News
CVE-2026-48188: OTRS Helpdesk Auth Bypass, No Login Needed (Fix 2026.4.X)
SecurityPrivacy
CVE-2026-48188 (CVSS 9.1) lets attackers break into the OTRS helpdesk with no login via unauthenticated SQL injection, but only when MySQL/MariaDB runs in NO_BACKSLASH_ESCAPES mode. Fixed in OTRS 2026.4.X; the end-of-life Community Edition 6.0.x is most at risk.
2026.06.0183 views
News
Casdoor SSO Auth Bypass (CVE-2026-9090 to 9098): No Patch Yet, Here Is How to Lock It Down Now
SecurityPrivacy
If your organization self-hosts Casdoor as its SSO login server, you are affected: CERT/CC disclosed nine authentication-bypass flaws (CVE-2026-9090 to 9098, VU#780781) in v2.362.0 and earlier that let an attacker log in as any user or admin. There is still no patch as of June 22, 2026, so the fix is operational: restrict the IdPs Casdoor accepts to trusted ones and audit your accounts now.
2026.06.01111 views
News
OpenCATS candidate-data flaw fixed in v0.10.0 (CVE-2026-49489)
SecurityPrivacy
OpenCATS (<=0.9.7.4) has SQL injection flaw CVE-2026-49489 (CVSS 8.5): any logged-in user can dump the candidate database. A public exploit exists; no fix yet.
2026.05.3151 views
News
Japan's Joh-Pla Act: 5 Platforms on a 7-Day Deletion Clock
Lawsuits & RegulationPrivacyGlobal Companies
Japan's Joh-Pla Act (in force since April 2025) makes Google, Meta, X, TikTok and LINE Yahoo decide on defamation-deletion requests within 7 days. Corporate fines reach 100M yen. A year in, what changed?
2026.05.19119 views
News
Why LinkedIn scans 6,000+ Chrome extensions on every page load (2026)
SecurityPrivacyGlobal Companies
LinkedIn has been scanning 6,236 Chrome extensions on every page load while collecting device telemetry. German nonprofit Fairlinked published technical evidence, independently verified by BleepingComputer.
2026.04.0579 views
