News
Goobi Viewer Hit by Unauthenticated CVE-2026-45083: Digital Archives At Risk
SecurityInfrastructureDevelopment
CVE-2026-45083 (CVSS 9.8) lets unauthenticated network clients send arbitrary Solr streaming expressions to Goobi viewer, the digital archive platform widely used by libraries, museums and research institutions. Versions 4.8.0 through 26.04.0 are affected; the broken endpoint was removed in 26.04.1.
2026.05.2816 views
News
Two Unauthenticated RCEs in Pi.Alert: CVE-2026-44887 / 44888 Hit Home Network Watchers
SecurityLinuxInfrastructure
Pi.Alert, the home/SOHO Wi-Fi and LAN intruder detector, ships with two unauthenticated RCE flaws (CVE-2026-44887/44888, both CVSS 9.8). Web protection is disabled by default, letting any attacker write Python code into pialert.conf which the scan daemon then loads via exec(). Patched in the 2026-05-07 release.
2026.05.2816 views
News
Three Critical Flaws Hit Gladinet Triofox: CVE-2026-8362 / 8363 / 8364, Enterprise File Sharing At Risk
Global CompaniesSecurityInfrastructure
Tenable Research disclosed three critical unauthenticated RCE vulnerabilities (CVE-2026-8362/8363/8364, all CVSS 9.8) in Gladinet Triofox enterprise file sharing on May 27, 2026. Versions up to 17.1.10488.57063 are vulnerable; fixed in 17.3.10565.57509.
2026.05.2823 views
News
Budibase Hit by Five Critical Authz Flaws: CVE-2026-46425 et al., Update to v3.39.0
AISecurityDevelopment
Five critical authorization and SSRF vulnerabilities in the Budibase low-code platform (CVE-2026-46425/48150/45716/45717/48153, CVSS 9.9 to 8.5) were disclosed on May 27, 2026. Issues range from SCIM router bypass to tenant-wide privilege escalation to global admin. Fixed in v3.39.0.
2026.05.2816 views
News
XSS Scanner Dalfox Hit by Unauthenticated RCE: CVE-2026-45087 (CVSS 10.0)
DevelopmentSecurity
Dalfox, the XSS scanner widely used by bug-bounty hunters, exposes an unauthenticated RCE in REST API server mode (CVE-2026-45087, CVSS 10.0). Versions up to 2.12.0 bind 0.0.0.0:6664 with no API key and accept shell commands via JSON. Update to v2.13.0 immediately.
2026.05.285 views
News
free5GC Hit by Five Critical Auth Bypass Flaws: CVE-2026-44315/26/27/29/30
InfrastructureDevelopmentSecurity
Five critical OAuth2 authorization bypass vulnerabilities (CVE-2026-44315/26/27/29/30, three at CVSS 10.0) hit the free5GC 5G core network implementation in versions up to v4.2.1. NEF and SMF API routes accept unauthenticated read/write/delete. Fixed in v4.2.2.
2026.05.289 views
News
From TanStack to Nx Console: Chained Supply-Chain Attack CVE-2026-45321 / CVE-2026-48027
AIDevelopmentSecurity
Two CISA KEV-listed npm and VS Code supply-chain breaches in May 2026 turned out to be one connected attack. CVE-2026-45321 hit 84 versions across 42 @tanstack/* packages on May 11; stolen GitHub credentials from that leak then powered CVE-2026-48027, the malicious Nx Console v18.95.0 push on May 18.
2026.05.2828 views
News
LibVNCClient Flaw CVE-2026-44988: Malicious VNC Server Can Hijack Your PC On Connect
SecurityDevelopmentLinux
CVE-2026-44988 (CVSS 8.8) hits LibVNCClient v0.9.15 and earlier. A malicious VNC server can send crafted framebuffer-update rectangles to overwrite memory on the connecting client, leading to potential RCE. Remmina, KRDC, ZoneMinder and other downstream projects are affected. No tagged release with the fix has shipped yet.
2026.05.2817 views
News
IBM Aspera Hit by Two asperahttpd Buffer Overflows: CVE-2026-8175 / CVE-2026-8179
SecurityInfrastructure
IBM disclosed two critical buffer overflow vulnerabilities in Aspera High-Speed Transfer Server and Endpoint on May 21, 2026: CVE-2026-8175 (heap BOF, CVSS 9.8, unauthenticated) and CVE-2026-8179 (stack BOF, CVSS 8.8, authenticated). Used by broadcasters, media, and large enterprises worldwide.
2026.05.2839 views
News
Critical Langflow Flaw CVE-2026-7524: TAR Symlinks Leak JWT Secret, Chain to RCE
SecurityDevelopmentAI
IBM disclosed CVE-2026-7524 (CVSS 9.8) in Langflow OSS on May 27, 2026. Versions 1.0.0 through 1.9.1 are vulnerable: a crafted tar with symlinks can steal the JWT secret, forge tokens, then chain to RCE via Python Interpreter nodes. Update to v1.9.2 or later immediately.
2026.05.2815 views
Lab Updated 3 days ago
CISA KEV Dashboard in Japanese — Browse the Actively Exploited Catalog
InfrastructureSecurity
Browse CISA's Known Exploited Vulnerabilities catalog (1,603 entries) in a Japanese-localized dashboard: full-text search, vendor filtering, Japan-market vendor filter, and ransomware-related extraction. Free, browser-only, no signup. Each CVE deep-links to NVD and our incident articles.
2026.05.2710 views
Lab
OSS Supply Chain Scanner — paste package.json, requirements.txt, pyproject.toml
SecurityDevelopment
Paste a package.json, requirements.txt, or pyproject.toml and instantly check your dependencies against OSV.dev's vulnerability database. Free, browser-only, no signup. Supports npm, pip, Poetry, uv, and Rye. Built as a hub for our axios, LiteLLM, Trivy, and GlassWorm supply chain coverage.
2026.05.279 views
