Drupal is warning users that it’s preparing a patch for a ‘highly critical’ vulnerability that may be exploited by threat actors shortly after its disclosure. In a notice posted this week, the developers of the open source content management system… Read More "Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation"
An unpatched vulnerability in ChromaDB could allow remote, unauthenticated attackers to spawn a shell and take control of the server process, HiddenLayer reports. ChromaDB is an open source vector database for building AI applications. It has approximately 13 million monthly… Read More "Unpatched ChromaDB Vulnerability Can Lead to Server Takeover"
Universal Robots, a Danish company specializing in collaborative industrial robots, or cobots, has patched a critical vulnerability affecting one of its operating systems. Advisories published last week by the cybersecurity agency CISA and Universal Robots revealed that PolyScope 5, an… Read More "Critical Vulnerability Exposes Industrial Robot Fleets to Hacking"
The first in-the-wild attacks exploiting a critical-severity NGINX vulnerability patched last week have occurred over the weekend, VulnCheck warns. Tracked as CVE-2026-42945 (CVSS score of 9.2) and dubbed Nginx Rift, the flaw is described as a heap buffer overflow in… Read More "Exploitation of Critical NGINX Vulnerability Begins"
A security researcher has released an exploit targeting a Windows vulnerability disclosed in 2020, warning that it might have never been patched. The flaw, tracked as CVE-2020-17103 (CVSS score of 7.0), is described as a privilege escalation issue in the… Read More "Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE"
Four vulnerabilities in the OpenClaw AI assistant can be chained together to plant backdoors on the underlying host, cybersecurity firm Cyera warns. The bugs, collectively known as Claw Chain, allow an attacker with code execution privileges inside the sandbox to… Read More "‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery"
Technical details and proof-of-concept (PoC) exploit code targeting a newly patched critical-severity vulnerability in NGINX are now available. Tracked as CVE-2026-42945 (CVSS score of 9.2), the issue was patched in the widely used web server this week as part of… Read More "PoC Code Published for Critical NGINX Vulnerability"
Google this week released a Chrome 148 update that resolves 79 vulnerabilities, including 14 critical-severity bugs across multiple components. The first critical issue is a heap buffer overflow in WebML tracked as CVE-2026-8509, for which the internet giant paid a… Read More "Chrome 148 Update Patches Critical Vulnerabilities"
F5 on Wednesday announced fixes for over 19 high-severity and 32 medium-severity vulnerabilities impacting BIG-IP, BIG-IQ, and NGINX. Based on the CVSS score, the most severe of the resolved issues is CVE-2026-42945 (CVSS v4.0 score of 9.2), a denial-of-service (DoS)… Read More "F5 Patches Over 50 Vulnerabilities"
Exploitation attempts targeting a recent authentication bypass vulnerability in PraisonAI started less than four hours after public disclosure, application protection firm Sysdig warns. PraisonAI is a multi-agent framework that allows organizations to deploy autonomous AI agents for the execution of… Read More "Hackers Targeted PraisonAI Vulnerability Hours After Disclosure"
