server process spawning an OS command shell (CVE-2020-9484 RCE outcome) [LLM] Attacker-staged .session deserialization payload written outside Tomcat's session store [LLM] SuiteCRM PHAR deserialization via case-mixed phar:// wrapper in admin request [LLM] Direct HTTP 200 to SuiteCRM /upload or /files (post-.htaccess-deletion code exec) [LLM] ImageMagick convert spawning shell/LOLBin child (ImageTragick CVE-2016-3714 RCE) [LLM] Semicolon GET parameter cloaking in web/proxy logs (cache poisoning, CVE-2021-23336 / CVE-2020-28473) [LLM] Assets exposed to cache-poisoning CVEs (Python parse_qsl CVE-2021-23336 / Bottle CVE-2020-28473) [LLM] systeminformation inetChecksite curl argument injection (CVE-2020-7752) [LLM] Node.js (Express) process spawning a command shell — express-fileupload prototype-pollution RCE outcome [LLM] Prototype-pollution payload (__proto__ / constructor.prototype) in inbound web requests to Express app [LLM] Exposure: hosts running express-fileupload vulnerable to CVE-2020-7699 [LLM] Celery task injected into Apache Airflow message broker (unacked queue / execute_command) [LLM] Apache Airflow Celery worker spawns non-airflow child (command-injection RCE, CVE-2020-11981) [LLM] Apache Airflow task run with --pickle flag (pickle deserialization, CVE-2020-11982) [LLM] Hosts exposed to Apache Airflow Celery broker RCE (CVE-2020-11981 / CVE-2020-11982) [LLM] GET request carrying a body / Content-Length — HTTP request smuggling (CL:CL) precursor [LLM] Front-end/back-end stack exposed to request-smuggling CVEs (nginx CVE-2020-12440, Werkzeug CVE-2019-16786) [LLM] Ghostcat: inbound AJP (TCP/8009) connections from untrusted/public sources to Tomcat [LLM] Ghostcat RCE: Tomcat/java process spawning a command shell (JSP webshell execution) [LLM] Ghostcat exposure: assets running Tomcat versions vulnerable to CVE-2020-1938 [LLM] Access to exposed Elector '/get-admin-users' credential-leaking API endpoint [LLM] Node.js launched with --insecure-http-parser flag (strict HTTP parsing disabled) [LLM] Hosts exposed to Node.js Feb-2020 HTTP/TLS CVEs (CVE-2019-15604/15605/15606) [LLM] Sequelize ORM JSON-path SQLi exploitation via ')) AS DECIMAL)' cast-break (CVE-2019-10748) [LLM] Exposure: jackson-databind <=2.9.9.2 / Spring Boot 2.1.7 vulnerable to CVE-2019-14379/14439 deserialization RCE [LLM] Java/Spring Boot process spawning a shell — possible jackson-databind deserialization RCE [LLM] Webmin password_change.cgi unauthenticated command injection exploit attempt (CVE-2019-15107) [LLM] Webmin RCE: miniserv/password_change.cgi spawning reverse shell (CVE-2019-15107) [LLM] Vulnerable lodash (CVE-2019-10744 prototype pollution) present in software inventory [LLM] Prototype pollution payload (__proto__ / constructor.prototype) in inbound web requests [LLM] Vulnerable urllib3 (<= 1.24.2 / CVE-2019-11236) present in software inventory [LLM] CRLF / HTTP-header injection in URL query string (urllib3 CVE-2019-11236 PoC shape) [LLM] jQuery prototype pollution payload (__proto__) in inbound HTTP request (CVE-2019-11358) [LLM] URL-encoded directory traversal (%2e%2e) against Node 'st' static file server [LLM] Successful sensitive-file disclosure via st traversal (/etc/passwd, package-lock.json) [LLM] Anonymous access to Kubernetes aggregated API (CVE-2018-1002105 exploit surface) [LLM] Zip Slip arbitrary file overwrite by archive-handling runtime (java/python) via path traversal [LLM] Exposure: hosts running Zip Slip-vulnerable Apache Storm / Hadoop (CVE-2018-8008 / CVE-2018-8009) [LLM] Apache Struts web app (java/Tomcat) spawning OS shell or recon — post-exploit RCE (CVE-2017-5638 / CVE-2017-9805) [LLM] Apache Struts OGNL / XStream exploit payload in WAF & web logs (CVE-2017-5638 + CVE-2017-9805) [LLM] Dust.js qs type-manipulation RCE payload in web request query string [LLM] qs prototype-override bypass exploit attempt in HTTP query string (CVE-2017-1000048) [LLM] ImageMagick binary spawning shell/recon process (ImageTragick CVE-2016-3714 delegate RCE) [LLM] ImageMagick binary making outbound network connection (ImageTragick URL/HTTPS coder SSRF)Articles citing this technique (2549)
crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads art-06
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-74
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit [GHSA / CRITICAL] GHSA-q6x4-v3qx-85qw: Budibase: SQL Injection via `multipleStatements: true` art-85
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
crit Don’t swing at everything art-106
high SQL injection isn't dead art-118
crit CISA KEV: CVE-2026-16232 — Check Point SmartConsole Improper Authentication Vulnerability art-120
crit CISA KEV: CVE-2026-50522 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-121
crit [GHSA / CRITICAL] CVE-2026-59873: node-tar: Decompression/parse DoS via unlimited input art-136
crit Begun, the Patch Wars have art-150
high GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration art-153
crit CISA KEV: CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-160
crit CISA KEV: CVE-2026-46817 — Oracle E-Business Suite Improper Privilege Management Vulnerability art-170
crit [GHSA / CRITICAL] CVE-2026-47677: FacturaScripts: Account takeover of any 2FA-enabled user art-188
crit Winning 54% of the time art-214
crit [GHSA / CRITICAL] CVE-2026-53649: Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE art-219
crit ESET Threat Report H1 2026 art-221
crit When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website art-246
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-253
crit [GHSA / CRITICAL] CVE-2026-59800: 9router: Missing Authorization and OS Command Injection art-257
crit [GHSA / CRITICAL] CVE-2026-9559: Mautic vulnerable to Path Traversal via Campaign Import art-258
high Catan and Mouse art-261
crit [GHSA / CRITICAL] CVE-2026-41052: Rancher has Privilege Escalation from Project Owner to Host art-267
crit CISA KEV: CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability art-297
high The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration art-312
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-316
med From China with tenderness art-323
crit CISA KEV: CVE-2026-11645 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability art-354
crit CISA KEV: CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability art-358
crit CISA KEV: CVE-2026-28318 — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability art-360
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-362
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-380
med How Relay Network Adopted AI Coding Securely and Built the Foundation for Agentic Development art-383
crit CISA KEV: CVE-2026-0257 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability art-385
crit CISA KEV: CVE-2026-34926 — Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability art-409
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-412
crit CISA KEV: CVE-2009-3459 — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability art-417
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-431
crit CISA KEV: CVE-2026-42897 — Microsoft Exchange Server Cross-Site Scripting Vulnerability art-432
crit CISA KEV: CVE-2026-20182 — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability art-436
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-440
crit Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks art-454
med Bridging the Gap to Autonomous Fixes: Snyk and Atlassian Unveil Intelligent Remediation for Jira art-470
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-471
high Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478) art-472
crit CISA KEV: CVE-2026-32202 — Microsoft Windows Protection Mechanism Failure Vulnerability art-474
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
crit CISA KEV: CVE-2026-32201 — Microsoft SharePoint Server Improper Input Validation Vulnerability art-508
med Dev Machine Guard Is Now Open Source: See What's Really Running on Your Developer Machine art-524
crit CISA KEV: CVE-2026-1340 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-529
crit CISA KEV: CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control Vulnerability art-533
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-551
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-555
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
crit CISA KEV: CVE-2025-43520 — Apple Multiple Products Classic Buffer Overflow Vulnerability art-573
crit CISA KEV: CVE-2026-20963 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-584
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-590
crit CISA KEV: CVE-2026-1603 — Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability art-599
crit CISA KEV: CVE-2017-7921 — Hikvision Multiple Products Improper Authentication Vulnerability art-602
crit CISA KEV: CVE-2021-30952 — Apple Multiple Products Integer Overflow or Wraparound Vulnerability art-605
crit CISA KEV: CVE-2026-22719 — Broadcom VMware Aria Operations Command Injection Vulnerability art-609
crit CISA KEV: CVE-2026-25108 — Soliton Systems K.K FileZen OS Command Injection Vulnerability art-620
crit CISA KEV: CVE-2025-49113 — RoundCube Webmail Deserialization of Untrusted Data Vulnerability art-624
med Weaving Security into the Flow: New Snyk Studio Capabilities Power the AI Security Fabric art-634
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
crit CISA KEV: CVE-2025-15556 — Notepad++ Download of Code Without Integrity Check Vulnerability art-651
crit CISA KEV: CVE-2025-40536 — SolarWinds Web Help Desk Security Control Bypass Vulnerability art-652
crit CISA KEV: CVE-2026-21510 — Microsoft Windows Shell Protection Mechanism Failure Vulnerability art-667
crit CISA KEV: CVE-2026-21533 — Microsoft Windows Improper Privilege Management Vulnerability art-668
crit CISA KEV: CVE-2025-11953 — React Native Community CLI OS Command Injection Vulnerability art-673
crit CISA KEV: CVE-2026-1281 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-686
crit CISA KEV: CVE-2024-37079 — Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability art-698
crit CISA KEV: CVE-2026-20045 — Cisco Unified Communications Products Code Injection Vulnerability art-705
crit CISA KEV: CVE-2025-20393 — Cisco Multiple Products Improper Input Validation Vulnerability art-731
med How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science art-745
crit CISA KEV: CVE-2025-66644 — Array Networks ArrayOS AG OS Command Injection Vulnerability art-749
crit CISA KEV: CVE-2025-55182 — Meta React Server Components Remote Code Execution Vulnerability art-750
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-753
crit CISA KEV: CVE-2025-6205 — Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability art-803
crit CISA KEV: CVE-2025-54236 — Adobe Commerce and Magento Improper Input Validation Vulnerability art-804
crit CISA KEV: CVE-2025-33073 — Microsoft Windows SMB Client Improper Access Control Vulnerability art-812
crit CISA KEV: CVE-2025-24990 — Microsoft Windows Untrusted Pointer Dereference Vulnerability art-820
crit CISA KEV: CVE-2010-3765 — Mozilla Multiple Products Remote Code Execution Vulnerability art-831
crit CISA KEV: CVE-2025-59689 — Libraesva Email Security Gateway Command Injection Vulnerability art-840
crit CISA KEV: CVE-2023-50224 — TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability art-860
crit CISA KEV: CVE-2025-55177 — Meta Platforms WhatsApp Incorrect Authorization Vulnerability art-863
crit CISA KEV: CVE-2024-8068 — Citrix Session Recording Improper Privilege Management Vulnerability art-868
crit CISA KEV: CVE-2025-43300 — Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability art-870
crit CISA KEV: CVE-2013-3893 — Microsoft Internet Explorer Resource Management Errors Vulnerability art-879
crit CISA KEV: CVE-2020-25078 — D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability art-885
crit CISA KEV: CVE-2020-25079 — D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability art-886
crit CISA KEV: CVE-2023-2533 — PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability art-891
crit CISA KEV: CVE-2025-6558 — Google Chromium ANGLE and GPU Improper Input Validation Vulnerability art-897
crit CISA KEV: CVE-2025-53770 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-902
crit CISA KEV: CVE-2025-5777 — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability art-905
crit CISA KEV: CVE-2014-3931 — Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability art-909
crit CISA KEV: CVE-2025-6543 — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability art-915
med Understanding CRA Compliance: Overcoming Challenges with an Integrated Security Testing Approach art-916
crit CISA KEV: CVE-2024-54085 — AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability art-919
crit CISA KEV: CVE-2025-24016 — Wazuh Server Deserialization of Untrusted Data Vulnerability art-932
crit CISA KEV: CVE-2025-5419 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability art-937
crit CISA KEV: CVE-2025-21479 — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability art-940
crit CISA KEV: CVE-2025-21480 — Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability art-941
crit CISA KEV: CVE-2025-3935 — ConnectWise ScreenConnect Improper Authentication Vulnerability art-945
crit CISA KEV: CVE-2024-11182 — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability art-960
crit CISA KEV: CVE-2025-4428 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-961
crit CISA KEV: CVE-2025-32756 — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability art-965
crit CISA KEV: CVE-2025-30397 — Microsoft Windows Scripting Engine Type Confusion Vulnerability art-967
crit CISA KEV: CVE-2025-30400 — Microsoft Windows DWM Core Library Use-After-Free Vulnerability art-970
crit CISA KEV: CVE-2024-58136 — Yiiframework Yii Improper Protection of Alternate Path Vulnerability art-980
crit CISA KEV: CVE-2024-38475 — Apache HTTP Server Improper Escaping of Output Vulnerability art-982
crit CISA KEV: CVE-2023-44221 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-983
crit CISA KEV: CVE-2025-42599 — Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability art-987
crit CISA KEV: CVE-2025-24054 — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability art-990
crit CISA KEV: CVE-2025-31201 — Apple Multiple Products Arbitrary Read and Write Vulnerability art-991
crit CISA KEV: CVE-2021-20035 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-994
crit CISA KEV: CVE-2024-20439 — Cisco Smart Licensing Utility Static Credential Vulnerability art-1005
crit CISA KEV: CVE-2024-48248 — NAKIVO Backup and Replication Absolute Path Traversal Vulnerability art-1014
crit CISA KEV: CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1019
crit CISA KEV: CVE-2025-24201 — Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability art-1024
crit CISA KEV: CVE-2025-24993 — Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability art-1029
crit CISA KEV: CVE-2025-24984 — Microsoft Windows NTFS Information Disclosure Vulnerability art-1032
crit CISA KEV: CVE-2024-13161 — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability art-1035
crit CISA KEV: CVE-2024-13160 — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability art-1036
crit CISA KEV: CVE-2024-13159 — Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability art-1037
crit CISA KEV: CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability art-1045
crit CISA KEV: CVE-2022-43939 — Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability art-1050
crit CISA KEV: CVE-2024-49035 — Microsoft Partner Center Improper Access Control Vulnerability art-1057
crit CISA KEV: CVE-2025-24989 — Microsoft Power Pages Improper Access Control Vulnerability art-1060
crit CISA KEV: CVE-2025-0108 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability art-1064
crit CISA KEV: CVE-2024-53704 — SonicWall SonicOS SSLVPN Improper Authentication Vulnerability art-1065
med Creating SBOMs with the Snyk CLI art-1081
crit CISA KEV: CVE-2018-19410 — Paessler PRTG Network Monitor Local File Inclusion Vulnerability art-1084
crit CISA KEV: CVE-2018-9276 — Paessler PRTG Network Monitor OS Command Injection Vulnerability art-1085
crit CISA KEV: CVE-2024-29059 — Microsoft .NET Framework Information Disclosure Vulnerability art-1086
crit CISA KEV: CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1102
crit CISA KEV: CVE-2024-3393 — Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability art-1112
crit CISA KEV: CVE-2021-44207 — Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability art-1114
crit CISA KEV: CVE-2021-40407 — Reolink RLC-410W IP Camera OS Command Injection Vulnerability art-1117
crit CISA KEV: CVE-2019-11001 — Reolink Multiple IP Cameras OS Command Injection Vulnerability art-1118
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1121
crit CISA KEV: CVE-2024-50623 — Cleo Multiple Products Unrestricted File Upload Vulnerability art-1124
med Snyk-Generated SBOMs Now Include License Details for the Open Source Libraries in Your Projects art-1129
crit CISA KEV: CVE-2024-44309 — Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability art-1142
crit CISA KEV: CVE-2024-38812 — VMware vCenter Server Heap-Based Buffer Overflow Vulnerability art-1145
crit CISA KEV: CVE-2024-9463 — Palo Alto Networks Expedition OS Command Injection Vulnerability art-1153
crit CISA KEV: CVE-2021-26086 — Atlassian Jira Server and Data Center Path Traversal Vulnerability art-1157
crit CISA KEV: CVE-2024-43451 — Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability art-1160
crit CISA KEV: CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability art-1161
crit CISA KEV: CVE-2024-5910 — Palo Alto Networks Expedition Missing Authentication Vulnerability art-1165
crit CISA KEV: CVE-2024-8956 — PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability art-1166
crit CISA KEV: CVE-2024-28987 — SolarWinds Web Help Desk Hardcoded Credential Vulnerability art-1185
crit CISA KEV: CVE-2024-30088 — Microsoft Windows Kernel TOCTOU Race Condition Vulnerability art-1187
crit CISA KEV: CVE-2024-9379 — Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability art-1192
crit CISA KEV: CVE-2019-0344 — SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability art-1204
crit CISA KEV: CVE-2020-15415 — DrayTek Multiple Vigor Routers OS Command Injection Vulnerability art-1205
crit CISA KEV: CVE-2024-7593 — Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability art-1211
crit CISA KEV: CVE-2024-8963 — Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability art-1213
crit CISA KEV: CVE-2022-21445 — Oracle ADF Faces Deserialization of Untrusted Data Vulnerability art-1216
crit CISA KEV: CVE-2024-27348 — Apache HugeGraph-Server Improper Access Control Vulnerability art-1218
crit CISA KEV: CVE-2013-0643 — Adobe Flash Player Incorrect Default Permissions Vulnerability art-1222
crit CISA KEV: CVE-2024-8190 — Ivanti Cloud Services Appliance OS Command Injection Vulnerability art-1227
crit CISA KEV: CVE-2024-38226 — Microsoft Publisher Protection Mechanism Failure Vulnerability art-1230
crit CISA KEV: CVE-2024-7965 — Google Chromium V8 Inappropriate Implementation Vulnerability art-1242
med A developer’s best friend: Lessons learned from our canine companions about AI code security art-1246
crit CISA KEV: CVE-2021-31196 — Microsoft Exchange Server Information Disclosure Vulnerability art-1250
crit CISA KEV: CVE-2024-23897 — Jenkins Command Line Interface (CLI) Path Traversal Vulnerability art-1254
crit CISA KEV: CVE-2024-38106 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-1261
crit CISA KEV: CVE-2024-38213 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1263
crit CISA KEV: CVE-2024-38178 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability art-1264
crit CISA KEV: CVE-2024-5217 — ServiceNow Incomplete List of Disallowed Inputs Vulnerability art-1277
crit CISA KEV: CVE-2024-38080 — Microsoft Windows Hyper-V Privilege Escalation Vulnerability art-1292
crit CISA KEV: CVE-2024-30051 — Microsoft DWM Core Library Privilege Escalation Vulnerability art-1338
crit CISA KEV: CVE-2024-29988 — Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability art-1349
crit CISA KEV: CVE-2022-38028 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-1356
crit The XZ backdoor CVE-2024-3094 art-1369
crit CISA KEV: CVE-2019-7256 — Nice Linear eMerge E3-Series OS Command Injection Vulnerability art-1373
med Snyk's AppSec dream team art-1377
med AppSec Maturity Models art-1380
high Defense in Depth art-1391
crit CISA KEV: CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass Vulnerability art-1396
crit CISA KEV: CVE-2024-21410 — Microsoft Exchange Server Privilege Escalation Vulnerability art-1401
crit CISA KEV: CVE-2024-21351 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1406
crit CISA KEV: CVE-2024-23222 — Apple Multiple Products WebKit Type Confusion Vulnerability art-1418
crit CISA KEV: CVE-2024-0519 — Google Chromium V8 Out-of-Bounds Memory Access Vulnerability art-1424
crit CISA KEV: CVE-2023-29357 — Microsoft SharePoint Server Privilege Escalation Vulnerability art-1430
crit CISA KEV: CVE-2023-29300 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1437
crit CISA KEV: CVE-2023-38203 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1438
crit CISA KEV: CVE-2023-6448 — Unitronics Vision PLC and HMI Insecure Default Password Vulnerability art-1458
crit CISA KEV: CVE-2023-42917 — Apple Multiple Products WebKit Memory Corruption Vulnerability art-1470
crit CISA KEV: CVE-2023-42916 — Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability art-1471
crit Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools art-1483
med File encryption in Python: An in-depth exploration of symmetric and asymmetric techniques art-1484
high Snyk Apps now GA: An easy, standardized, and secure framework for building custom integrations art-1488
crit CISA KEV: CVE-2023-36025 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1496
crit CISA KEV: CVE-2023-29552 — Service Location Protocol (SLP) Denial-of-Service Vulnerability art-1509
crit CISA KEV: CVE-2023-46604 — Apache ActiveMQ Deserialization of Untrusted Data Vulnerability art-1516
high Dependency injection in Python art-1517
crit CISA KEV: CVE-2023-46748 — F5 BIG-IP Configuration Utility SQL Injection Vulnerability art-1518
crit CISA KEV: CVE-2023-5631 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability art-1521
crit Weak Hash vulnerability discovered in crypto-js and crypto-es (CVE-2023-46233 & CVE-2023-46133) art-1522
crit CISA KEV: CVE-2023-41763 — Microsoft Skype for Business Privilege Escalation Vulnerability art-1541
crit CISA KEV: CVE-2023-42824 — Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability art-1548
crit CISA KEV: CVE-2023-41992 — Apple Multiple Products Kernel Privilege Escalation Vulnerability art-1563
crit CISA KEV: CVE-2023-41993 — Apple Multiple Products WebKit Code Execution Vulnerability art-1564
crit CISA KEV: CVE-2023-4863 — Google Chromium WebP Heap-Based Buffer Overflow Vulnerability art-1581
crit CISA KEV: CVE-2023-36802 — Microsoft Streaming Service Proxy Privilege Escalation Vulnerability art-1584
crit CISA KEV: CVE-2023-41064 — Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability art-1586
crit CISA KEV: CVE-2023-26359 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1605
med Implementing TLS in Kubernetes art-1623
crit CISA KEV: CVE-2023-35081 — Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability art-1624
crit CISA KEV: CVE-2023-35078 — Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability art-1630
crit CISA KEV: CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability art-1641
crit CISA KEV: CVE-2023-37450 — Apple Multiple Products WebKit Code Execution Vulnerability art-1644
crit CISA KEV: CVE-2023-32046 — Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability art-1647
crit CISA KEV: CVE-2022-31199 — Netwrix Auditor Insecure Object Deserialization Vulnerability art-1651
crit CISA KEV: CVE-2019-20500 — D-Link DWL-2600AP Access Point Command Injection Vulnerability art-1656
crit CISA KEV: CVE-2021-25489 — Samsung Mobile Devices Improper Input Validation Vulnerability art-1658
crit CISA KEV: CVE-2021-25372 — Samsung Mobile Devices Improper Boundary Check Vulnerability art-1662
crit CISA KEV: CVE-2023-32435 — Apple Multiple Products WebKit Memory Corruption Vulnerability art-1668
crit CISA KEV: CVE-2023-32439 — Apple Multiple Products WebKit Type Confusion Vulnerability art-1669
crit CISA KEV: CVE-2023-20887 — Vmware Aria Operations for Networks Command Injection Vulnerability art-1674
high Ethical hacking techniques art-1698
high Ethical Hacking: Top Tools art-1702
crit CISA KEV: CVE-2023-28771 — Zyxel Multiple Firewalls OS Command Injection Vulnerability art-1704
crit CISA KEV: CVE-2023-32409 — Apple Multiple Products WebKit Sandbox Escape Vulnerability art-1714
crit CISA KEV: CVE-2023-28204 — Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability art-1715
crit CISA KEV: CVE-2023-32373 — Apple Multiple Products WebKit Use-After-Free Vulnerability art-1716
crit CISA KEV: CVE-2023-25717 — Multiple Ruckus Wireless Products CSRF and RCE Vulnerability art-1727
crit CISA KEV: CVE-2015-5317 — Jenkins User Interface (UI) Information Disclosure Vulnerability art-1731
crit CISA KEV: CVE-2021-45046 — Apache Log4j2 Deserialization of Untrusted Data Vulnerability art-1747
crit Lessons from OpenSSL vulnerabilities part 2: Finding and fixing supply chain vulnerabilities art-1749
crit API Security Guide art-1751
med New IaC security workshop from Snyk, HashiCorp, and AWS at KubeCon Europe 2023 and on-demand art-1772
crit CISA KEV: CVE-2023-28205 — Apple Multiple Products WebKit Use-After-Free Vulnerability art-1773
crit CISA KEV: CVE-2021-27877 — Veritas Backup Exec Agent Improper Authentication Vulnerability art-1776
crit CISA KEV: CVE-2023-26083 — Arm Mali GPU Kernel Driver Information Disclosure Vulnerability art-1779
crit CISA KEV: CVE-2021-30900 — Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability art-1796
crit CISA KEV: CVE-2022-3038 — Google Chromium Network Service Use-After-Free Vulnerability art-1799
high Securing the web (forward) art-1803
crit CISA KEV: CVE-2023-26360 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1810
crit CISA KEV: CVE-2023-23397 — Microsoft Office Outlook Privilege Escalation Vulnerability art-1811
crit CISA KEV: CVE-2023-24880 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1812
high Preventing XSS in Django art-1814
high Cybersecurity Hygiene 101 art-1824
med When software isn’t a “supply” art-1841
crit CISA KEV: CVE-2023-21715 — Microsoft Office Publisher Security Feature Bypass Vulnerability art-1842
crit CISA KEV: CVE-2023-23529 — Apple Multiple Products WebKit Type Confusion Vulnerability art-1844
crit CISA KEV: CVE-2023-22952 — Multiple SugarCRM Products Remote Code Execution Vulnerability art-1855
med Adding security to Nuxt 3 art-1858
med Snyk's AppSec journey in 2022 art-1868
crit CISA KEV: CVE-2022-41080 — Microsoft Exchange Server Privilege Escalation Vulnerability art-1869
med You should be using HTTP Strict Transport Security (HSTS) headers in your Node.js server art-1874
crit CISA KEV: CVE-2018-5430 — TIBCO JasperReports Server Information Disclosure Vulnerability art-1875
crit CISA KEV: CVE-2018-18809 — TIBCO JasperReports Library Directory Traversal Vulnerability art-1876
crit CISA KEV: CVE-2022-44698 — Microsoft Defender SmartScreen Security Feature Bypass Vulnerability art-1890
crit CISA KEV: CVE-2022-26500 — Veeam Backup & Replication Remote Code Execution Vulnerability art-1892
crit CISA KEV: CVE-2022-26501 — Veeam Backup & Replication Remote Code Execution Vulnerability art-1893
crit CISA KEV: CVE-2022-41073 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-1931
crit CISA KEV: CVE-2021-25337 — Samsung Mobile Devices Improper Access Control Vulnerability art-1934
crit Secure Python URL validation art-1937
crit CISA KEV: CVE-2018-19323 — GIGABYTE Multiple Products Privilege Escalation Vulnerability art-1956
crit CISA KEV: CVE-2018-19321 — GIGABYTE Multiple Products Privilege Escalation Vulnerability art-1958
high SREs bring ORDER(R) to CHAOS art-1965
crit Reviewing CVE-2022-42889: The arbitrary code execution vulnerability in Apache Commons Text art-1966
crit CISA KEV: CVE-2022-40684 — Fortinet Multiple Products Authentication Bypass Vulnerability art-1978
crit CISA KEV: CVE-2022-41082 — Microsoft Exchange Server Remote Code Execution Vulnerability art-1991
crit CISA KEV: CVE-2022-32917 — Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability art-2014
med How Onna Technologies uses Snyk & Sysdig to secure the SDLC while saving time and money art-2016
crit CISA KEV: CVE-2022-3075 — Google Chromium Mojo Insufficient Data Validation Vulnerability art-2019
crit CISA KEV: CVE-2022-27593 — QNAP Photo Station Externally Controlled Reference Vulnerability art-2020
crit CISA KEV: CVE-2018-13374 — Fortinet FortiOS and FortiADC Improper Access Control Vulnerability art-2026
crit CISA KEV: CVE-2011-4723 — D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability art-2028
high Building a secure API with gRPC art-2043
crit CISA KEV: CVE-2021-38406 — Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability art-2050
crit CISA KEV: CVE-2020-28949 — PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability art-2053
high The dangers of assert in Python art-2062
crit CISA KEV: CVE-2022-2856 — Google Chromium Intents Insufficient Input Validation Vulnerability art-2066
crit CISA KEV: CVE-2022-21971 — Microsoft Windows Runtime Remote Code Execution Vulnerability art-2068
crit CISA KEV: CVE-2017-15944 — Palo Alto Networks PAN-OS Remote Code Execution Vulnerability art-2069
high Securing PHP containers art-2082
crit CISA KEV: CVE-2011-2462 — Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability art-2150
crit CISA KEV: CVE-2010-2883 — Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability art-2152
crit CISA KEV: CVE-2009-1862 — Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability art-2157
crit CISA KEV: CVE-2016-7256 — Microsoft Windows Open Type Font Remote Code Execution Vulnerability art-2171
crit CISA KEV: CVE-2016-0034 — Microsoft Silverlight Runtime Remote Code Execution Vulnerability art-2174
crit CISA KEV: CVE-2015-0016 — Microsoft Windows TS WebProxy Directory Traversal Vulnerability art-2176
crit CISA KEV: CVE-2015-1769 — Microsoft Windows Mount Manager Privilege Escalation Vulnerability art-2180
crit CISA KEV: CVE-2014-4123 — Microsoft Internet Explorer Privilege Escalation Vulnerability art-2187
crit CISA KEV: CVE-2014-2817 — Microsoft Internet Explorer Privilege Escalation Vulnerability art-2189
crit CISA KEV: CVE-2013-7331 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2192
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2203
crit CISA KEV: CVE-2017-0147 — Microsoft Windows SMBv1 Information Disclosure Vulnerability art-2208
crit CISA KEV: CVE-2017-0022 — Microsoft XML Core Services Information Disclosure Vulnerability art-2209
crit CISA KEV: CVE-2017-0210 — Microsoft Internet Explorer Privilege Escalation Vulnerability art-2212
crit CISA KEV: CVE-2017-8543 — Microsoft Windows Search Remote Code Execution Vulnerability art-2214
crit CISA KEV: CVE-2016-0162 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2216
crit CISA KEV: CVE-2019-0676 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2232
crit CISA KEV: CVE-2019-11707 — Mozilla Firefox and Thunderbird Type Confusion Vulnerability art-2237
crit CISA KEV: CVE-2019-11708 — Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability art-2238
crit CISA KEV: CVE-2018-5002 — Adobe Flash Player Stack-based Buffer Overflow Vulnerability art-2243
med Cloud security challenges art-2247
crit CISA KEV: CVE-2022-30525 — Zyxel Multiple Firewalls OS Command Injection Vulnerability art-2250
crit CISA KEV: CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability art-2282
crit CISA KEV: CVE-2019-1003029 — Jenkins Script Security Plugin Sandbox Bypass Vulnerability art-2288
crit CISA KEV: CVE-2022-22718 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-2296
crit CISA KEV: CVE-2022-22960 — VMware Multiple Products Privilege Escalation Vulnerability art-2298
crit CISA KEV: CVE-2018-7841 — Schneider Electric U.motion Builder SQL Injection Vulnerability art-2302
crit CISA KEV: CVE-2016-4523 — Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability art-2303
crit CISA KEV: CVE-2014-0780 — InduSoft Web Studio NTWebServer Directory Traversal Vulnerability art-2304
crit CISA KEV: CVE-2007-3010 — Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability art-2306
crit CISA KEV: CVE-2022-24521 — Microsoft Windows CLFS Driver Privilege Escalation Vulnerability art-2309
crit CISA KEV: CVE-2014-9163 — Adobe Flash Player Stack-Based Buffer Overflow Vulnerability art-2318
crit CISA KEV: CVE-2022-23176 — WatchGuard Firebox and XTM Privilege Escalation Vulnerability art-2320
crit CISA KEV: CVE-2021-27852 — Checkbox Survey Deserialization of Untrusted Data Vulnerability art-2324
crit CISA KEV: CVE-2020-2509 — QNAP Network-Attached Storage (NAS) Command Injection Vulnerability art-2326
crit CISA KEV: CVE-2017-11317 — Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability art-2327
crit CISA KEV: CVE-2021-31166 — Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability art-2332
crit CISA KEV: CVE-2022-22965 — Spring Framework JDK 9+ Remote Code Execution Vulnerability art-2337
crit CISA KEV: CVE-2021-45382 — D-Link Multiple Routers Remote Code Execution Vulnerability art-2340
crit CISA KEV: CVE-2022-26871 — Trend Micro Apex Central Arbitrary File Upload Vulnerability art-2346
crit CISA KEV: CVE-2021-21551 — Dell dbutil Driver Insufficient Access Control Vulnerability art-2350
crit CISA KEV: CVE-2022-0543 — Debian-specific Redis Server Lua Sandbox Escape Vulnerability art-2356
crit CISA KEV: CVE-2021-34486 — Microsoft Windows Event Tracing Privilege Escalation Vulnerability art-2358
crit CISA KEV: CVE-2021-20028 — SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability art-2360
crit CISA KEV: CVE-2018-8406 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability art-2363
crit CISA KEV: CVE-2018-8405 — Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability art-2364
crit CISA KEV: CVE-2017-0059 — Microsoft Internet Explorer Information Disclosure Vulnerability art-2366
crit CISA KEV: CVE-2017-0037 — Microsoft Edge and Internet Explorer Type Confusion Vulnerability art-2367
crit CISA KEV: CVE-2016-0151 — Microsoft Windows CSRSS Security Feature Bypass Vulnerability art-2371
crit CISA KEV: CVE-2013-2729 — Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability art-2377
crit CISA KEV: CVE-2013-1690 — Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability art-2380
crit CISA KEV: CVE-2010-4398 — Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability art-2386
crit CISA KEV: CVE-2022-26318 — WatchGuard Firebox and XTM Appliances Arbitrary Code Execution art-2387
crit CISA KEV: CVE-2022-26143 — MiCollab, MiVoice Business Express Access Control Vulnerability art-2388
crit CISA KEV: CVE-2022-21999 — Microsoft Windows Print Spooler Privilege Escalation Vulnerability art-2389
crit CISA KEV: CVE-2020-9054 — Zyxel Multiple NAS Devices OS Command Injection Vulnerability art-2393
crit CISA KEV: CVE-2020-5410 — VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability art-2395
crit CISA KEV: CVE-2020-2021 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability art-2398
crit CISA KEV: CVE-2019-12991 — Citrix SD-WAN and NetScaler Command Injection Vulnerability art-2405
crit CISA KEV: CVE-2019-11043 — PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability art-2407
crit CISA KEV: CVE-2019-10068 — Kentico Xperience Deserialization of Untrusted Data Vulnerability art-2408
crit CISA KEV: CVE-2019-1003030 — Jenkins Matrix Project Plugin Remote Code Execution Vulnerability art-2409
crit CISA KEV: CVE-2018-6961 — VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability art-2413
crit CISA KEV: CVE-2018-1273 — VMware Tanzu Spring Data Commons Property Binder Vulnerability art-2415
crit CISA KEV: CVE-2018-0147 — Cisco Secure Access Control System Java Deserialization Vulnerability art-2417
crit CISA KEV: CVE-2017-6316 — Citrix Multiple Products Remote Code Execution Vulnerability art-2420
crit CISA KEV: CVE-2017-12615 — Apache Tomcat on Windows Remote Code Execution Vulnerability art-2423
crit CISA KEV: CVE-2016-1555 — NETGEAR Multiple WAP Devices Command Injection Vulnerability art-2427
crit CISA KEV: CVE-2015-3035 — TP-Link Multiple Archer Devices Directory Traversal Vulnerability art-2432
crit CISA KEV: CVE-2014-6287 — Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability art-2438
crit CISA KEV: CVE-2005-2773 — HP OpenView Network Node Manager Remote Code Execution Vulnerability art-2452
crit CISA KEV: CVE-2016-6277 — NETGEAR Multiple Routers Remote Code Execution Vulnerability art-2491
crit CISA KEV: CVE-2021-41379 — Microsoft Windows Installer Privilege Escalation Vulnerability art-2504
crit CISA KEV: CVE-2019-1652 — Cisco Small Business Routers Improper Input Validation Vulnerability art-2508
crit CISA KEV: CVE-2018-8581 — Microsoft Exchange Server Privilege Escalation Vulnerability art-2510
crit CISA KEV: CVE-2018-0175 — Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability art-2514
crit CISA KEV: CVE-2018-0173 — Cisco IOS and IOS XE Software Improper Input Validation Vulnerability art-2516
crit CISA KEV: CVE-2018-0172 — Cisco IOS and IOS XE Software Improper Input Validation Vulnerability art-2517
crit CISA KEV: CVE-2018-0167 — Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability art-2518
crit CISA KEV: CVE-2016-8562 — Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability art-2549
crit CISA KEV: CVE-2015-2387 — Microsoft ATM Font Driver Privilege Escalation Vulnerability art-2564
crit CISA KEV: CVE-2013-1347 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2573
crit CISA KEV: CVE-2012-1856 — Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability art-2578
crit CISA KEV: CVE-2010-0188 — Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability art-2587
crit CISA KEV: CVE-2009-3129 — Microsoft Excel Featheader Record Memory Corruption Vulnerability art-2588
crit CISA KEV: CVE-2008-3431 — Oracle VirtualBox Insufficient Input Validation Vulnerability art-2590
crit CISA KEV: CVE-2017-0222 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2601
crit CISA KEV: CVE-2018-8174 — Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability art-2619
crit CISA KEV: CVE-2013-3906 — Microsoft Graphics Component Memory Corruption Vulnerability art-2624
crit CISA KEV: CVE-2022-22620 — Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability art-2626
crit CISA KEV: CVE-2021-36934 — Microsoft Windows SAM Local Privilege Escalation Vulnerability art-2630
crit CISA KEV: CVE-2017-8464 — Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability art-2634
crit CISA KEV: CVE-2020-5722 — Grandstream Networks UCM6200 Series SQL Injection Vulnerability art-2657
crit CISA KEV: CVE-2014-6271 — GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability art-2661
crit CISA KEV: CVE-2020-14864 — Oracle Business Intelligence Enterprise Edition Path Transversal art-2683
crit CISA KEV: CVE-2019-1579 — Palo Alto Networks PAN-OS Remote Code Execution Vulnerability art-2703
crit CISA KEV: CVE-2021-27860 — FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit art-2708
med Checking Terraform IaC security in CI/CD with Regula and Bitbucket Pipelines [Tutorial] art-2715
high New Log4j 2.17.1 fixes CVE-2021-44832 remote code execution (but it’s not as bad as it sounds) art-2716
crit CISA KEV: CVE-2017-12149 — Red Hat JBoss Application Server Remote Code Execution Vulnerability art-2744
crit CISA KEV: CVE-2010-1871 — Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability art-2745
crit CISA KEV: CVE-2020-11261 — Qualcomm Multiple Chipsets Improper Input Validation Vulnerability art-2753
crit CISA KEV: CVE-2021-37415 — Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability art-2755
crit CISA KEV: CVE-2021-40449 — Microsoft Windows Win32k Privilege Escalation Vulnerability art-2764
crit CISA KEV: CVE-2021-42321 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2765
crit CISA KEV: CVE-2021-27103 — Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability art-2783
crit CISA KEV: CVE-2021-21017 — Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability art-2784
crit CISA KEV: CVE-2018-4939 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-2786
crit CISA KEV: CVE-2020-5735 — Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability art-2789
crit CISA KEV: CVE-2017-9805 — Apache Struts Deserialization of Untrusted Data Vulnerability art-2791
crit CISA KEV: CVE-2020-27950 — Apple Multiple Products Memory Initialization Vulnerability art-2804
crit CISA KEV: CVE-2020-9818 — Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability art-2806
crit CISA KEV: CVE-2020-9819 — Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability art-2807
crit CISA KEV: CVE-2021-30661 — Apple Multiple Products WebKit Storage Use-After-Free Vulnerability art-2813
crit CISA KEV: CVE-2021-30665 — Apple Multiple Products WebKit Memory Corruption Vulnerability art-2817
crit CISA KEV: CVE-2021-30663 — Apple Multiple Products WebKit Integer Overflow Vulnerability art-2818
crit CISA KEV: CVE-2021-28664 — Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability art-2824
crit CISA KEV: CVE-2021-28663 — Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability art-2825
crit CISA KEV: CVE-2021-1498 — Cisco HyperFlex HX Data Platform Command Injection Vulnerability art-2834
crit CISA KEV: CVE-2020-3118 — Cisco IOS XR Software Discovery Protocol Format String Vulnerability art-2836
crit CISA KEV: CVE-2018-15811 — DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability art-2850
crit CISA KEV: CVE-2019-15752 — Docker Desktop Community Edition Privilege Escalation Vulnerability art-2852
crit CISA KEV: CVE-2020-8515 — Multiple DrayTek Vigor Routers Web Management Page Vulnerability art-2853
crit CISA KEV: CVE-2020-12812 — Fortinet FortiOS SSL VPN Improper Authentication Vulnerability art-2863
crit CISA KEV: CVE-2020-16010 — Google Chrome for Android UI Heap Buffer Overflow Vulnerability art-2865
crit CISA KEV: CVE-2021-30633 — Google Chromium Indexed DB API Use-After-Free Vulnerability art-2872
crit CISA KEV: CVE-2021-38000 — Google Chromium Intents Improper Input Validation Vulnerability art-2880
crit CISA KEV: CVE-2016-3718 — ImageMagick Server-Side Request Forgery (SSRF) Vulnerability art-2891
crit CISA KEV: CVE-2020-7961 — Liferay Portal Deserialization of Untrusted Data Vulnerability art-2894
crit CISA KEV: CVE-2021-22506 — Micro Focus Access Manager Information Leakage Vulnerability art-2896
crit CISA KEV: CVE-2020-0878 — Microsoft Edge and Internet Explorer Memory Corruption Vulnerability art-2901
crit CISA KEV: CVE-2021-31955 — Microsoft Windows Kernel Information Disclosure Vulnerability art-2902
crit CISA KEV: CVE-2016-0185 — Microsoft Windows Media Center Remote Code Execution Vulnerability art-2905
crit CISA KEV: CVE-2020-0683 — Microsoft Windows Installer Privilege Escalation Vulnerability art-2906
crit CISA KEV: CVE-2020-17087 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2907
crit CISA KEV: CVE-2021-33771 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2910
crit CISA KEV: CVE-2021-31979 — Microsoft Windows Kernel Privilege Escalation Vulnerability art-2913
crit CISA KEV: CVE-2020-17144 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2915
crit CISA KEV: CVE-2021-34523 — Microsoft Exchange Server Privilege Escalation Vulnerability art-2919
crit CISA KEV: CVE-2019-0708 — Microsoft Remote Desktop Services Remote Code Execution Vulnerability art-2926
crit CISA KEV: CVE-2021-34473 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2927
crit CISA KEV: CVE-2021-34527 — Microsoft Windows Print Spooler Remote Code Execution Vulnerability art-2930
crit CISA KEV: CVE-2021-31207 — Microsoft Exchange Server Security Feature Bypass Vulnerability art-2931
crit CISA KEV: CVE-2020-1040 — Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability art-2933
crit CISA KEV: CVE-2020-1350 — Microsoft Windows DNS Server Remote Code Execution Vulnerability art-2935
crit CISA KEV: CVE-2021-26411 — Microsoft Internet Explorer Memory Corruption Vulnerability art-2936
crit CISA KEV: CVE-2017-8759 — Microsoft .NET Framework Remote Code Execution Vulnerability art-2939
crit CISA KEV: CVE-2021-27085 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2947
crit CISA KEV: CVE-2017-0199 — Microsoft Office and WordPad Remote Code Execution Vulnerability art-2953
crit CISA KEV: CVE-2017-11774 — Microsoft Office Outlook Security Feature Bypass Vulnerability art-2956
crit CISA KEV: CVE-2021-26855 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2959
crit CISA KEV: CVE-2021-26858 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2960
crit CISA KEV: CVE-2021-27065 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2961
crit CISA KEV: CVE-2021-1675 — Microsoft Windows Print Spooler Remote Code Execution Vulnerability art-2963
crit CISA KEV: CVE-2021-34448 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability art-2964
crit CISA KEV: CVE-2020-0646 — Microsoft .NET Framework Remote Code Execution Vulnerability art-2967
crit CISA KEV: CVE-2021-26857 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2969
crit CISA KEV: CVE-2020-6819 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability art-2976
crit CISA KEV: CVE-2020-6820 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability art-2977
crit CISA KEV: CVE-2019-17026 — Mozilla Firefox And Thunderbird Type Confusion Vulnerability art-2978
crit CISA KEV: CVE-2020-2555 — Oracle Multiple Products Remote Code Execution Vulnerability art-2982
crit CISA KEV: CVE-2021-22900 — Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability art-2992
crit CISA KEV: CVE-2021-22899 — Ivanti Pulse Connect Secure Command Injection Vulnerability art-2995
crit CISA KEV: CVE-2019-11510 — Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability art-2996
crit CISA KEV: CVE-2019-16256 — SIMalliance Toolbox Browser Command Injection Vulnerability art-3012
crit CISA KEV: CVE-2016-3643 — SolarWinds Virtualization Manager Privilege Escalation Vulnerability art-3015
crit CISA KEV: CVE-2020-10199 — Sonatype Nexus Repository Remote Code Execution Vulnerability art-3016
crit CISA KEV: CVE-2021-20021 — SonicWall Email Security Improper Privilege Management Vulnerability art-3017
crit CISA KEV: CVE-2020-10181 — Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability art-3021
crit CISA KEV: CVE-2017-6327 — Symantec Messaging Gateway Remote Code Execution Vulnerability art-3022
crit CISA KEV: CVE-2020-10987 — Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability art-3026
crit CISA KEV: CVE-2018-14558 — Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability art-3027
crit CISA KEV: CVE-2020-8468 — Trend Micro Multiple Products Content Validation Escape Vulnerability art-3032
crit CISA KEV: CVE-2020-24557 — Trend Micro Multiple Products Improper Access Control Vulnerability art-3033
crit CISA KEV: CVE-2021-21985 — VMware vCenter Server Improper Input Validation Vulnerability art-3046
crit CISA KEV: CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability art-3048
crit CISA KEV: CVE-2020-11738 — WordPress Snap Creek Duplicator Plugin File Download Vulnerability art-3049
crit CISA KEV: CVE-2020-10189 — Zoho ManageEngine Desktop Central File Upload Vulnerability art-3053
crit CISA KEV: CVE-2019-8394 — Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability art-3054
crit CISA KEV: CVE-2020-29583 — Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability art-3055
high Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach art-3066
high Detect and prevent dependency confusion attacks on npm to maintain supply chain security art-3088
high Developer driven workflows: Dockerfile image scanning, prioritization, and remediation art-3190
med Python Poetry package manager and security integration with software composition analysis tool art-3260
high Node.js security: lessons from the Node.js Security Working Group in triaging vulnerabilities art-3267
high New Gartner Market Guide highlights the importance of Software Composition Analysis (SCA) art-3309
crit Breaking out of message brokers art-3322
high After three years of silence, a new jQuery prototype pollution vulnerability emerges once again art-3541
high Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem art-3545
high Snyking in - regular expression denial of service vulnerability exploit in the ms package art-3548
high Snyk - Your Next Career Move! art-3575
high 2018 Year in Review art-3577
crit XSS Attacks: The Next Wave art-3641
high Maven support is here! art-3647
med Launching serverless Snyk art-3666
high Yarn is Micro Secure art-3668
med Enriching bitHound with Snyk art-3676
high Exploiting Buffer art-3687
med Launching Snyk art-3692
high A CEO's guide to Emacs art-3693