News
Just opening a repo in Cursor can hijack a Windows PC: CVE-2026-63093, and there's still no official fix
DevelopmentAISecurity
A flaw in the Windows version of Cursor, the AI code editor used by over 7 million developers, can let attackers run code on your PC just by getting you to open a booby-trapped repository. Tracked as CVE-2026-63093 (severity 8.8), it has no published fixed version — Cursor calls it out of scope, so users must protect themselves for now.
2026.07.1849 views
News
Critical flaw in Spring Authorization Server (CVE-2026-22752): a crafted client registration can lead to impersonation and data theft — update to 7.0.5 / 1.5.7
SecurityDevelopment
A critical flaw, CVE-2026-22752 (CVSS 9.6), has been disclosed in Spring Authorization Server, the Java foundation used for login integration in enterprise systems. When Dynamic Client Registration is enabled, crafted data can lead to impersonation, privilege escalation, and internal probing. The fix is to update to 7.0.5 or 1.5.7, or to disable dynamic registration.
2026.07.1650 views
News
Three popular WordPress plugins hit by admin-takeover flaws, including a translation tool on 1M+ sites (CVE-2026-15005 and more) — update now (July 16, 2026)
SecurityDevelopment
On July 16, 2026, three popular WordPress plugins were disclosed to carry serious takeover flaws: the translation tool Loco Translate (1M+ installs), the phone-number login plugin Digits, and the funnel builder WPFunnels. All three can let an attacker impersonate an administrator, rated 8.8 out of 10. Updating each plugin to its latest version resolves the risk.
2026.07.1644 views
News
Critical flaw in the WordPress plugin miniOrange SAML SSO (CVE-2026-15013): admin takeover with no password — update to 5.4.4
DevelopmentSecurity
A critical flaw, CVE-2026-15013, was found in the WordPress SSO plugin 'SAML Single Sign On – SSO Login' (miniOrange). An attacker with no password could bypass signature verification, impersonate an administrator, and take over the site. Severity is CVSS 9.8, with 10,000+ installs. We cover updating to 5.4.4 and how to check for compromise.
2026.07.1631 views
News
Signature forgery flaws in node-forge, a JS crypto library with 34M weekly downloads (CVE-2026-33894, CVE-2026-33895): update to 1.4.0
SecurityDevelopment
node-forge, a JavaScript crypto library with about 34.4M weekly downloads, has two signature-forgery flaws (CVE-2026-33894, CVE-2026-33895). An attacker's forged signature could be accepted as genuine, bypassing authentication and code signing. Both are High (CVSS 7.5). We cover how to check exposure and update to 1.4.0.
2026.07.1656 views
News
Two flaws in Tera Term (CVE-2026-58317 and CVE-2026-60060): a malicious SSH server could leak your PC's memory — update to 5.6.2
SecurityDevelopment
Two flaws (CVE-2026-58317, CVE-2026-60060) were found in Tera Term, a popular Japanese tool for connecting to servers. Connecting to a malicious server could leak your PC's memory or crash the app. Severity is medium with no observed abuse; we explain who is affected and how to update to 5.6.2.
2026.07.1660 views
News
Tomcat CVE-2026-34486 Is Under Attack: Only Three Builds Affected, Deadline August 7
DevelopmentSecurity
Apache Tomcat flaws CVE-2026-59083 and 59084 show up as a '9.1 (Critical)' in scanners, but Apache itself rates both 'Low' — no real exploitation, not in KEV. We explain calmly why the numbers disagree, whether your setup is affected, and why a routine update is enough.
2026.07.16129 views
News
Info-leak flaw in the Directus data platform (CVE-2026-61836): password-protected shares exposed to others, update to v12
SecurityDevelopment
Directus, the open-source data platform, has an info-leak flaw (CVE-2026-61836, CVSS 8.6). Without a login, even password-protected share links can be exposed to unrelated third parties. Only environments combining the cache with share links are affected. Fixed in 12.0.0 — update now if it applies.
2026.07.1653 views
News
Argo CD's Default Config Lets an Insider Hijack Your Whole Kubernetes Cluster — CVE-2026-15416, Update the Chart to v10.0.0
DevelopmentInfrastructureSecurity
A flaw in Argo CD lets an attacker with a foothold inside the network take over the entire server platform it manages. CVE-2026-15416, rated 8.9 out of 10. Used by roughly half of all GitOps shops, it needs the distribution chart updated to v10.0.0, or the traffic-restriction setting turned on.
2026.07.1472 views
Roundup
For 3 Years, a Game Sent Your "Number" Out: How Identifiers Leak From App Tracking Tags, and How to Prevent It
DevelopmentSecurity
Using LY Corporation's mis-transmission of ~7.1M user identifiers from three games (LINE Pokopoko and others) to an external ad tool as an entry point, we explain why identifying information leaks from an app's tracking tags and how to prevent unintended data transmission in development — what an internal identifier is, why it matters without names or phone numbers, the data-governance gap that hid it for 3y10m, plus a developer checklist and what users can do.
2026.07.1432 views
News
28 Takeover Flaws Hit WordPress Add-ons at Once, Two of Them a Perfect 10.0 — Full Plugin List and Fixes (July 13, 2026)
DevelopmentSecurity
On the night of July 13, 2026, 28 dangerous flaws were disclosed at once in WordPress add-ons (plugins and themes). Sixteen are rated 9.0 or higher, two of them a worst-case 10.0, and many allow site takeover or member-data theft with no login. Affected products include the booking plugins Amelia and LatePoint and the widely bundled Kirki. Check the list for what you use and see what to do now.
2026.07.1372 views
News
PraisonAI gets four more CVEs, one at 10.0, all fixes shipped
SecurityDevelopmentAI
PraisonAI, a popular tool for delegating work to AI, has five flaws including the max-severity (10.0) CVE-2026-61447. A single crafted AI instruction can run malicious code on the server and steal secrets like API keys. Past PraisonAI flaws were attacked within hours of disclosure. Update both packages now.
2026.07.1155 views
