News
XSS Scanner Dalfox Hit by Unauthenticated RCE: CVE-2026-45087 (CVSS 10.0)
DevelopmentSecurity
Dalfox, the XSS scanner widely used by bug-bounty hunters, exposes an unauthenticated RCE in REST API server mode (CVE-2026-45087, CVSS 10.0). Versions up to 2.12.0 bind 0.0.0.0:6664 with no API key and accept shell commands via JSON. Update to v2.13.0 immediately.
2026.05.2838 views
News
free5GC Hit by Five Critical Auth Bypass Flaws: CVE-2026-44315/26/27/29/30
InfrastructureDevelopmentSecurity
Five critical OAuth2 authorization bypass vulnerabilities (CVE-2026-44315/26/27/29/30, three at CVSS 10.0) hit the free5GC 5G core network implementation in versions up to v4.2.1. NEF and SMF API routes accept unauthenticated read/write/delete. Fixed in v4.2.2.
2026.05.2865 views
News
TanStack and Nx Console Supply-Chain Compromise: Which Versions Are Safe Now
AIDevelopmentSecurity
Two CISA KEV-listed npm and VS Code supply-chain breaches in May 2026 turned out to be one connected attack. CVE-2026-45321 hit 84 versions across 42 @tanstack/* packages on May 11; stolen GitHub credentials from that leak then powered CVE-2026-48027, the malicious Nx Console v18.95.0 push on May 18.
2026.05.2879 views
News
LibVNCClient Flaw CVE-2026-44988: Malicious VNC Server Can Hijack Your PC On Connect
SecurityDevelopmentLinux
CVE-2026-44988 (CVSS 8.8) hits LibVNCClient v0.9.15 and earlier. A malicious VNC server can send crafted framebuffer-update rectangles to overwrite memory on the connecting client, leading to potential RCE. Remmina, KRDC, ZoneMinder and other downstream projects are affected. No tagged release with the fix has shipped yet.
2026.05.2870 views
News
Critical Langflow Flaw CVE-2026-7524: TAR Symlinks Leak JWT Secret, Chain to RCE
SecurityDevelopmentAI
IBM disclosed CVE-2026-7524 (CVSS 9.8) in Langflow OSS on May 27, 2026. Versions 1.0.0 through 1.9.1 are vulnerable: a crafted tar with symlinks can steal the JWT secret, forge tokens, then chain to RCE via Python Interpreter nodes. Update to v1.9.2 or later immediately.
2026.05.2858 views
Lab
OSS Supply Chain Scanner — paste package.json, requirements.txt, pyproject.toml
SecurityDevelopment
Paste a package.json, requirements.txt, or pyproject.toml and instantly check your dependencies against OSV.dev's vulnerability database. Free, browser-only, no signup. Supports npm, pip, Poetry, uv, and Rye. Built as a hub for our axios, LiteLLM, Trivy, and GlassWorm supply chain coverage.
2026.05.2772 views
News
WordPress WPCode code-injection flaw, safe on 2.3.6 and later (CVE-2026-8832)
Global CompaniesDevelopmentSecurity
A code injection flaw (CVE-2026-8832, CVSS 8.8) has been disclosed in WPCode, a WordPress code-snippet management plugin installed on over 3 million sites. The flaw lets any user with Author-level access or higher run arbitrary code on the server. The vendor released v2.3.6 on May 26, 2026; Wordfence published the advisory on May 27.
2026.05.2766 views
Column
The Day Google Summons Back the "Obscure Personal Blog": Beyond AI Article Fatigue
DevelopmentFreelance
The "obscure personal blogs" that Google's Helpful Content Update killed in 2023 are being summoned back by the March and May 2026 Core Updates. A field report on E-E-A-T's "Experience" axis, AI-article fatigue, and the strange world of a blog where Bing slightly outranks Google.
2026.05.2652 views
News
Drupal Core Flaw Lets Anyone Hijack PostgreSQL Sites Without a Login
InfrastructureSecurityDevelopment
The U.S. CISA gave federal agencies just five days to patch CVE-2026-9082, a highly critical SQL injection in Drupal core that lets anonymous attackers take over PostgreSQL-backed sites. Imperva already counts 15,000 attack attempts against 6,000 sites across 65 countries, including Drupal-powered government and university portals in Japan.
2026.05.2365 views
News
Langflow CVE-2025-34291: visiting a web page can hijack your AI agent stack
SecurityDevelopmentAI
A CVSS 9.4 flaw has been found in Langflow, the popular AI agent OSS, and CISA has added it to the Known Exploited Vulnerabilities catalog. Visiting a malicious web page is enough to steal a user's session and hijack the entire AI agent stack, including configured OpenAI and Anthropic API keys. A fix is available in version 1.9.3.
2026.05.2258 views
News
IINA Vulnerability Explained: Update to 1.4.4, the 1.4.3 Fix Was Incomplete
DevelopmentSecurityLinux
A critical CVSS 8.8 vulnerability has been found in IINA, the popular open-source video player for Mac. Just clicking a malicious link and approving the open prompt lets attackers run arbitrary commands on your Mac. Used by 44K+ GitHub stargazers, the project has shipped a fix in version 1.4.3 and immediate updates are advised.
2026.05.22109 views
Lab
UUIDv4 vs v7 vs bigint: The Right Answer for Each Use Case (2026 DB Design)
Development
Is UUIDv7 really a drop-in upgrade from v4? We benchmarked insert performance on PostgreSQL 18 with Python 3.14 and mapped out the best ID strategy by project scale and table purpose.
2026.04.13379 views
