https://skopnix.com/news/CVE-2026-574-ghsa-q986-4x7x-gx39-scbe-aethermoore-unauthenticated-aetherb skopnix en 2026-09-25T21:48:03.000Z GHSA-q986-4x7x-gx39: SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests https://skopnix.com/news/6073b2d64854-ghsa-vj8p-hp9x-gh47-mpp-vulnerable-to-gas-draining-with-low skopnix en 2026-09-25T21:47:36.000Z GHSA-vj8p-hp9x-gh47: mpp vulnerable to Gas Draining with low gas limit https://skopnix.com/news/CVE-2026-100-ghsa-wrvw-254r-wpmv-cliinvokespecializations-has-command-inj skopnix en 2026-09-25T21:41:48.000Z GHSA-wrvw-254r-wpmv: CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers https://skopnix.com/news/CVE-2026-100-ghsa-j73w-8hfr-4gc9-cliinvoke-argument-injection-in-extensib skopnix en 2026-09-25T21:41:36.000Z GHSA-j73w-8hfr-4gc9: CliInvoke: Argument Injection in Extensibility Runner Factory https://skopnix.com/news/bdcdb2d24781-kiteworks-urges-6-hour-server-shutdown-over-potential-zero-d skopnix en 2026-09-25T21:41:07.000Z Kiteworks urges 6-hour server shutdown over potential zero-day attacks https://skopnix.com/news/ceecedb340d7-ghsa-62mm-xwmv-crhg-khoj-has-an-unauthenticated-path-travers skopnix en 2026-09-25T21:38:15.000Z GHSA-62mm-xwmv-crhg: khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem https://skopnix.com/news/483bc5c8d70e-ghsa-29h2-jr22-frmh-openzeppelin-confidential-contracts-vest skopnix en 2026-09-25T19:31:08.000Z GHSA-29h2-jr22-frmh: OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract https://skopnix.com/news/449ec06352ad-bitget-blames-north-korea-for-3875m-crypto-wallet-raid skopnix en 2026-09-25T17:04:07.000Z Bitget blames North Korea for $387.5M crypto wallet raid https://skopnix.com/news/CVE-2026-921-ghsa-g7vj-c29h-3h5m-friendsofflarum-oauth-unauthenticated-ac skopnix en 2026-09-25T15:55:07.000Z GHSA-g7vj-c29h-3h5m: FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider https://skopnix.com/news/74ab0bc29886-storm-3168-agentic-driven-cloud-attacks-using-compromised-se skopnix en 2026-09-25T15:35:08.000Z Storm-3168: Agentic-driven cloud attacks using compromised service principals https://skopnix.com/news/CVE-2026-574-ghsa-v65j-hff3-753c-mediawiki-embedvideo-extension-has-store skopnix en 2026-09-25T15:03:43.000Z GHSA-v65j-hff3-753c: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled https://skopnix.com/news/CVE-2026-618-ghsa-qxg3-46rw-79j8-code16-sharp-vulnerable-to-stored-xss-vi skopnix en 2026-09-25T15:02:11.000Z GHSA-qxg3-46rw-79j8: code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute https://skopnix.com/news/8b1ba443ae92-bitget-says-suspected-north-korean-hackers-stole-3516m-after skopnix en 2026-09-25T10:35:55.000Z Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise https://skopnix.com/news/CVE-2026-488-roundcube-pre-auth-sql-injection-flaw-actively-exploited-in skopnix en 2026-09-25T10:14:02.000Z Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild https://skopnix.com/news/6a804f54cfab-salesbleed-flaws-in-salesforce-agentforce-enabled-zero-click skopnix en 2026-09-25T09:27:51.000Z ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration https://skopnix.com/news/CVE-2026-571-ghsa-3c93-f73f-qc9h-social-auth-core-vk-app-backend-accepts skopnix en 2026-09-24T19:57:22.000Z GHSA-3c93-f73f-qc9h: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing https://skopnix.com/news/CVE-2026-571-ghsa-r4vp-3vw6-r2x5-trestle-is-vulnerable-to-arbitrary-file skopnix en 2026-09-24T19:52:34.000Z GHSA-r4vp-3vw6-r2x5: Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix o https://skopnix.com/news/CVE-2026-597-ghsa-3cj3-hqcr-g934-cline-cross-origin-websocket-hijacking-i skopnix en 2026-09-24T19:48:34.000Z GHSA-3cj3-hqcr-g934: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint) https://skopnix.com/news/CVE-2026-618-ghsa-36h5-qg4p-q2qf-zbatesonmail-mime-parser-has-crlf-header skopnix en 2026-09-24T19:46:32.000Z GHSA-36h5-qg4p-q2qf: zbateson/mail-mime-parser has CRLF header injection via attachment filename https://skopnix.com/news/CVE-2026-618-ghsa-f6v3-2qmr-vfjx-zbatesonmail-mime-parser-has-uncontrolle skopnix en 2026-09-24T19:45:05.000Z GHSA-f6v3-2qmr-vfjx: zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME https://skopnix.com/news/CVE-2026-617-ghsa-jmg2-rcxh-w8q3-rsdoctorrspack-plugin-has-unauthenticate skopnix en 2026-09-24T19:42:10.000Z GHSA-jmg2-rcxh-w8q3: @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata https://skopnix.com/news/CVE-2026-572-ghsa-4hq8-gpf5-8p68-podman-malformed-image-can-trick-podman skopnix en 2026-09-24T19:40:20.000Z GHSA-4hq8-gpf5-8p68: Podman: Malformed Image can trick podman run into leaking host environment variables into the container https://skopnix.com/news/CVE-2026-617-ghsa-mwwr-p57h-56pf-bytebasedbhubs-read-only-mode-does-not-p skopnix en 2026-09-24T19:37:59.000Z GHSA-mwwr-p57h-56pf: @bytebase/dbhub's read-only mode does not prevent database writes https://skopnix.com/news/CVE-2026-617-ghsa-fm8p-53ww-hf6w-dbhub-http-transport-dns-rebinding-allow skopnix en 2026-09-24T19:36:57.000Z GHSA-fm8p-53ww-hf6w: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution https://skopnix.com/news/CVE-2026-617-ghsa-cjx3-73hr-rpw7-http4s-scala-xml-has-an-xml-external-ent skopnix en 2026-09-24T19:35:16.000Z GHSA-cjx3-73hr-rpw7: http4s-scala-xml has an XML External Entity (XXE) processing issue https://skopnix.com/news/CVE-2026-567-ghsa-36f9-7rg5-cpf8-bsvwallet-toolbox--client--mobile-dont-v skopnix en 2026-09-24T19:32:00.000Z GHSA-36f9-7rg5-cpf8: `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against c https://skopnix.com/news/CVE-2026-567-ghsa-rw77-vq4g-x3hp-phpmyfaq-has-sql-injection-in-stopwordsa skopnix en 2026-09-24T19:30:07.000Z GHSA-rw77-vq4g-x3hp: phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion https://skopnix.com/news/CVE-2026-567-ghsa-8gpw-xvpf-hvx5-phpmyfaqs-two-factor-authentication-logi skopnix en 2026-09-24T19:29:27.000Z GHSA-8gpw-xvpf-hvx5: phpMyFAQ's two-factor authentication login bypasses the password factor https://skopnix.com/news/CVE-2026-567-ghsa-pgwp-vc7q-cvj3-phpmyfaq-has-stored-xss-in-admin-faq-edi skopnix en 2026-09-24T19:28:43.000Z GHSA-pgwp-vc7q-cvj3: phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission https://skopnix.com/news/c5b9968833d4-ghsa-g28h-2cmm-rj9x-langchain-nvidia-ai-endpoints-has-local skopnix en 2026-09-24T19:25:36.000Z GHSA-g28h-2cmm-rj9x: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs https://skopnix.com/news/CVE-2026-616-ghsa-w3rp-4cm2-4wgc-ixo-blockchain-xbonds-did-resolved-payer skopnix en 2026-09-24T19:22:53.000Z GHSA-w3rp-4cm2-4wgc: ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass https://skopnix.com/news/CVE-2026-617-ghsa-g5f9-3xfg-p9mf-decepticon-role-boundary-forgery-via-cha skopnix en 2026-09-24T19:17:49.000Z GHSA-g5f9-3xfg-p9mf: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM cont https://skopnix.com/news/CVE-2026-634-ghsa-396x-xmvh-p563-snipe-it-stored-xss-via-inline-xml-rende skopnix en 2026-09-24T18:19:38.000Z GHSA-396x-xmvh-p563: Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API https://skopnix.com/news/CVE-2026-850-ghsa-9993-rfwp-rhwf-zitadel-mfa-bypass-via-session-reuse-in skopnix en 2026-09-24T18:19:35.000Z GHSA-9993-rfwp-rhwf: ZITADEL: MFA bypass via session reuse in Login V2 https://skopnix.com/news/CVE-2026-850-ghsa-fgmf-7rf8-m6vf-zitadel-actions-v1-sandbox-escape-host-f skopnix en 2026-09-24T18:19:32.000Z GHSA-fgmf-7rf8-m6vf: ZITADEL: Actions V1 sandbox escape: host file read via require() https://skopnix.com/news/CVE-2026-623-ghsa-p9h3-gvpq-5539-snipe-it-stored-xss-via-custom-field-nam skopnix en 2026-09-24T18:19:30.000Z GHSA-p9h3-gvpq-5539: Snipe-IT: Stored XSS via Custom Field name in asset-list column headers https://skopnix.com/news/CVE-2026-591-ghsa-6rf4-v2fh-m6p4-suneditor-critical-xss-vulnerability---s skopnix en 2026-09-24T14:57:55.000Z GHSA-6rf4-v2fh-m6p4: SunEditor: Critical XSS vulnerability - sanitizer bypass https://skopnix.com/news/54c1206098ba-kyiv-internet-providers-report-major-outages-after-russian-a skopnix en 2026-09-24T13:30:00.000Z Kyiv internet providers report major outages after Russian attacks damage data centers https://skopnix.com/news/8ae4194eda2b-hackers-now-exploit-critical-roundcube-flaw-in-code-injectio skopnix en 2026-09-24T13:27:57.000Z Hackers now exploit critical Roundcube flaw in code injection attacks https://skopnix.com/news/da7f985e1c2e-one-week-five-flaws-same-weak-point-the-management-layer skopnix en 2026-09-24T13:15:42.000Z One Week, Five Flaws, Same Weak Point: The Management Layer https://skopnix.com/news/CVE-2024-455-when-business-email-compromise-starts-rewriting-reality skopnix en 2026-09-24T13:00:00.000Z When Business Email Compromise Starts Rewriting Reality https://skopnix.com/news/f90f2426c716-openai-agent-breached-australian-government-health-website-a skopnix en 2026-09-24T12:30:00.000Z OpenAI agent breached Australian government health website, Albanese says https://skopnix.com/news/849a3d02ea1a-cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw skopnix en 2026-09-24T10:42:37.000Z CISA: Ransomware gangs now exploiting critical TeamCity flaw https://skopnix.com/news/CVE-2026-820-ncsc-2026-0393-100-mh-kwetsbaarheden-verholpen-in-adobe-camp skopnix en 2026-09-24T06:43:17.000Z NCSC-2026-0393 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic https://skopnix.com/news/639e8904565a-closedquorum-the-malware-that-asks-four-ai-models-what-to-do skopnix en 2026-09-24T05:44:13.000Z CLOSEDQUORUM, the malware that asks four AI models what to do next https://skopnix.com/news/9df47e688838-your-security-program-knows-about-the-firewall-but-does-it-k skopnix en 2026-09-24T04:30:14.000Z Your security program knows about the firewall, but does it know about the elevator?