Coverage
Vulnerabilities
1309 articles on vulnerability disclosures and exploits
Advertisement
CyberStrikeAI Exploitation: AI Tools Targeting Fortinet Firewalls
Threat actors are repurposing CyberStrikeAI to automate reconnaissance and exploit critical vulnerabilities in Fortinet FortiGate firewalls and edge devices.
CVE-2026-0628: Chrome Gemini Panel Exploit Enables Privilege Escalation
A high-severity flaw in Google Chrome's Gemini side panel allowed malicious extensions to bypass security policies and access local files on target systems.
Google Gemini Side Panel Bug Enables Session Hijacking — Update Now
Researchers discovered a security flaw in the Google Gemini side panel that allows for unauthorized session hijacking and cross-origin data exfiltration.
OpenClaw Hijacking Vulnerability: How Malicious Sites Control AI Agents
A critical vulnerability in the OpenClaw AI gateway allows malicious websites to hijack local AI agents via WebSocket connections and password brute-forcing.
Chrome Gemini Live Hijacking: Malicious Extension Vulnerability
A vulnerability in Google Chrome’s Gemini Live AI assistant allowed malicious extensions to hijack sessions and steal user files. Learn more about the impact.
SD-WAN Zero-Day and Smart TV Proxy SDK Vulnerabilities Recap
Technical analysis of recent SD-WAN zero-day exploits and Smart TV proxy SDK risks, detailing how network infrastructure is increasingly targeted.
Wireshark 4.6.4 Patch Fixes Dissector Vulnerabilities — Update Guide
Wireshark 4.6.4 addresses multiple dissector vulnerabilities, including CVE-2025-1811 and CVE-2025-1812, which could lead to application crashes.
APT28 Exploits CVE-2026-21513: MSHTML 0-Day Intelligence
Akamai reports Russia-linked APT28 exploited CVE-2026-21513 in the MSHTML Framework as a zero-day before Microsoft's February 2026 security patch updates.
CVE-2025-24036: Critical RCE in Ivanti Connect Secure — Patch Now
Exploit analysis of CVE-2025-24036 in Ivanti Connect Secure and Policy Secure. Learn to detect unauthenticated RCE attempts and apply mitigation strategies.
ClawJacked Vulnerability in OpenClaw AI Agent Enables Data Hijacking
Analysis of the ClawJacked attack where malicious websites can hijack local OpenClaw instances to steal sensitive LLM API keys and private conversation data.
ClawJacked: Hijacking Local OpenClaw AI Agents via WebSocket
A high-severity vulnerability in the OpenClaw AI gateway allows malicious websites to take control of local AI agents by exploiting WebSocket flaws.
900+ Sangoma FreePBX Servers Compromised via Web Shell Exploitation
Over 900 Sangoma FreePBX instances are currently infected with web shells following a command injection campaign first observed in late 2025.
Addressing Enterprise Risk in Third-Party Software Patching
Analyze the security risks of third-party software drift and learn why automated patch management is essential for reducing the modern attack surface.
CISA Warns of RESURGE Malware Persistence on Ivanti Devices
CISA details RESURGE, a sophisticated implant exploiting CVE-2025-0282 in Ivanti Connect Secure, capable of remaining dormant to bypass detection and recovery.
Juniper PTX Routers Face Critical RCE via Junos OS Evolved Flaw
Juniper Networks patches a critical 9.8 CVSS RCE vulnerability (CVE-2024-21602) in PTX Series routers. Learn the technical details and mitigation steps.
Critical Vulnerabilities in Gardyn Smart Gardens Enable Remote Takeover
CISA warns of critical flaws in Gardyn Smart Gardens, including CVE-2024-39682 and CVE-2024-39683, allowing remote code execution and unauthorized access.
OpenLDAP and lldpd Vulnerabilities: Analyzing DoS Risks
Detailed analysis of CVE-2025-25164 in OpenLDAP and CVE-2025-25330 in lldpd, focusing on NULL pointer dereference and memory leak impacts on infrastructure.
Cisco SD-WAN Zero-Day Under Exploitation for 3 Years
A critical zero-day vulnerability, CVE-2026-20127, in Cisco SD-WAN has been actively exploited by a sophisticated threat actor for three years.
GetProcessHandleFromHwnd API: UAC Bypass Implications
Investigate the GetProcessHandleFromHwnd API's role in a Quick Assist UAC bypass. Understand its mechanism, UIAccess implications, and defender recommendations.
Multiple DoS/RCE Vulnerabilities in Yokogawa CENTUM VP R6, R7
CISA alerts to multiple medium-severity vulnerabilities in Yokogawa CENTUM VP R6 and R7, allowing DoS and RCE via crafted packets in critical infrastructure…
Critical Authentication Flaws in Chargemap EV Infrastructure
CISA warns of critical vulnerabilities in Chargemap EV charging stations, including unauthenticated WebSocket access and session hijacking (CVE-2026-25851).
Trend Micro Patches Critical RCE Flaws in Apex One Security Platform
Trend Micro addresses two critical vulnerabilities, CVE-2023-32524 and CVE-2023-32525, in its Apex One platform that allow for remote code execution.
Anthropic Patches Claude Code Vulnerabilities Enabling Silent Hacking
Anthropic addressed flaws in Claude Code that allowed attackers to execute arbitrary commands on developer devices via malicious repository configurations.
Threat Intelligence Analysis: Kali Linux AI Integration and Browser Crash Traps
Analysis of Kali Linux Claude AI integration, Chrome browser crash traps, and the ongoing exploitation of WinRAR vulnerabilities by LockBit affiliates.