News
Two vLLM Flaws: API-Key Bypass (CVE-2026-48746, CVSS 9.1) & Dependency Confusion (CVE-2026-54232) — Update to 0.22.1
AISecurity
vLLM, the go-to engine for self-hosting LLMs, has two critical flaws. CVE-2026-48746 (CVSS 9.1) lets attackers bypass the API key and use the AI API without authentication; CVE-2026-54232 (CVSS 8.8) is a Docker-build dependency confusion that runs code as root. Updating to 0.22.1 resolves both.
2026.06.2351 views
News
Crawl4AI Vulnerabilities: Update to 0.9.2 or Later to Be Safe
AISecurity
Crawl4AI, a popular crawler for AI data collection, has a critical flaw in its Docker API server, exploitable without authentication (CVE-2026-56266). An attacker can make the server fetch cloud internal data and steal access keys. All versions before 0.8.7 are affected; 0.8.7 also fixes several flaws including a pre-auth RCE. Update now.
2026.06.2358 views
News
Dell Wyse Management Suite SQL Injection Flaw and How 2605 Fixes It
Global CompaniesSecurity
Dell Wyse Management Suite, used to centrally manage fleets of thin clients, has a critical flaw (CVSS 8.8, CVE-2026-44272). A low-privileged logged-in attacker can use SQL injection to reach information and operations beyond their rights, risking the management base. All versions before 2605 are affected; update to 2605 now.
2026.06.2333 views
News
ADSys, Ubuntu's Active Directory Tool: Forged-Certificate Flaw Fixed in 0.16.3
LinuxSecurity
ADSys, the official tool for managing Ubuntu under Windows Active Directory, has a critical flaw (CVSS 9.0, CVE-2026-12249). Because certificate auto-enrollment ran over plain HTTP, an attacker on the network can make endpoints trust forged certificates, enabling interception and impersonation. Fixes are out for each Ubuntu release; update now.
2026.06.2339 views
News
Critical RCE in Autodesk Fusion CAD: CVE-2026-10789 (CVSS 9.6) — Update to 2703.1.20
Global CompaniesSecurity
Autodesk Fusion's desktop CAD has a critical flaw (CVSS 9.6, CVE-2026-10789). With the MCP extension enabled, simply opening a malicious web page can run attacker code on your PC, risking design-data theft and full takeover. Versions before 2703.1.20 are affected; update now.
2026.06.2349 views
News
Langflow: all 24 flaws are fixed in 1.11.0, and CVE-2026-19297 makes 25
SecurityAI
Serious flaws in the AI tool Langflow keep coming. On June 30, 2026 IBM disclosed 8 more, led by a CVSS 10.0 code execution that takes over the server with no login or interaction (CVE-2026-10134). Up to 1.10.0 is affected; update to the latest release (1.10.1+) now.
2026.06.23115 views
News
SiYuan MCP Endpoint Unauthorized Access: CVE-2026-66012, Fix in v3.7.2
DevelopmentSecurity
SiYuan, the popular open-source note app, has four new takeover flaws (CVE-2026-50551 / 54067 / 54158 / 55570) in its databases, CSS snippets, and marketplace. Three are CVSS 9.9 and one is 9.0. Shared or synced data can trigger them, and updating to 3.6.1 earlier does not cover them. Update to 3.7.0 now.
2026.06.2261 views
News
Crawl4AI vulnerability coverage has moved to the consolidated article
SecurityInfrastructureAI
A critical flaw lets attackers take over a server without logging in, found in Crawl4AI, the popular tool that feeds web pages into AI. Rated CVSS 9.8, the self-hosted Docker edition baked the 'master key' used to verify users into the product, so anyone can impersonate an administrator. A fix, 0.8.7, is out; if you self-host, update urgently.
2026.06.2245 views
News
Server takeover flaw in Prefect (CVE-2026-5366): update to the latest
InfrastructureDevelopmentSecurity
A critical flaw lets attackers run code and take over a server in Prefect, the popular Python tool for automating data pipelines. Rated CVSS 9.9, in shared multi-user setups anyone who can register a job may take over other users' processing too. A fix is out; if you self-host, update urgently.
2026.06.2145 views
News
Flowise: 26 flaws in one day, CVE-2026-70477 — update to 3.1.4+
AIDevelopmentSecurity
Four new critical flaws, including a perfect 10.0, hit Flowise, the popular no-code tool for building AI apps. The worst, CVE-2025-71338, lets an attacker write arbitrary files to the server with no login via a crafted file name and take over on restart — and it has no patch yet. Two are fixed in 3.0.6; two are not. We lay out the fixes and a version-by-version quick reference.
2026.06.2168 views
News
Two Critical Flaws in ProxySQL (CVE-2026-48772 / 48773): Source Spoofing and Pre-Login Memory Corruption, Upgrade to v3.0.9 Now
InfrastructureDevelopmentSecurity
ProxySQL, the widely used proxy in front of MySQL and PostgreSQL, has two critical flaws (CVSS 10.0 and 9.8). Attackers can spoof their source IP to bypass access controls, or crash the server before login. Both need no authentication. Here are the affected versions and how to upgrade to v3.0.9.
2026.06.2068 views
News
JetBrains Hub Hit by Perfect 10.0 Flaw (CVE-2026-50242): Admin Takeover With No Password, Update Now
SecurityDevelopmentGlobal Companies
On June 19, 2026, JetBrains disclosed three critical flaws in its login-management service JetBrains Hub. The most severe, CVE-2026-50242, scores a perfect 10.0: an attacker can bypass identity checks from outside and impersonate an administrator. Fixes are already available.
2026.06.2047 views
