News
Warp Terminal Security Flaws: Which Version Is Safe to Run
DevelopmentSecurity
Warp, a developer terminal with a built-in AI agent, has four vulnerabilities. CVE-2026-48704 and others, all with severity CVSS 8.6 to 8.8. Merely opening a crafted document, receiving on-screen output, or letting the AI work in a malicious repository can run programs on your computer without intent. Update to the latest build.
2026.06.2556 views
News
Unauthenticated Flaws Pile Up in ML Feature Store Feast: Server Takeover and Arbitrary File Write (CVE-2026-56121 & CVE-2026-23537) — Update to v0.63.0
AISecurity
Feast, a data platform used in AI and machine learning, has a flaw that lets an attacker take over the server without authentication. CVE-2026-56121, with a top-class severity of CVSS 9.8. Versions before 0.63.0 are affected; a single crafted request from outside can run arbitrary code on the server running Feast. Update to 0.63.0 now.
2026.06.2538 views
News
Many Flaws in Capacitor Live-Update Service Capgo (CVE-2026-56237 and More) — Update to v12.128.2 Now
DevelopmentSecurity
Capgo, a service that updates a mobile app's contents instantly without app-store review, has been found to contain many vulnerabilities from weak authentication. CVE-2026-56237 and others; the most severe is CVSS 9.1. Attackers could take over accounts and organizations and tamper with the updates pushed to apps. Versions 12.128.1 and earlier are affected; update to 12.128.2 or later.
2026.06.2447 views
News
Ultimate Member Admin-Takeover Flaw: Safe From Version 2.12.0 On
DevelopmentSecurity
Ultimate Member, a membership-site plugin used by over 200,000 sites, has a flaw letting a Contributor-level user take over an administrator. CVE-2026-7761, severity CVSS 8.8. Versions 2.11.4 and earlier are affected; update to the latest 2.12.0. An attacker can steal the admin's password reset link and seize the entire site.
2026.06.2460 views
News
GeoVision GV-I/O Box 4E Takeover Flaws Are Fixed in Firmware v2.12
SecurityInfrastructure
GeoVision's GV-I/O Box 4E, a device that controls alarms and electric locks alongside surveillance cameras, has 8 vulnerabilities allowing remote takeover without a password. The top severity is CVSS 10.0. Firmware 2.09 is affected; update to the fixed v2.12. Left unpatched, the device can become a stepping stone for attacks or network intrusion.
2026.06.2485 views
News
Style Dictionary: 5.4.4 Isn't Enough, Update to 5.5.1 (CVE-2026-54639)
SecurityDevelopment
Style Dictionary, the popular tool that turns design tokens (colors, spacing) into code, has a high-severity flaw, CVE-2026-54639 (8.8). A crafted token can pollute the shared object prototype during a build, cascading to a poisoned build, outages, or worse. Versions 4.3.0 to 5.4.3 are affected. Update to 5.4.4 — and here's who actually needs to worry.
2026.06.2460 views
News
Money Forward: ~62,901 records may have leaked — personal data left on GitHub
SecurityJapanese Companies
Up to 62,901 people's personal data may have leaked at Money Forward, maker of popular budgeting and accounting software. The cause was not a software flaw but a credential leak into GitHub plus personal-data files mistakenly stored there; the production DB was safe. What leaked, why it happened, and what we can learn — tracked with follow-ups.
2026.06.2465 views
News
ManageEngine CVE-2026-11374: Hard to Exploit, but Patching Isn't Enough
DevelopmentSecurity
Unauthenticated account takeover hits ManageEngine products integrated with AD360 (CVE-2026-11374, CVSS 9.0), via predictable SSO tickets. Update now.
2026.06.2375 views
News
KDDI email breach: count corrected to 12,231,954 and resets are done
Japanese CompaniesPrivacySecurity
KDDI's ISP email system was breached, possibly exposing up to 14.22M email addresses and passwords. @nifty, BIGLOBE and more affected. Here's what to do now.
2026.06.2364 views
News
expr-eval Code Injection via toJSFunction (CVE-2026-12866, CVSS 9.8): Never Pass Untrusted Input, Move to expr-eval-fork
SecurityDevelopment
A critical code-injection flaw (CVE-2026-12866, CVSS 9.8) affects expr-eval, a JavaScript math-expression library with 800k+ weekly downloads used in AI and NLP apps. Its toJSFunction() compiles input via new Function(), so untrusted expressions run as code. Stop passing untrusted input and move to expr-eval-fork.
2026.06.2342 views
News
FastStone CVE-2026-30040/30041: 8.5 is out, but no confirmed fix
Security
FastStone Image Viewer (8.3.0.0 and earlier), a free image viewer, has two flaws (CVE-2026-30040 / 30041) that let a crafted image take over a PC; the former triggers from automatic thumbnail generation alone. The vendor is unreachable and no patch exists, so mitigations — not processing untrusted images — are essential.
2026.06.2365 views
News
Windows BitLocker Bypass Flaw YellowKey: Fix Status and What to Do
LinuxSecurity
A flaw (CVE-2026-45585, 'YellowKey') abuses the Windows recovery environment WinRE to defeat BitLocker disk encryption and the UEFI/BIOS password in minutes with physical access and one USB stick. It breaks the 'encrypted, so safe' premise for lost or stolen PCs. Microsoft fixed it in the June 2026 update — apply it now.
2026.06.23104 views
