News
i18next Add-ons i18next-fs-backend and i18next-http-middleware: Two Unauthenticated Flaws, Fixed in 2.6.6 / 3.9.7
SecurityDevelopment
Two companion components of i18next, the JavaScript library widely used to translate web app UIs, have 9.1 flaws (CVE-2026-48713 / 48714). With no login, an attacker can poison the app's shared foundation, chaining to bypassed login checks or service outages. Update to 2.6.6 / 3.9.7.
2026.06.1646 views
News
WordPress Plugin Vulnerabilities: Easy Invoice and GeekyBot Are Fixed in the Latest Versions
DevelopmentSecurity
In June 2026, dozens of WordPress plugins disclosed critical flaws leading to site takeover or data theft. The invoicing plugin Easy Invoice and the chatbot GeekyBot are rated a maximum 10.0, and a dozen-plus form-integration plugins are exploitable with no login. If your site uses an affected plugin, update each one to the latest version now.
2026.06.1633 views
News
Spring AI Vector Store Query Injection: Affected Versions and the Safe Update
AIDevelopmentSecurity
Spring AI, a popular Java framework for building generative-AI apps, has an 8.6 flaw (CVE-2026-47835) in its vector database integrations. Special characters let an attacker run unauthorized queries against Elasticsearch and others with no login, risking data exfiltration. Fixed in 1.0.9 / 1.1.8; developers should update now.
2026.06.1682 views
News
No attacks on Cisco SD-WAN's five new flaws, and CVE-2026-20310 is 9.1 not 9.9
SecurityGlobal CompaniesInfrastructure
Cisco Catalyst SD-WAN Manager, the system that centrally manages a company's WAN, has a vulnerability already confirmed to be exploited (CVE-2026-20262). With just a low-privileged login, an attacker can overwrite server files and seize root. Fixed releases are out; affected organizations should update now.
2026.06.1653 views
News
Takeover Flaw in the PAM Tool Fortra BoKS: CVE-2026-9862, Update to s-9.0.0.5 / s-8.1.0.23 Now
Global CompaniesSecurityInfrastructure
Fortra Core Privileged Access Manager (BoKS), used to centrally manage admin access across server fleets, has a 9.8 flaw (CVE-2026-9862). With no login, an attacker on the internal network can take over the central server and seize company-wide privilege. Fixed releases s-9.0.0.5 and s-8.1.0.23 are out; affected orgs should update now.
2026.06.1654 views
News
Max-Severity Takeover Flaw in a WooCommerce Invoice Plugin: CVE-2026-52704, Update to 2.0.9 Now
SecurityDevelopment
WooCommerce PDF Invoice Builder, a popular plugin for generating invoice PDFs on WordPress stores, has a max-severity flaw (CVE-2026-52704, scored 10.0). With no login required, anyone can take over the shop's server over the internet. The fixed version 2.0.9 is out; update affected stores now.
2026.06.1637 views
News
Takeover Flaw in Foxit's AI PDF Tool: CVE-2026-12057, a Crafted PDF Can Lead to Remote Code Execution
AIGlobal CompaniesSecurity
Foxit AI, the browser-based AI PDF service, has a takeover flaw (CVE-2026-12057, severity 8.6). Feeding it a crafted PDF lets instructions hidden inside the file call out to an external program and run attacker code. Foxit applied a fix on June 15, 2026, and there are no reports of abuse so far.
2026.06.1548 views
Roundup
Hacker and Ransomware Groups Explained: Qilin, Anonymous, and Attacks on Japan
PrivacySecurityLawsuits & Regulation
A guide to the hacker and ransomware groups you see in the news—Qilin, Anonymous, North Korea's Lazarus and more—sorted into four types: ransomware, state-backed, social extortion and hacktivist. Where they came from, who's in them, which famous companies they hit, and what it means for ordinary life, including groups that struck Japan's Asahi, KADOKAWA and local governments.
2026.06.1591 views
Roundup
Asahi Net Profit Falls 36.7% (Confirmed): The Full Ransomware Chain Behind It, From Breach to Earnings
SecurityJapanese CompaniesPrivacy
In June 2026 Asahi Group cut its net-profit outlook from 167.5 billion to 120 billion yen, blaming the September 2025 ransomware attack. We trace the nine-month chain—breach via a VPN device, halted orders and shipping, 115,513 leaked records, the refusal to pay Qilin, and the 47.5-billion-yen hit—and explain what hole was breached and how the company responded.
2026.06.15200 views
News
Is Your Mitsubishi Wi-Fi Air Conditioner Safe? Hard-coded Password Flaw (CVE-2026-5667)
Japanese CompaniesSecurity
Mitsubishi Electric disclosed that many Wi-Fi-enabled home appliances—air conditioners, refrigerators, water heaters, IH cooktops, rice cookers and more—shipped with a hard-coded password (CVE-2026-5667). Appliances left with Wi-Fi on but never connected to a home router can let a nearby third party read operating data or change settings. Here are the affected models and what to do now.
2026.06.1591 views
News
LiteSpeed cPanel Plugin: 2nd Takeover Flaw CVE-2026-54420, Fix v2.4.8
SecurityGlobal CompaniesInfrastructure
A second takeover flaw, CVE-2026-54420, hits the LiteSpeed cPanel plugin a month after the first. One cheap plan can seize neighbors' sites. Fix: v2.4.8.
2026.06.1443 views
News
sanitize-html's XSS Bypass and the Fix: Safe on 2.17.4 and Later
SecurityDevelopment
A vulnerability (CVE-2026-44990, CVSS 9.3) was found in sanitize-html, the go-to HTML sanitizer for preventing XSS, using the deprecated <xmp> tag to slip past sanitization. It is downloaded 7M+ times a week; the fix is updating to 2.17.4. Here is how it works and what to check.
2026.06.1368 views
