News
expr-eval Code Injection via toJSFunction (CVE-2026-12866, CVSS 9.8): Never Pass Untrusted Input, Move to expr-eval-fork
DevelopmentSecurity
A critical code-injection flaw (CVE-2026-12866, CVSS 9.8) affects expr-eval, a JavaScript math-expression library with 800k+ weekly downloads used in AI and NLP apps. Its toJSFunction() compiles input via new Function(), so untrusted expressions run as code. Stop passing untrusted input and move to expr-eval-fork.
2026.06.2342 views
News
SiYuan MCP Endpoint Unauthorized Access: CVE-2026-66012, Fix in v3.7.2
DevelopmentSecurity
SiYuan, the popular open-source note app, has four new takeover flaws (CVE-2026-50551 / 54067 / 54158 / 55570) in its databases, CSS snippets, and marketplace. Three are CVSS 9.9 and one is 9.0. Shared or synced data can trigger them, and updating to 3.6.1 earlier does not cover them. Update to 3.7.0 now.
2026.06.2261 views
News
Server takeover flaw in Prefect (CVE-2026-5366): update to the latest
InfrastructureDevelopmentSecurity
A critical flaw lets attackers run code and take over a server in Prefect, the popular Python tool for automating data pipelines. Rated CVSS 9.9, in shared multi-user setups anyone who can register a job may take over other users' processing too. A fix is out; if you self-host, update urgently.
2026.06.2145 views
News
Flowise: 26 flaws in one day, CVE-2026-70477 — update to 3.1.4+
AIDevelopmentSecurity
Four new critical flaws, including a perfect 10.0, hit Flowise, the popular no-code tool for building AI apps. The worst, CVE-2025-71338, lets an attacker write arbitrary files to the server with no login via a crafted file name and take over on restart — and it has no patch yet. Two are fixed in 3.0.6; two are not. We lay out the fixes and a version-by-version quick reference.
2026.06.2168 views
News
Two Critical Flaws in ProxySQL (CVE-2026-48772 / 48773): Source Spoofing and Pre-Login Memory Corruption, Upgrade to v3.0.9 Now
InfrastructureDevelopmentSecurity
ProxySQL, the widely used proxy in front of MySQL and PostgreSQL, has two critical flaws (CVSS 10.0 and 9.8). Attackers can spoof their source IP to bypass access controls, or crash the server before login. Both need no authentication. Here are the affected versions and how to upgrade to v3.0.9.
2026.06.2068 views
News
JetBrains Hub Hit by Perfect 10.0 Flaw (CVE-2026-50242): Admin Takeover With No Password, Update Now
SecurityDevelopmentGlobal Companies
On June 19, 2026, JetBrains disclosed three critical flaws in its login-management service JetBrains Hub. The most severe, CVE-2026-50242, scores a perfect 10.0: an attacker can bypass identity checks from outside and impersonate an administrator. Fixes are already available.
2026.06.2047 views
Lab
Claude Code vs Codex: Only 1 of 17 Tries Fixed an Unseen Vulnerability
SecurityAIDevelopment
We planted brand-new vulnerabilities that the models had never seen, cut off internet access so they could not look up the answer, and asked Claude Code and Codex to fix them. Across 17 runs, only one actually closed the real hole. Knowing the file was not enough, and a green test suite did not mean the bug was gone.
2026.06.1972 views
News
mcp-pinot, the Bridge Between AI and Your Database, Lets Anyone In: CVE-2026-49257, Update to v3.1.0
SecurityDevelopmentAI
mcp-pinot, the component that connects AI assistants to an analytics database, was left reachable by anyone from the outside at its default settings. CVE-2026-49257 carries the maximum 10.0 severity. An attacker can read and write the database without authentication, risking a full takeover. No-auth holes keep surfacing in the 'MCP servers' that connect AI to external systems; affected v3.0.1 and earlier should be updated to v3.1.0 immediately.
2026.06.1950 views
News
Bitnami Cassandra Images Leave a Default Password Active: CVE-2026-47846, Update Now
DevelopmentSecurityInfrastructure
A flaw in the Bitnami official container images of Apache Cassandra, the popular database that distributes large volumes of data across servers, can leave a well-known default password active. CVE-2026-47846 is rated 9.8 out of 10. Even if you set up your own administrator, an attacker can break in from the outside with the default account and read or write all data. The affected 4.0/4.1/5.0 branches should be updated to a fixed version immediately.
2026.06.1939 views
News
Account Takeover Flaw in AI Agent Tool AutoGPT: CVE-2026-55237, Update to 0.6.62
AIDevelopmentSecurity
A vulnerability in AutoGPT, the well-known tool for building AI agents, can let an attacker hijack a user's account just by getting them to click a crafted link. Published June 18, 2026 as CVE-2026-55237 with a severity of 8.8 out of 10, it affects self-hosted installs. Updating to the latest version, 0.6.62, closes the hole.
2026.06.1955 views
News
Is FFmpeg safe? A run of subtitle, audio & video flaws (CVE-2026-64830 and more) — even 8.1.2 needs another update
DevelopmentSecurity
Is FFmpeg safe to use? In July 2026 four more high-severity flaws were disclosed together in the go-to video software—in subtitle and audio parsing and in hardware video playback (CVE-2026-64830/64831/64832/64835), all rated 8.8, where a single crafted file can lead to code execution. None is fixed by June's 8.1.2 release.
2026.06.19160 views
Lab
Python 3.15: locale.getdefaultlocale Won't Be Removed, Plus Lazy Imports and What Breaks
Development
Hit the "'locale.getdefaultlocale' is deprecated and slated for removal in Python 3.15" warning? Swap it for getlocale()/getencoding() — the replacement code is inside. Plus the rest of 3.15, benchmarked on the beta: lazy imports (~4x faster startup), UTF-8 by default, and the APIs that stop working when you upgrade.
2026.06.17145 views
