News
July 13, 2026 Security Vulnerability Roundup: Takeovers in a Wireless Router and Industrial Gear — Does It Affect You?
InfrastructureSecurity
A roundup of three July 13, 2026 vulnerabilities rated 9.0 or higher. The Comfast wireless router can be taken over with no login yet has no fix, the WAGO industrial device has a hidden feature, and the Centreon monitoring tool has a critical flaw. Most target product operators. Also covers the same-day LINE bug so you can check what affects you.
2026.07.1356 views
News
July 12, 2026 Security Vulnerability Roundup: AI-Dev Tools Flowise and Crawl4AI Allow No-Login Takeover — Does It Affect You?
AISecurity
A roundup of the July 12, 2026 vulnerabilities rated 9.0 or higher. The AI-app builder Flowise and the AI data-collection tool Crawl4AI both have flaws allowing no-login takeover or file overwrite, and fixes are already out. We also organize seven network-device flaws so you can check whether a product you use is affected.
2026.07.1371 views
News
LINE freezing your iPhone? Below 26.3.0 it is a known bug
MobileSecurityJapanese Companies
LINE for iPhone flaw (CVE-2026-3861): a crafted link fills the screen with pop-ups and briefly freezes the device. No data stolen. Update to 26.3.0 to fix.
2026.07.1352 views
News
PraisonAI gets four more CVEs, one at 10.0, all fixes shipped
DevelopmentAISecurity
PraisonAI, a popular tool for delegating work to AI, has five flaws including the max-severity (10.0) CVE-2026-61447. A single crafted AI instruction can run malicious code on the server and steal secrets like API keys. Past PraisonAI flaws were attacked within hours of disclosure. Update both packages now.
2026.07.1155 views
News
July 11, 2026 Security Vulnerability Roundup: Seven WordPress Plugins Enable Admin Takeover — Does It Affect You?
SecurityDevelopment
A one-day roundup of the July 11, 2026 vulnerabilities we did not cover individually. Seven WordPress plugins let a single member or contributor account take over the admin, and a 2M-site Elementor add-on is among them. Judge relevance by whether a login is required, and see what ordinary users must act on now.
2026.07.1162 views
News
miniOrange login plugins need 7.8.1 — and the numbering differs
SecurityDevelopment
Two miniOrange WordPress login plugins, Social Login and Register and OAuth SSO, have critical authentication-bypass flaws (CVE-2026-12761, CVE-2026-57807, severity 9.8) that let an unauthenticated attacker take over the administrator account. Update to the latest versions now.
2026.07.1158 views
News
Exploit code published for mcp-server-kubernetes CVE-2026-61459 — and scanners stay silent
InfrastructureAISecurity
mcp-server-kubernetes, a popular tool that lets AI assistants operate Kubernetes, has a critical flaw (CVE-2026-61459, severity 9.8): unauthenticated argument injection redirects kubectl and steals the cluster admin's credentials. Versions before 3.9.0 are affected. Update now.
2026.07.1139 views
News
Four Joomla extension flaws: Balbooa Forms 2.4.1 is not enough (CVE-2026-65880)
SecurityDevelopment
A new critical flaw in Balbooa Forms (CVE-2026-65880, CVSS 10.0) is not fixed by 2.4.1 or 2.4.2. If any form uses a Signature field, only 2.4.3 is safe. Four Joomla extension CVEs covered.
2026.07.1165 views
News
9Router default password 123456 (CVE-2026-63732): server takeover risk
SecurityAIDevelopment
9Router, a popular AI coding router, has critical flaws (CVE-2026-55500, 9.9) that leak all stored API keys and tokens, plus a 10.0 unauthenticated RCE. Update to v0.4.80+ and don't expose it to the internet.
2026.07.11327 views
News
IntelliJ IDEA: 10.0 Remote Development hijack flaws (CVE-2026-64812) — update to 2026.2
DevelopmentSecurity
IntelliJ IDEA has a critical flaw (CVE-2026-59792, severity 9.6): opening a crafted project runs attacker code on your machine. All versions before 2026.1.4 and 2026.2 are affected. Update now.
2026.07.11106 views
News
Super Forms CVE-2026-14894: working PoCs are now public
SecurityDevelopment
A flaw (CVE-2026-14894, severity 9.8) in the popular premium WordPress form builder Super Forms lets anyone, with no login, upload a malicious file and run programs on the server to hijack the site. Versions 6.3.313 and earlier are affected. The vendor has released a fix, and updating to the latest version stops it. We explain the scope and what to do now.
2026.07.1042 views
News
Popular AI Agent UI 'Hermes WebUI' Server-Takeover Flaw CVE-2026-58123 — No Password Needed, Plus API-Key Theft; Update Now
DevelopmentAISecurity
A flaw (CVE-2026-58123, severity 9.8) in the popular tool Hermes WebUI—which runs your own AI agent from a browser (15,000+ GitHub stars)—lets attackers take over the server with no password. A second flaw, CVE-2026-58122, strips out paid LLM API keys and messaging credentials. Fixes are out for both, and updating to the latest stops them. We explain the scope and the fix.
2026.07.10101 views
