#vulnerabilities

An authenticated tenant with basic namespace permissions can break out to the host control plane in...

We live in an era where terminology outpaces capability. Every few months, a new label emerges:...

Most supply-chain security checks the package: does it exist, is it new, is there a CVE against this...

CVE-2026-41264 turned a prompt to Flowise's CSV Agent into code execution on the server. What broke, why the 3.1.0 fix was not enough, and how to hunt for it.

An attacker with minimal write permissions in one ZITADEL organization can take over accounts in...

A memory overflow in Citrix NetScaler's SAML handler is being actively exploited as a zero-day. CISA...

Internet-Exposed RDP Is Still the Ransomware On-Ramp the Gunra Advisory Warns About The...

Nine vulnerabilities hit YesWiki on October 2, 2026. The lead flaw is CVE-2026-104457 (CVSS 8.6) —...

A single authenticated user with any role can execute arbitrary OS commands on every monitored...

Four WordPress plugins dropped CVSS 9.8 authentication bypass vulnerabilities on the same day. All...

A Ghost staff user with valid credentials can log into any other staff account using only the...

Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel &...