Aggregator

A vulnerability classified as problematic has been found in Newell Brands DYMO Connect Desktop up to 1.6.1. Impacted is the function LoadImageAsPngBase64 of the component Local Web Service. This manipulation of the argument file_path causes path traversal. This vulnerability appears as CVE-2026-76796. The attack requires local access. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in Tencent Mass Service Engine in Cluster (MSEC). The impacted element is an unknown function. Such manipulation leads to unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is listed as CVE-2026-89040. The attack may be performed from remote. There is no available exploit.

Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731."

Strengthen your readiness against Silent Ransom Group. As SRG increasingly uses IT impersonation and legitimate remote-access tools to target law firms, firms should review how they verify support interactions, protect sensitive client data and detect suspicious activity.

The post When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group appeared first on Sygnia.

Новый Claude стал дешевле и опаснее интереснее.

Submit #953395 / VDB-408568

Threat actors stole 170 private repositories using an OAuth token stolen from a former employee's computer through the TanStack npm supply chain attack.

Submit #953380 / VDB-397465

Submit #953379 / VDB-408556

Submit #953331 / VDB-408552

Submit #953330 / VDB-408551

Submit #953327 / VDB-408550

Submit #953309 / VDB-408549

Submit #953308 / VDB-408548

Submit #953306 / VDB-221796

Shadow IT can leave security teams unaware of unmanaged endpoints, unauthorized software, and other assets that fall outside existing monitoring. Wazuh explains how endpoint inventory, agentless monitoring, and centralized analysis can help organizations identify and reduce these visibility gaps. [...]

Submit #953304 / VDB-408547

Submit #953303 / VDB-408546

As more reports of misalignment incidents underscore AI risks, large AI labs, regular businesses, and even nations are searching for better ways to keep control and be secure.

Submit #953281 / VDB-408543