Aggregator

INC

Dark Feed IO
3 weeks 6 days ago

You must login to view this content

cohenido

CVE-2026-32135 | NanoMQ MQTT Broker up to 0.24.10 REST API uri_param_parse heap-based overflow (EUVD-2026-23939)

VulDB Recent Entries
3 weeks 6 days ago
A vulnerability marked as critical has been reported in NanoMQ MQTT Broker up to 0.24.10. This affects the function uri_param_parse of the component REST API. The manipulation leads to heap-based buffer overflow. This vulnerability is referenced as CVE-2026-32135. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-6060 | OTRS up to 2026.2.x SQL Box resource consumption (EUVD-2026-23933 / WID-SEC-2026-1176)

VulDB Recent Entries
3 weeks 6 days ago
A vulnerability labeled as problematic has been found in OTRS up to 2026.2.x. The impacted element is an unknown function of the component SQL Box. Executing a manipulation can lead to resource consumption. The identification of this vulnerability is CVE-2026-6060. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.
vuldb.com

CVE-2026-29645 | NEMU up to 2025.12.r1 RISC-V Vector Decoder funct3 denial of service (EUVD-2026-23937)

VulDB Recent Entries
3 weeks 6 days ago
A vulnerability identified as problematic has been detected in NEMU up to 2025.12.r1. The affected element is an unknown function of the component RISC-V Vector Decoder. Performing a manipulation of the argument funct3 results in denial of service. This vulnerability was named CVE-2026-29645. The attack needs to be approached within the local network. There is no available exploit. You should upgrade the affected component.
vuldb.com

CVE-2026-5478 | wpeverest Everest Forms Plugin up to 3.4.4 on WordPress unlink old_files path traversal (EUVD-2026-23941)

VulDB Recent Entries
3 weeks 6 days ago
A vulnerability categorized as critical has been discovered in wpeverest Everest Forms Plugin up to 3.4.4 on WordPress. Impacted is the function unlink. Such manipulation of the argument old_files leads to path traversal. This vulnerability is uniquely identified as CVE-2026-5478. The attack can be launched remotely. No exploit exists.
vuldb.com

CVE-2026-6550 | Amazon AWS Encryption SDK for Python up to 2.5.1/3.3.0/4.0.4 Caching Layer downgrade (EUVD-2026-23943)

VulDB Recent Entries
3 weeks 6 days ago
A vulnerability was found in Amazon AWS Encryption SDK for Python up to 2.5.1/3.3.0/4.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Caching Layer. The manipulation results in algorithm downgrade. This vulnerability is known as CVE-2026-6550. Attacking locally is a requirement. No exploit is available.
vuldb.com

CVE-2026-6248 | tomdever wpForo Forum Plugin up to 3.0.5 on WordPress Members::update path traversal (EUVD-2026-23935)

VulDB Recent Entries
3 weeks 6 days ago
A vulnerability was found in tomdever wpForo Forum Plugin up to 3.0.5 on WordPress. It has been classified as critical. This affects the function Members::update. The manipulation leads to path traversal. This vulnerability is traded as CVE-2026-6248. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.
vuldb.com

Vercel Traces Customer Data Theft to Agentic AI Tool Breach

BankInfoSecurity.com
3 weeks 6 days ago
Attacker First Compromised AI Tool Used by Vercel Employee, Platform Provider Finds
Cloud platform provider Vercel said an attacker breached its systems and stole customer data after compromising a third-party agentic artificial intelligence tool used by an employee, called Context.ai, and stealing from it credentials and OAuth tokens tied to multiple services and customers.

A Token Flaw Turned Azure's AI Agent Into a Spy

BankInfoSecurity.com
3 weeks 6 days ago
Outsiders Could Exploit Misconfig to Stream Commands, Credentials
A misconfiguration in Microsoft's Azure SRE Agent may have allowed any Azure account holder from any company to tap into another organization's agent conversations in real time, watching commands, outputs and credentials, leaving no trace.

AI Changes Focus to Real-Time Cyber Defense

BankInfoSecurity.com
3 weeks 6 days ago
Cisco's Jeetu Patel on How Machine-Speed Threats Drive Need for AI-Led Security
Cisco's Jeetu Patel explains how AI models are compressing exploit timelines to minutes, forcing a shift to machine-speed defense, real-time enforcement and deeper ecosystem collaboration to secure critical infrastructure and stay ahead of adversaries.

[un]prompted 2026 – Rob T. Lee, Glenn Thorpe, Dan Hubbard & Sergej Epp – Vibe Coded (Micro-Talks)

Security Boulevard
3 weeks 6 days ago

Author, Creator & Presenter: Rob T. Lee, Glenn Thorpe, Dan Hubbard & Sergej Epp

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations' YouTube Channel.

Permalink

The post [un]prompted 2026 – Rob T. Lee, Glenn Thorpe, Dan Hubbard & Sergej Epp – Vibe Coded (Micro-Talks) appeared first on Security Boulevard.

Marc Handelman

North Korea-Linked UNC1069 Uses Fake Zoom and Teams Meetings to Hack Crypto Professionals

Cyber Security News
3 weeks 6 days ago

A North Korean threat group known as UNC1069 has been running a sophisticated campaign that tricks cryptocurrency and Web3 professionals into joining fake online meetings, only to infect their computers with malware designed to steal digital assets. The group pretends to be venture capital firms looking for investment partnerships, building trust with targets over time […]

The post North Korea-Linked UNC1069 Uses Fake Zoom and Teams Meetings to Hack Crypto Professionals appeared first on Cyber Security News.

Tushar Subhra Dutta

Managed ad