News
LLaMA-Factory RCE Flaw (CVE-2026-58116): An Exposed Web UI Lets Anyone Hijack the Server
SecurityAI
LLaMA-Factory, a popular AI fine-tuning tool, has a critical flaw (CVE-2026-58116): an exposed training screen lets a malicious model hijack the server. No fix yet.
2026.06.3037 views
News
RPG Maker MV/MZ Flaw (CVE-2026-56137): Shared Save Can Hijack Your PC
Securitygame
Games made with RPG Maker MV/MZ have a flaw (CVE-2026-56137): loading a save someone else shared can hijack your PC. No fix yet, so don't load untrusted saves.
2026.06.3040 views
News
AWS WAF Body-Inspection Bypass (CVE-2026-13762/13763, CVSS 9.8): Attacks Can Slip Past on CloudFront and the Load Balancer
SecurityInfrastructure
AWS WAF, the web shield on Amazon's cloud, has a flaw (CVE-2026-13762/13763, CVSS 9.8): splitting an attack across HTTP/2 frames slips past body inspection. CloudFront is auto-fixed; load balancer (ALB) users must change a setting.
2026.06.3066 views
News
Critical Auth-Bypass in SimpleHelp (CVE-2026-48558, CVSS 10): Attackers Can Take Over Every Managed PC — Now in CISA KEV, Update to 5.5.16
SecurityInfrastructure
SimpleHelp remote-support software has a critical auth-bypass flaw (CVE-2026-48558, CVSS 10): attackers forge a login to create an admin technician and take over every managed PC. Now in CISA KEV — update to 5.5.16.
2026.06.3062 views
News
Snowflake CLI Had a Code-Injection Flaw Before 3.19.0: Building a Malicious Project Can Take Over Your Machine
SecurityDevelopmentInfrastructure
Snowflake CLI, the official tool for the Snowflake cloud data platform, has a code-injection flaw (CVE-2026-13749, CVSS 8.8): building or deploying a malicious project runs attacker code on your machine. Fixed in 3.19.0 — update now.
2026.06.3037 views
News
Command Injection in vscode-java (CVE-2026-12856, CVSS 8.8): A Malicious Java File Can Take Over Your Machine — Update to 1.55.0
DevelopmentSecurity
Language Support for Java by Red Hat, a popular VS Code extension, has a flaw (CVE-2026-12856, CVSS 8.8): opening a malicious Java file and clicking a JavaDoc hover link can take over your machine. Update to 1.55.0.
2026.06.3083 views
News
libzypp (openSUSE/SUSE Linux) File-Overwrite Flaw: What It Is and How to Fix It
SecurityLinuxInfrastructure
libzypp, the openSUSE/SUSE Linux package manager, has a path traversal flaw (CVE-2026-25707, CVSS up to 8.8): a malicious repository can overwrite system files. Update to the fixed version now.
2026.06.2950 views
News
Fluentd Hit by Unauthenticated RCE (CVE-2026-44024, CVSS 9.8) Plus 5 More — Update to v1.19.3 Now
DevelopmentInfrastructureSecurity
Fluentd has a critical flaw (CVE-2026-44024, CVSS 9.8): an unauthenticated attacker can overwrite files via a crafted log tag to run code. Six issues fixed; update to v1.19.3 now.
2026.06.2962 views
News
Kestra Now Has Seven Known Flaws, None Fixed in Any Stable Build
InfrastructureDevelopmentSecurity
Critical Kestra flaws (CVE-2026-53576/49869): an unauthenticated attacker bypasses login and runs commands as root, taking over the host. The orchestration platform is used by 30,000+ orgs. Update to 1.3.24.
2026.06.2750 views
News
mise Security: Entering a Repo Folder Can Run an Attacker's Command — Keep It Updated
SecurityDevelopment
Critical mise flaws (CVE-2026-33646/55441): entering a malicious repo folder or tab-completing a task runs an attacker's command on your machine. The dev-environment manager's trust check is bypassed. Update to 2026.6.4.
2026.06.2747 views
News
Code-execution flaw in ad server Revive Adserver (CVE-2026-50741): update to 6.0.8
SecurityDevelopment
Revive Adserver, the open-source software for self-hosting ad delivery, has a server-takeover flaw, CVE-2026-50741 (CVSS 8.8). A low-privileged login account can run arbitrary programs, and it is a recurrence that bypasses June's fix for CVE-2026-34916. It is exploitable via the type parameter and the ox.setChannelTargeting XML-RPC method. Versions up to 6.0.7 are affected; update to 6.0.8.
2026.06.2659 views
News
Max-Severity Flaw in Manufacturers' Design-Data Software PTC Windchill: Patch Now (CVE-2026-12569)
SecurityInfrastructure
PTC Windchill and FlexPLM, the design-data software used across automotive, electronics and other manufacturing, has a max-severity flaw allowing unauthenticated remote takeover. Germany's BSI warned admins at night, and attacks are reported underway. U.S. CISA set a June 28 deadline; apply the fix.
2026.06.2662 views
