Dreigingen

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

CVE-2026-45803

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

Caddy CVE-2026-30852 Fix Bypass

Caddy CVE-2026-30852 Fix Bypass

Microsoft Self-Service Password Reset abused in Azure data theft attacks

A threat actor targeting Microsoft 365 and Azure production environments is stealing data in attacks that abuse legitimate applications and administration features. [...]

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint

Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint

Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder

Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder

CVE-2026-39806

Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`

Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`

CVE-2026-39803

Phishingcampagne gericht op medewerkers van overheidsorganisaties

Er is een phishingcampagne waargenomen die zich richt op overheidsmedewerkers met als doel inloggegevens en MFA-codes te onderscheppen.

Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps

Cybersecurity researchers have disclosed details of a new ad fraud and malvertising operation dubbed Trapdoor targeting Android device users. The activity, per HUMAN's Satori Threat Intelligence and Research Team, encompassed 455 malicious Android apps and 183 threat actor-owned command-and-control (C2) domains, turning the infrastructure into a pipeline for multi-stage fraud. "Users