Vulnerabilities
Stack Overflow for Agents: ChatGPT Plugin Sparks 10x Agent Creation Rate Surge
OpenAI reports that its new ChatGPT plugin for Stack Overflow for Agents has significantly increased developer signups and agent creation rates.
RedTeam Log CVE Desk
Vulnerabilities
kin-openapi flaw allows remote crash via malformed API specs
A high-severity nil pointer panic in kin-openapi lets attackers disrupt Go services by supplying specific OpenAPI documents that bypass initial validation checks.
Vulnerabilities
Misaka Danmu Server Authentication Bypass Grants Full Admin Control
Unauthenticated users can manipulate configuration keys to assume administrator privileges in Misaka Danmu Server versions up to 2.8.9.
Vulnerabilities
Claude Agent SDK Input Sanitization Failure Triggers Remote Code Execution Risk
Unvalidated inputs in the Claude Agent SDK for Python enable arbitrary command execution, bypassing permission controls before version 0.2.121.
Vulnerabilities
RIOT OS ATWINC15x0 Memory Corruption: Nearby Malformed SSIDs Trigger Remote Code Execution
A critical flaw in the ATWINC15x0 driver allows nearby attackers to corrupt memory and execute code via malformed network names.
Vulnerabilities
OpenBSD Kernel Flaw Chain Grants Root Access via Integer Overflow
Researchers demonstrated how chaining two kernel defects allows local users to seize root privileges on OpenBSD systems.
Vulnerabilities
BeyondTrust Remote Support Zero-Day Bypasses Authentication for Root Access
Espionage actors exploited an authentication flaw in BeyondTrust Remote Support to seize full control of appliances and steal credentials.
Vulnerabilities
Next.js 10-16 Patches Critical Remote Code Execution in Cache and Image Processing
Unauthenticated attackers can execute remote code via two critical flaws in Next.js caching and image handling, fixed in new LTS releases.
Vulnerabilities
AWS API MCP Server CVE-2026-16584 Grants Access on Init Fail; Patch 1.3.47 Fixes
A bug in the open-source server allows attackers to bypass security policies if initialization fails, granting unauthorized access until restart.
Vulnerabilities
AI Coding Agents Introduce Flaws at Eight Times the Remediation Rate
Snyk data reveals AI development outpaces security, with malicious packages stealing credentials before scans run.
Vulnerabilities
nullclaw NullHub Auth Bypass Exposes Agent Control to Unauthenticated Users
A critical flaw in nullclaw NullHub allows attackers to rewrite agent configurations and credentials without any authentication, affecting versions up to 2026.5.29.
Vulnerabilities
Znuny header trust flaw grants admin access without passwords
Attackers can impersonate any user, including administrators, in Znuny versions prior to 7.3.7 by forging a single HTTP request header.
Vulnerabilities
Cortex XSOAR Command Injection Risk in OS Query Pack
Authenticated admins can run OS commands via a vulnerable content pack, but a patch and mitigation are available.
Vulnerabilities
Prisma Browser Chromium flaws expose sessions to unauthorised access
Palo Alto Networks confirms high-severity flaws in Prisma Browser versions before 155.16.5.40 require urgent updates to prevent session theft.
Vulnerabilities
Microsoft Shell Zero-Day Bypasses Mark of the Web in Record Patch
Attackers exploit a Windows Shell flaw to bypass file warnings. Microsoft’s October update fixes this active threat among 1,413 vulnerabilities.
Vulnerabilities
vlife Critical CVE-2026-110612: Hardcoded Signing Key Enables Token Forgery and Full System Control
A hardcoded signing key in vlife allows attackers to forge tokens and gain full system control without valid credentials.
Vulnerabilities
@mborne/extract Path Traversal Injection Grants Full Process Privileges Before 0.2.1
Attackers can run operating system commands via archive paths in versions before 0.2.1, gaining full process privileges.
Vulnerabilities
Juniper Junos BGP Buffer Overflow Allows Unauthenticated Root Access
A critical flaw in Juniper’s routing software lets remote attackers gain root control if monitoring is active, requiring immediate version checks.
Vulnerabilities
Juniper Junos OS Routing Daemon Stack Overflow Allows BGP Peers to Execute Root Code
A critical flaw in Juniper Junos OS routing daemons lets configured BGP peers run root code or crash services through valid route advertisements.
Vulnerabilities
Chrome Stable and Extended Stable Fix Critical Buffer Overflow and Use-After-Free Bugs
Google releases security updates for Chrome Stable and Extended Stable channels, addressing dozens of high and critical vulnerabilities.
Vulnerabilities
.NET Runtimes 8-11: Algorithmic Complexity Flaw in XML Library Patched to Prevent Network-Based DoS
Microsoft patches an algorithmic complexity vulnerability in .NET runtimes that allows unauthenticated network-based denial of service attacks.
Vulnerabilities
Windows SmartScreen Use-After-Free CVE-2026-85851 Allows Silent Local Privilege Escalation
A memory error in Windows SmartScreen allows local attackers to raise their access level without user interaction, prompting urgent patching.
Vulnerabilities
Coruna and DarkSword kits breach iOS sandbox to harvest credentials
Exploit chains allow attackers to bypass browser restrictions and steal sensitive data from iPhones through a single web visit.
Vulnerabilities
Collabora Online CODE Server Restart Command Injection Enables Full System Control
Attackers exploited a command injection bug in the built-in server during restarts, gaining full control of affected Nextcloud systems.