Aggregator

Canadian Tire 2025 data breach impacts 38 million users

Security Affairs
2 months ago
A data breach at Canadian Tire exposed personal data from over 38 million accounts, including contact details and encrypted passwords. More than 38 million accounts were affected by an October 2025 data breach at Canadian retail giant Canadian Tire (CTC). The incident marks one of the largest retail data breaches in Canada, raising concerns about […]
Pierluigi Paganini

ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket

The Hackers News
2 months ago
OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control. "Our vulnerability lives in the core system itself – no plugins, no marketplace, no user-installed extensions – just the bare OpenClaw gateway, running exactly as documented," Oasis
The Hacker News

CVE-2026-3395 | MaxSite CMS up to 109.1 MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection (EUVD-2026-9130)

VulDB Recent Entries
2 months ago
A vulnerability, which was classified as critical, was found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. This vulnerability is registered as CVE-2026-3395. It is possible to launch the attack remotely. Furthermore, an exploit is available. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
vuldb.com

CVE-2026-3394 | jarikomppa soloud up to 20200207 WAV File Parser soloud_wav.cpp SoLoud::Wav::loadwav memory corruption (Issue 401 / EUVD-2026-9129)

VulDB Recent Entries
2 months ago
A vulnerability, which was classified as problematic, has been found in jarikomppa soloud up to 20200207. This affects the function SoLoud::Wav::loadwav of the file src/audiosource/wav/soloud_wav.cpp of the component WAV File Parser. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2026-3394. The attack must be initiated from a local position. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.
vuldb.com

CVE-2026-3393 | jarikomppa soloud up to 20200207 Audio File soloud_wav.cpp SoLoud::Wav::loadflac heap-based overflow (Issue 401 / EUVD-2026-9128)

VulDB Recent Entries
2 months ago
A vulnerability classified as problematic was found in jarikomppa soloud up to 20200207. The impacted element is the function SoLoud::Wav::loadflac of the file src/audiosource/wav/soloud_wav.cpp of the component Audio File Handler. Such manipulation leads to heap-based buffer overflow. This vulnerability is listed as CVE-2026-3393. The attack must be carried out locally. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.
vuldb.com

MY TAKE: The Pentagon punished Anthropic for red lines it accepted from OpenAI hours later

Security Boulevard
2 months ago

KINGSTON, Wash. — On Friday afternoon, President Trump ordered every federal agency to stop using Anthropic’s AI technology. Defense Secretary Pete Hegseth followed by designating the company a “supply-chain risk to national security,” a label the government typically reserves for … (more…)

The post MY TAKE: The Pentagon punished Anthropic for red lines it accepted from OpenAI hours later first appeared on The Last Watchdog.

The post MY TAKE: The Pentagon punished Anthropic for red lines it accepted from OpenAI hours later appeared first on Security Boulevard.

bacohido

CVE-2026-3392 | FascinatedBox lily up to 2.3 src/lily_emitter.c eval_tree null pointer dereference (Issue 384 / EUVD-2026-9127)

VulDB Recent Entries
2 months ago
A vulnerability classified as problematic has been found in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-3392. The attack is restricted to local execution. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.
vuldb.com

CVE-2026-3391 | FascinatedBox lily up to 2.3 src/lily_emitter.c clear_storages out-of-bounds (Issue 383 / EUVD-2026-9126)

VulDB Recent Entries
2 months ago
A vulnerability described as problematic has been identified in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-3391. The attack is only possible with local access. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.
vuldb.com

CVE-2026-3390 | FascinatedBox lily up to 2.3 Error Reporting src/lily_build_error.c patch_line_end out-of-bounds (Issue 382 / EUVD-2026-9125)

VulDB Recent Entries
2 months ago
A vulnerability marked as problematic has been reported in FascinatedBox lily up to 2.3. This issue affects the function patch_line_end of the file src/lily_build_error.c of the component Error Reporting. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-3390. The attack can only be performed from a local environment. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.
vuldb.com

Managed ad