criticalVulnerabilityResolved
PickleScan Fails to Block Standard Library RCE Modules
PickleScan v1.0.3 fails to block multiple Python stdlib modules enabling RCE, allowing bypass of security scans.
picklescan
Intelligence · Updated daily
Security Intelligence
AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.
Page 31 of 37
751–775 of 906criticalVulnerabilityResolved
Authenticated Remote Code Execution via SSTI in Craft CMS
Craft CMS suffers from an authenticated RCE vulnerability due to SSTI in Twig templates, allowing attackers to write malicious scripts to web-accessible directories.
CVE-2026-28697
Craft CMS
criticalVulnerabilityResolved
ePower epower.ie Vulnerabilities Allow Critical Access and Disruption
Critical vulnerabilities in ePower's charging stations could allow attackers to gain administrative control or disrupt services, posing significant risks to electric vehicle infrastructure.
ePower
criticalVulnerabilityResolved
Labkotec LID-3300IP Missing Authentication Vulnerability
Labkotec LID-3300IP devices are vulnerable to unauthenticated access, allowing attackers to take control of critical system operations, posing significant risks to industrial safety.
Labkotec LID-3300IP
criticalVulnerabilityResolved
Hitachi Energy RTU500 Vulnerabilities Expose Critical Risks
Hitachi Energy's RTU500 product has critical vulnerabilities that could lead to device outages and exposure of user management information, posing significant risks to industrial control systems.
Hitachi Energy RTU500 Product
criticalVulnerabilityResolved
Critical Vulnerabilities in Mobiliti e-mobi.hu Charging Stations
Mobiliti e-mobi.hu charging stations are vulnerable to critical flaws allowing unauthorized administrative control and denial-of-service attacks, affecting all versions of the product.
Mobiliti e-mobi.hu
criticalVulnerabilityResolved
Windows ACPX Path Vulnerability: Cwd Injection in Wrapper Execution
A critical vulnerability in Windows ACPX path handling allows cwd injection via .cmd/.bat wrapper fallback, risking command execution. Immediate patching is advised.
CpenClaw/ACPX (Vendor/Product)
criticalVulnerabilityResolved
OpenClaw Gateway Agent File Symlink Traversal Vulnerability
The OpenClaw gateway agents.files.get and agents.files.set methods allowed symlink traversal, enabling arbitrary file read/write outside the workspace. This PoC highlights critical risks for defenders.
OpenClaw/gateway
criticalVulnerabilityResolved
OpenClaw Gateway Node Invoke Approval Bypass Vulnerability Analysis
An RCE vulnerability in OpenClaw's gateway allows authenticated clients to bypass node execution approvals by manipulating parameters, posing a significant risk to connected systems.
OpenClaw Gateway
highCampaignResolved
UK Warns of Escalating Iranian Cyber Threats Amid Regional Tensions
UK authorities warn of increased Iranian cyberattack risks targeting British organizations due to Middle East tensions.
highSupply ChainResolved
Fraudulent Microsoft COA Trafficking Exposes Supply Chain Risks
A Florida woman was sentenced to 22 months in prison for trafficking thousands of stolen Microsoft Certificate of Authenticity (COA) labels, highlighting vulnerabilities in software supply chain integrity.
Microsoft
criticalCampaignResolved
Cyberstalking and Extortion Ring Targets Hundreds of Women
A 22-year-old Alabama man has pleaded guilty to hacking, cyberstalking, and extorting hundreds of women by hijacking their social media accounts.
Social Media Platforms (Unknown specific vendor)
criticalCampaignResolved
Phishing Campaign Exploits Fake Google Security Page with PWA for Credential Theft
Attackers are using a fake Google Account security page to deliver a Progressive Web App (PWA) that steals credentials, MFA codes, and proxies traffic through victims' browsers. This campaign poses a significant risk due to its ability to bypass multi-factor authentication.
Google Users
criticalToolResolved
CyberStrikeAI Exploitation in Fortinet Breach Highlights AI-Driven Threats
Hackers have adopted CyberStrikeAI, an open-source AI security testing platform, to breach Fortinet FortiGate firewalls, demonstrating a significant shift in attack methodologies leveraging advanced AI tools.
Fortinet FortiGate
criticalVulnerabilityResolved
SQL Injection Vulnerability in itsourcecode School Management System
A critical SQL injection vulnerability exists in itsourcecode School Management System 1.0, allowing remote attackers to manipulate database queries. The PoC highlights the need for immediate defensive measures to prevent data exposure and system compromise.
CVE-2026-3261
itsourcecode/School-Management-System
criticalVulnerabilityResolved
ClawJacked Flaw in OpenClaw AI Gateway Allows Malicious Sites to Hijack Local AI Agents
A high-severity vulnerability in OpenClaw's core gateway allowed malicious websites to hijack locally running AI agents via WebSocket connections. The issue has been fixed, but highlights risks of unsecured AI systems.
OpenClaw AI Gateway
criticalVulnerabilityResolved
South Korea Tax Agency Exposes Crypto Wallet Seed Leading to $4.8M Theft
South Korea's National Tax Service exposed a cryptocurrency wallet seed in a press release, enabling hackers to steal $4.8 million worth of crypto.
South Korea National Tax Service
criticalMalwareResolved
Malicious Chrome Extension Compromises Users' Cryptocurrency
The QuickLens Chrome extension was removed after being compromised to push malware aimed at stealing cryptocurrency from users. The attack highlights vulnerabilities in third-party browser extensions and the risks of crypto-related phishing.
Chrome Web Store, QuickLens Chrome Extension
criticalVulnerabilityResolved
Langflow CSV Agent Misconfiguration Enables RCE
The Langflow CSV Agent hardcodes a flag that enables arbitrary code execution, posing a severe security risk.
CVE-2026-27966
Langflow
criticalVulnerabilityResolved
Arbitrary File Write via Backup Manifest in Vitess
Vitess backup restoration process allows attackers with backup storage access to write files to arbitrary paths, enabling unauthorized access and potential system compromise.
CVE-2026-27969
Vitess/vitess versions prior to v23.0.3 and v22.0.4
criticalVulnerabilityResolved
Password Reset Token Reuse Vulnerability in Vikunja
Vikunja's password reset mechanism allows token reuse due to improper token invalidation and cleanup, enabling persistent account takeovers.
CVE-2026-28268
Vikunja/api
highVulnerabilityResolved
Third-Party Software Risks and Patching Importance
Third-party software like PDF readers and email clients pose significant risks to organizations' security, with consistent patching being crucial to mitigate exploit exposure.
Organizations using third-party tools
highCampaignResolved
Europol Disrupts Child-Targeted Cybercrime Group The Com
Europol's Project Compass operation has led to the arrest of 30 individuals linked to The Com, a cybercrime group targeting children and teenagers. This coordinated international effort highlights the growing threat of child-targeted online exploitation.
criticalMalwareResolved
APT37 Exploits New Malware for Air-Gap Network Attacks
North Korean hackers, APT37, are using newly discovered malware to breach air-gapped networks by leveraging removable drives and conducting covert surveillance.
Organizations with air-gapped networks, particularly in critical sectors like defense, finance +1
mediumVulnerabilityResolved
Windows 11 Enhances Batch File Security to Mitigate Script-Based Attacks
Microsoft is improving the security of batch file and CMD script execution in Windows 11 Insider Preview builds, addressing a common attack vector for malicious scripts.
Windows 11