Vulnerabilities

Zero Click Agentic Browser Attack Can Wipe Entire Google Drive Through Crafted Emails

A new agent based browser attack has been discovered in Perplexity’s Comet browser, and researchers from Straiker STAR Labs warn that it can turn a harmless looking email into a destructive command that erases all files stored in a user’s Google Drive account. The method is known as the Zero Click Google Drive Wiper technique. […]

Zero Click Agentic Browser Attack Can Wipe Entire Google Drive Through Crafted Emails Read More »

JPCERT Confirms Active Command Injection Attacks Targeting Array AG Gateways

JPCERT/CC has confirmed that a command injection vulnerability in Array Networks AG Series secure access gateways has been actively exploited since August 2025. The alert, released this week, warns organizations to take immediate protective measures. The vulnerability, which has not yet received a CVE identifier, was addressed by Array Networks on May 11, 2025. It

JPCERT Confirms Active Command Injection Attacks Targeting Array AG Gateways Read More »

Critical RSC Bugs in React and Next.js Enable Unauthenticated Remote Code Execution

A newly disclosed maximum severity vulnerability in React Server Components has raised significant alarm across the web development ecosystem. The flaw, assigned CVE-2025-55182 and nicknamed React2shell, allows attackers to execute code remotely without authentication simply by sending a specially crafted request to a Server Function endpoint. Nature of the Vulnerability The React Team stated that

Critical RSC Bugs in React and Next.js Enable Unauthenticated Remote Code Execution Read More »

Microsoft Quietly Fixes Windows LNK Flaw After Years of Active Exploitation

Microsoft has rolled out a silent fix for a Windows Shortcut (LNK) vulnerability that has been under active exploitation since 2017. The update was released as part of the company’s November 2025 Patch Tuesday batch, according to details published by ACROS Security’s 0patch team. Background of the Vulnerability The flaw, tracked as CVE-2025-9491 and rated

Microsoft Quietly Fixes Windows LNK Flaw After Years of Active Exploitation Read More »

Picklescan Bugs Let Malicious PyTorch Models Bypass Scans and Run Unauthorized Code

A set of three serious vulnerabilities has been uncovered in Picklescan, an open source security tool created by Matthieu Maitre, designed to inspect Python pickle files and detect dangerous behavior before any code is executed. These flaws make it possible for attackers to hide harmful commands inside PyTorch models and completely bypass the scanner, posing

Picklescan Bugs Let Malicious PyTorch Models Bypass Scans and Run Unauthorized Code Read More »

Active Attacks on WordPress King Addons Flaw Allow Hackers to Create Admin Accounts

A severe security vulnerability affecting the King Addons for Elementor WordPress plugin is currently under active exploitation. The flaw, tracked as CVE-2025-8489 with a CVSS score of 9.8, allows unauthenticated attackers to escalate their privileges by registering directly as administrators. The issue impacts all plugin versions from 24.12.92 up to 51.1.14. The maintainers issued a

Active Attacks on WordPress King Addons Flaw Allow Hackers to Create Admin Accounts Read More »

Google Fixes 107 Android Flaws Including Two Actively Exploited Framework Bugs

Google has released its latest monthly security updates for the Android operating system, delivering fixes for 107 vulnerabilities found across key system components. The update covers issues in Framework, System, Kernel, and modules from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unison. Two High Severity Bugs Exploited in Real World Attacks The company confirmed that two

Google Fixes 107 Android Flaws Including Two Actively Exploited Framework Bugs Read More »

CISA adds actively exploited XSS flaw CVE-2021-26829 in OpenPLC ScadaBR to KEV list

The United States Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog by adding a  cross-site scripting flaw that affects OpenPLC ScadaBR on both Windows and Linux systems. The decision follows confirmed evidence that the vulnerability is being actively used by attackers. The flaw, tracked as CVE-2021-26829  with a CVSS

CISA adds actively exploited XSS flaw CVE-2021-26829 in OpenPLC ScadaBR to KEV list Read More »

Legacy Python bootstrap scripts create domain takeover risk in several PyPI packages

Cybersecurity researchers have identified insecure legacy code inside several Python packages that could allow attackers to compromise the Python Package Index (PyPI) through a domain takeover scenario. ReversingLabs reported that the issue originates from old bootstrap scripts associated with a build and deployment tool known as zc.buildout. According to researcher Vladimir Pezo, these bootstrap files

Legacy Python bootstrap scripts create domain takeover risk in several PyPI packages Read More »

Microsoft to block unauthorized scripts in Entra ID logins with 2026 CSP update

Microsoft has announced a major update to strengthen the security of Entra ID authentication. Starting in October 2026, the company will block unauthorized script injection attacks through a revised Content Security Policy (CSP) for its login platform. Enhanced Security for Entra ID Sign-Ins The CSP update will focus on the sign-in experience at login.microsoftonline[.]com, allowing

Microsoft to block unauthorized scripts in Entra ID logins with 2026 CSP update Read More »