Vulnerabilities, zero-days and active exploitation.

CVE & Exploits · 3d ago

Researchers Uncover RovoBlast Vulnerability in Atlassian AI Assistant

Atlassian fixed a flaw letting one crafted link make its Rovo AI assistant exfiltrate company data

CVE & Exploits · 3d ago

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call.…

CVE & Exploits · 3d ago

Why transparent AI agents matter more than you think

As security operations teams now use large language models (LLMs) and autonomous AI agents into their daily work, a new…

CVE & Exploits · 3d ago

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once…

CVE & Exploits · 3d ago

OpenAI Pauses Astra Model Over Critical Cybersecurity Risk Concerns

OpenAI paused work involving Astra after tests showed cybersecurity abilities that could approach its Critical risk…

CVE & Exploits · 3d ago

“Ghostjacking” Exploits AI Agents’ Trusted Access to Evade Firewall Controls

Tenet reported that half of Fortune 500 companies are vulnerable to the Ghostjacking technique, which involves tricking…

CVE & Exploits · 3d ago

A GitHub Misconfiguration Let Kimi K3 Cheat a Cybersecurity Benchmark

Kimi K3 bypassed a UK cybersecurity test by accessing GitHub, cloning the benchmark and reading its solutions instead…

CVE & Exploits · 5d ago

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization…

CVE & Exploits · 5d ago

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a…

CVE & Exploits · 5d ago

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw…

CVE & Exploits · 6d ago

More than half of AI-generated patches are broken

As AI-generated code continues to be injected into all corners of the internet, concerns have risen about an expanding…

CVE & Exploits · 6d ago

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects…