Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index879 entries

Vulnerabilities Malware Campaigns Supply Chain Policy Tools

Page 19 of 36

451–475 of 879

criticalVulnerabilityResolved

ArcadeDB Authorization Bypass via Uninitialized Security Context and Disabled Schema Enforcement

Two compounding defects in ArcadeDB allow authenticated users to bypass database and record-level authorization controls: uninitialized fileAccessMap treated as allow-all, and newly-created databases with disabled security factories. Any authenticated principal can read/write/mutate schemas across all databases on a shared server.

CVE-2026-44221

6 May 2026ArcadeData/arcadedb (<26.4.2)

highPolicyResolved

FTC Enforcement Action Against Kochava Signals Regulatory Shift on Location Data Commercialisation

The FTC has banned data broker Kochava from selling precise geolocation data without explicit consumer consent, settling charges that the company monetised location information harvested from hundreds of millions of mobile devices. This represents meaningful regulatory intervention in the location data market.

6 May 2026Kochava, Collective Data Solutions (CDS)

highVulnerabilityContained

University student breached Taiwan high-speed rail TETRA communications, triggering emergency protocols

A 23-year-old student in Taiwan gained unauthorised access to the TETRA communication system used by the high-speed railway network and triggered emergency brake sequences. This demonstrates direct vulnerabilities in critical infrastructure communications that lack adequate access controls.

6 May 2026Taiwan High-Speed Rail (THSR), TETRA communication systems

criticalVulnerabilityResolved

Gotenberg ExifTool Stdin Injection via Metadata Value Newlines - Incomplete Sanitization Bypass

CVE-2026-40281 demonstrates a bypass of Gotenberg v8.30.1's metadata sanitization by injecting newline characters into metadata VALUES (not keys), allowing arbitrary ExifTool pseudo-tag execution and file system manipulation. Defenders must patch immediately and audit all metadata input handling.

CVE-2026-40281

3 May 2026Gotenberg <= v8.30.1

criticalVulnerabilityResolved

Patreon OAuth Provider Identity Collapse: Cryptographic Hash Collision Enabling Cross-User Impersonation

A logic error in the Patreon OAuth provider causes all authenticated users to map to an identical local user ID, collapsing distinct accounts into a single identity and enabling unauthorized cross-user access.

CVE-2026-42560

3 May 2026patreon-oauth-provider (root module), patreon-oauth-provider/v2

highCampaignContained

Juvenile actor breaches French administrative identity system, highlighting insider threat and data commodification risks

A 15-year-old was detained for allegedly stealing and selling data from France Titres (ANTS), the agency managing national identity and administrative documents. The incident demonstrates how young threat actors with technical capability can compromise high-value government systems and monetise sensitive personal data.

3 May 2026France Titres (ANTS), French Ministry of Interior

highSupply ChainResolved

Canvas Learning Platform Incident Exposes EdTech Supply Chain Risk at Scale

Instructure, operator of Canvas, has disclosed a cybersecurity incident under investigation. Given Canvas's penetration across schools and universities globally, any compromise of user data or platform integrity could affect millions of students and educators.

3 May 2026Instructure Canvas

informationalToolResolved

Microsoft's modernised Run dialog represents incremental UX hardening, not a security event

Microsoft is replacing Windows 11's legacy Run dialog with a modern variant featuring dark mode and claimed performance improvements. This is a user experience refresh with no direct security implications, though modernisation efforts occasionally surface adjacent hardening opportunities.

3 May 2026Windows 11

criticalVulnerabilityResolved

Unsafe Java Deserialization in fabric-sdk-java ObjectInputStream without Filter

fabric-sdk-java's Channel.deSerializeChannel() deserializes untrusted byte arrays without an ObjectInputFilter, enabling remote code execution via gadget chain exploitation. This PoC demonstrates a fundamental deserialization flaw in deprecated but still-deployed SDKs.

CVE-2026-41586

30 April 2026hyperledger/fabric-sdk-java

criticalVulnerabilityResolved

n8n Prototype Pollution via XML Webhook Parser Leading to RCE

A prototype pollution flaw in n8n's xml2js-based webhook handler allows authenticated users to corrupt JavaScript object prototypes, which can be chained with Git node SSH operations to achieve remote code execution on the host system.

CVE-2026-42231

30 April 2026n8n/n8n (< 1.123.32, < 2.17.4, < 2.18.1)

criticalVulnerabilityResolved

cPanel/WHM Authentication Bypass: Mass Exploitation Risk for Millions of Hosting Providers

A critical authentication bypass in cPanel and WHM affects all versions except the latest, allowing unauthenticated attackers to gain full control panel access. This threatens the administrative interfaces of millions of hosted websites and is likely already being exploited in the wild.

30 April 2026cPanel, WebHost Manager (WHM)

highCampaignResolved

Mass Roblox Account Hijacking Ring Dismantled: 610,000 Compromised Accounts Yielded $225,000 in Criminal Revenue

Three Ukrainian criminals were arrested after compromising 610,000 Roblox accounts and selling them for approximately $225,000. The case highlights the persistent market for stolen gaming credentials and the cross-border enforcement challenges in combating organised account theft.

30 April 2026Roblox

criticalVulnerabilityResolved

Qinglong task scheduler authentication bypass enables widespread cryptominer deployment

Two authentication bypass vulnerabilities in Qinglong, an open-source task scheduler popular with developers, are being actively exploited to deploy cryptominers on compromised servers. The flaws allow unauthenticated remote code execution, making this a significant threat to any organisation running unpatched instances.

30 April 2026Qinglong task scheduler

criticalSupply ChainResolved

Five-year dormant backdoor in 70k-site WordPress plugin exposes supply-chain timing risk

The Quick Page/Post Redirect WordPress plugin contained a backdoor injected five years ago that remained undetected across 70,000+ installations, allowing arbitrary code execution. This demonstrates how supply-chain compromises can persist for years within popular plugins before discovery.

30 April 2026Quick Page/Post Redirect plugin

criticalSupply ChainResolved

SAP npm supply-chain compromise reveals persistent TeamPCP targeting of enterprise developer infrastructure

Official SAP npm packages were compromised to inject credential-stealing malware, directly compromising developers' authentication tokens and local systems. This represents a high-impact supply-chain attack against enterprise development environments at scale.

30 April 2026SAP npm packages, SAP developers, organisations using SAP development tools

criticalVulnerabilityResolved

LangChain Core Template Injection Leading to Remote Code Execution

LangChain Core 1.2.4 contains a Server-Side Template Injection (SSTI) vulnerability in template processing that allows unauthenticated remote code execution. This PoC demonstrates the need for immediate input validation hardening in LLM framework integrations.

CVE-2025-68664

29 April 2026LangChain/LangChain-Core

highSupply ChainResolved

LAPSUS$ Breach of Checkmarx Exposes AppSec Tools and Internal Development Practices

LAPSUS$ threat group confirmed leaking proprietary source code and internal data stolen from Checkmarx's private GitHub repositories. The breach affects a major application security vendor and raises concerns about the security posture of tools trusted to protect enterprise software supply chains.

29 April 2026Checkmarx

highCampaignResolved

Scattered Spider operator arrested in Finland: implications for distributed social engineering campaigns

A 19-year-old dual US-Estonian national arrested in Finland faces federal charges for membership in Scattered Spider, a prolific collective known for social engineering and financial fraud targeting critical sectors. The arrest demonstrates law enforcement coordination across jurisdictions but does not significantly disrupt the group's operational capacity.

29 April 2026Financial services, Technology sectors, Healthcare organisations

highSupply ChainResolved

Anodot breach cascades to Vimeo: third-party monitoring tools as attack surface

Vimeo disclosed unauthorised access to customer and user data following a breach at Anodot, a third-party data anomaly detection service integrated into Vimeo's infrastructure. This exposes the risk of supply-chain compromise through monitoring and analytics vendors.

29 April 2026Vimeo, Anodot

criticalVulnerabilityResolved

LiteLLM SQLi exploitation accelerating: 36-hour weaponisation window exposes pre-auth data access risk

A pre-authentication SQL injection in BerriAI's LiteLLM Python package (CVE-2026-42208, CVSS 9.3) is being actively exploited within 36 hours of public disclosure. The flaw enables unauthenticated attackers to access and modify sensitive data stored in LLM gateway deployments.

CVE-2026-42208

29 April 2026BerriAI LiteLLM, LiteLLM Python package

highMalwareResolved

VECT 2.0 ransomware encryption flaw converts payload into destructive wiper for large files

VECT 2.0 ransomware contains a critical implementation flaw in nonce handling that causes it to permanently destroy files above a certain size rather than encrypt them. This unintended behaviour converts the malware into a data wiper, eliminating ransom recovery options and increasing damage to victims.

29 April 2026VECT 2.0 ransomware victims

highCampaignResolved

Social Media Scams Cost Americans $2.1B in 2025: Systemic Platform Failure and Exploitation at Scale

The FTC reports that Americans lost over $2.1 billion to social media scams in 2025, representing a sustained and accelerating trend since 2020. This reflects a fundamental failure of platforms to implement effective fraud detection and user verification controls, creating an environment where scammers operate with minimal friction.

28 April 2026Meta/Facebook, Instagram, TikTok +3

highCampaignResolved

Silk Typhoon operator extradition signals strengthened US-Italy cooperation on Chinese APT prosecution

A Chinese national linked to Silk Typhoon, a state-sponsored APT group conducting cyberespionage for Chinese intelligence, has been extradited from Italy to face US criminal charges. This marks a significant shift in international law enforcement coordination against Chinese cyber operations.

28 April 2026US government agencies, International critical infrastructure

highCampaignContained

Toronto SMS Blaster Arrests Expose Street-Level Phishing Infrastructure Gap

Canadian authorities arrested three individuals operating a fake cellular tower (IMSI catcher) in Toronto to distribute phishing SMS messages at scale. The arrests highlight how accessible cellular interception hardware has become for low-sophistication threat actors targeting local populations.

28 April 2026Canadian telecommunications networks, SMS users in Toronto area

criticalSupply ChainResolved

GlassWorm's dormant extension network exposes supply-chain blindness in open-source IDE ecosystems

73 malicious extensions in OpenVSX remained undetected until post-install activation, demonstrating that update mechanisms in extension marketplaces can be weaponised to bypass initial vetting and achieve code execution at developer workstations.

28 April 2026OpenVSX, VS Code, Open VSX Registry