Metabase Zero-Day SQL Injection Exploited in Active Attacks
Metabase confirms active exploitation of a critical zero-day SQL injection flaw that gives remote attackers administrator access. Self-hosted users must patch.
Read more →Vulnerabilities
Latest articles in Vulnerabilities
Critical TeamCity RCE Flaw Threatens CI/CD Servers
Rapid7 details critical TeamCity flaw CVE-2026-63077, which lets unauthenticated attackers run commands on exposed on-premises CI/CD servers worldwide.
Read more →
Zero-Click Prompt Injection Hijacks Agentic AI Browsers
Zero-click prompt injection tests hijacked agentic AI browsers, exposing authenticated sessions to phishing, data theft and unauthorized account actions.
Read more →
CISA Flags Three Actively Exploited Enterprise Flaws
CISA adds exploited Langflow, N-central and Tomcat flaws to its KEV catalog, giving federal agencies until August 7 to apply vendor mitigations.
Read more →
Coldcard Wallet Flaw Linked to $88.6 Million Bitcoin Theft
Coldcard's weak seed generation flaw is linked to suspected thefts of $88.6 million in bitcoin, with affected wallet owners urged to migrate funds now.
Read more →
wp2shell POST Variant Bypasses URL-Only WordPress Defenses
Cloudways reports a wp2shell variant hiding the WordPress batch route in POST bodies, bypassing URL-only defenses and reinforcing the need to patch now.
Read more →
Fastjson RCE Flaw CVE-2026-16723 Exploited in Attacks
Attackers are exploiting critical Fastjson flaw CVE-2026-16723 for unauthenticated remote code execution, leaving unsupported 1.x deployments at risk.
Read more →
CVE-2026-6875 ServiceNow Flaw Exploited in Attacks
CVE-2026-6875, a critical ServiceNow AI Platform sandbox escape, is reportedly being exploited as administrators are urged to apply available patches.
Read more →
YellowKey BitLocker Zero-Day Bypass Exploits Windows Recovery
Microsoft issues emergency mitigation for YellowKey CVE-2026-45585, a BitLocker zero-day bypass requiring only a USB stick and physical access.
Read more →
Linux Kernel Copy Fail Flaw Enables Root in 732 Bytes
CVE-2026-31431 Copy Fail lets unprivileged users gain Linux root access with a 732-byte script. CISA mandates patching by May 15.
Read more →