Dreigingen

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]

OpenAI's AI agents accidentally uploaded user-provided images to third-party sites

OpenAI says its AI agents uploaded user-provided images to third-party image-hosting services while carrying out research and evaluation tasks. [...]

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

CVE-2026-57443

mpp vulnerable to Gas Draining with access list

mpp vulnerable to Gas Draining with access list

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

CVE-2026-100368

CliInvoke: Argument Injection in Extensibility Runner Factory

CliInvoke: Argument Injection in Extensibility Runner Factory

CVE-2026-100369

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

CVE-2026-86439

OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet

OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet

Containerd has image-pull DoS via crafted OCI index graph amplification

Containerd has image-pull DoS via crafted OCI index graph amplification

CVE-2026-53493

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

CVE-2026-92161

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

CVE-2026-57440