Aggregator

CVE-2026-31845 | Rukovoditel CRM up to 3.6/3.6.4 API Endpoint /api/tel/zadarma.php zd_echo cross site scripting (EUVD-2026-21682)

VulDB Recent Entries
2 weeks ago
A vulnerability, which was classified as problematic, has been found in Rukovoditel CRM up to 3.6/3.6.4. This issue affects some unknown processing of the file /api/tel/zadarma.php of the component API Endpoint. The manipulation of the argument zd_echo leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-31845. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.
vuldb.com

Virtual Patching: Guarding Against a Tsunami of AI-discovered Exploits with vDefend and Avi

VMWare Security Blog
2 weeks ago

As the digital landscape enters the age of Artificial Intelligence, the traditional methods of securing applications are being fundamentally challenged. The emergence of advanced AI models has shifted the advantage towards attackers. With AI, even a novice attacker is now weaponized into a sophisticated hacker while operating semi-autonomously at very low cost, and unprecedented scale. … Continued

The post Virtual Patching: Guarding Against a Tsunami of AI-discovered Exploits with vDefend and Avi appeared first on VMware Security Blog.

Umesh Mahajan

OpenAI Warns macOS Users to Update ChatGPT and Codex Immediately

Cyber Security News
2 weeks ago

OpenAI has disclosed a security incident tied to the compromise of Axios, a widely used third-party JavaScript developer library, as part of a broader software supply chain attack detected on March 31, 2026. While the company confirmed no user data, API keys, or systems were compromised, it is taking aggressive precautionary measures to protect its […]

The post OpenAI Warns macOS Users to Update ChatGPT and Codex Immediately appeared first on Cyber Security News.

Guru Baran

GlassWorm evolves with Zig dropper to infect multiple developer tools

Security Affairs
2 weeks ago
The GlassWorm campaign uses a Zig-based dropper hidden in a fake IDE extension to infect developer tools and compromise systems. The GlassWorm campaign, active since 2025, has evolved from malicious npm packages to large-scale supply chain attacks across GitHub, npm, and VS Code, even deploying RATs via fake browser extensions. In its latest iteration, threat […]
Pierluigi Paganini

Saturday Security: AI Could Trigger a Zero-Day Exploit Tsunami

Security Boulevard
2 weeks ago

For decades, zero-day vulnerabilities were the cyber equivalent of secret weapons — only nation-states and elite attackers could find and weaponize them. That balance may be gone. On April 7, 2026, Anthropic announced Claude Mythos Preview — an AI model so capable of finding and exploiting vulnerabilities that the company decided it’s too dangerous to […]

The post Saturday Security: AI Could Trigger a Zero-Day Exploit Tsunami appeared first on Security Boulevard.

psilva

CVE-2026-6124 | Tenda F451 1.0.0.7 httpd /goform/SafeMacFilter fromSafeMacFilter page/menufacturer stack-based overflow (EUVD-2026-21726)

VulDB Recent Entries
2 weeks ago
A vulnerability classified as critical was found in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. This vulnerability is handled as CVE-2026-6124. The attack can be executed remotely. Additionally, an exploit exists.
vuldb.com

CVE-2026-6123 | Tenda F451 1.0.0.7 httpd /goform/addressNat fromAddressNat entrys stack-based overflow (EUVD-2026-21724)

VulDB Recent Entries
2 weeks ago
A vulnerability classified as critical has been found in Tenda F451 1.0.0.7. This affects the function fromAddressNat of the file /goform/addressNat of the component httpd. Performing a manipulation of the argument entrys results in stack-based buffer overflow. This vulnerability is known as CVE-2026-6123. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
vuldb.com

CVE-2026-6122 | Tenda F451 1.0.0.7 httpd /goform/L7Prot frmL7ProtForm page stack-based overflow (EUVD-2026-21722)

VulDB Recent Entries
2 weeks ago
A vulnerability described as critical has been identified in Tenda F451 1.0.0.7. Affected by this issue is the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Such manipulation of the argument page leads to stack-based buffer overflow. This vulnerability is traded as CVE-2026-6122. The attack may be launched remotely. Furthermore, there is an exploit available.
vuldb.com

Managed ad