The type confusion vulnerability allows a guest-to-host sandbox escape which can lead to remote code execution ...

Microsoft says CVE-2026-69836, a CVSS 10.0 Entra ID RCE flaw, has been exploited in the wild but is fully mitigated with no ...

Attackers exploit CVE-2026-73570 on Zimbra servers with zimbra-snmp installed and SNMP notifications enabled, allowing ...

Weeks apart, at two unrelated companies, Escape's AI pentesting agent found the same stored XSS. Both had shipped a ...

By chaining an SQL injection and an API vulnerability, attackers can inject code. WordPress has released an update, the finders a hotfix.

Wiz revealed that its AI agent discovered and exploited a GitHub Actions vulnerability to gain access to Snowflake's internal environment.

A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a ...

In Zoom, IT researchers have discovered zero-click vulnerabilities that allow conference participants to inject any arbitrary code into others.

Anthropic’s source code leak revealed a new way to get Claude Code to do things it doesn’t want to. The leak of Claude Code’s source is already having consequences for the tool’s security. Researchers ...

Federal agencies have until August 7, 2026, to remediate or disconnect assets affected by a critical vulnerability in IBM Langflow, tracked as CVE-2026-9198. This mandate follows the inclusion of the ...