Vulnerabilities
Stack Overflow data: 79% of devs prioritise source attribution for AI training
New survey data reveals strong developer concern regarding source attribution, impacting firms licensing Q&A archives to model builders.
Malware Brief Exposure Desk
The Malware Brief Exposure Desk is the part of the Malware Brief newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 15 articles so far. See the editorial policy or report an error.
Vulnerabilities
Organizations Face Critical Privilege Escalation Risk in miniOrange OTP Plugin Versions Through 5.5.7
A high-severity flaw in the miniOrange OTP Verification plugin allows attackers to escalate privileges on WordPress installations running versions up to 5.5.7.
Vulnerabilities
Unreviewed AI bug reports go straight to opted-in OSS maintainers to speed patching
Anthropic’s new OSS Scanner sends unreviewed, model-generated vulnerability reports directly to opt-in open source maintainers to accelerate patching.
Vulnerabilities
Orgs with FalkorDB Bolt Endpoint Exposed Face Critical Auth Bypass CVE-2026-107910
A critical flaw in FalkorDB allows remote users to run queries without credentials if the Bolt endpoint is enabled.
Vulnerabilities
EduAdmin Booking SQL Injection Risk Threatens Data Integrity for Institutions
A critical blind SQL injection flaw in EduAdmin Booking versions prior to 6.0.0 exposes organisations to severe data compromise risks, according to the National Vulnerability Database.
Vulnerabilities
Organizations Urged to Patch ThemeREX Let's Play v1.1.15 to Mitigate Critical 9.8 CVSS Deserialization Risk
A critical deserialization vulnerability in ThemeREX's Let's Play plugin allows attackers to inject objects, posing severe risks to web infrastructure.
Vulnerabilities
Organisations Risk Remote Code Execution via Critical Command Injection in @enmaso/node-convert Library
A critical command injection flaw in @enmaso/node-convert allows remote execution of system commands through unsanitized inputs.
Vulnerabilities
Skyeye TTS Vulnerability Enables Unauth PowerShell Execution on Windows Servers
A critical unauthenticated command injection in Dromara Skyeye allows remote attackers to execute PowerShell code on Windows servers via a text-to-speech endpoint.
Vulnerabilities
Open-source maintainers receive automated AI vulnerability reports from Anthropic's new free scanner
The AI firm offers opt-in vulnerability scans for open-source code, delivering automated reports generated by its strongest models without human review.
Vulnerabilities
Critical Unauth SQLi in PHPNuxBill FreeRADIUS Puts Orgs at Risk, Enabling Credential Theft via Blind Injection
A critical flaw in PHPNuxBill’s FreeRADIUS module allows attackers to extract credentials via blind SQL injection without authentication.
Vulnerabilities
Organisations urged to patch IBM Guardium 12.1/12.2.2 to stop unauthenticated container hijack and cluster takeover
A critical vulnerability in IBM Guardium allows unauthenticated attackers to execute arbitrary container images and seize control of managed edge clusters.
Vulnerabilities
Organisations urged to patch IBM Guardium 12.0-12.2 after critical unauthenticated RCE flaw exposed
A critical path traversal flaw in IBM Guardium versions 12.0 to 12.2 allows remote attackers to execute arbitrary code without credentials.
Vulnerabilities
IBM access software flaw lets attackers run code without credentials, hitting versions up to 10.0.9.2 and 11.0.3
A deserialization flaw in IBM access management software lets attackers run arbitrary code without credentials, affecting versions up to 10.0.9.2 and 11.0.3.
Vulnerabilities
Service Outages Loom as CISA Orders Federal BIND TKEY Fixes by Oct 11
CISA added an old but active BIND vulnerability to its critical catalog, demanding federal action within three days to prevent service outages.
Vulnerabilities
Handlebars RCE flaw allows server compromise via prototype bypass
A critical vulnerability in the Handlebars templating engine enables remote code execution by bypassing security controls, affecting versions up to 4.7.9.