https://skopnix.com/news/449ec06352ad-bitget-blames-north-korea-for-3875m-crypto-wallet-raid skopnix en 2026-09-25T17:04:07.000Z Bitget blames North Korea for $387.5M crypto wallet raid https://skopnix.com/news/CVE-2026-921-ghsa-g7vj-c29h-3h5m-friendsofflarum-oauth-unauthenticated-ac skopnix en 2026-09-25T15:55:07.000Z GHSA-g7vj-c29h-3h5m: FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider https://skopnix.com/news/74ab0bc29886-storm-3168-agentic-driven-cloud-attacks-using-compromised-se skopnix en 2026-09-25T15:35:08.000Z Storm-3168: Agentic-driven cloud attacks using compromised service principals https://skopnix.com/news/CVE-2026-574-ghsa-v65j-hff3-753c-mediawiki-embedvideo-extension-has-store skopnix en 2026-09-25T15:03:43.000Z GHSA-v65j-hff3-753c: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled https://skopnix.com/news/CVE-2026-618-ghsa-qxg3-46rw-79j8-code16-sharp-vulnerable-to-stored-xss-vi skopnix en 2026-09-25T15:02:11.000Z GHSA-qxg3-46rw-79j8: code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute https://skopnix.com/news/8b1ba443ae92-bitget-says-suspected-north-korean-hackers-stole-3516m-after skopnix en 2026-09-25T10:35:55.000Z Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise https://skopnix.com/news/CVE-2026-488-roundcube-pre-auth-sql-injection-flaw-actively-exploited-in skopnix en 2026-09-25T10:14:02.000Z Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild https://skopnix.com/news/6a804f54cfab-salesbleed-flaws-in-salesforce-agentforce-enabled-zero-click skopnix en 2026-09-25T09:27:51.000Z ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration https://skopnix.com/news/CVE-2026-571-ghsa-3c93-f73f-qc9h-social-auth-core-vk-app-backend-accepts skopnix en 2026-09-24T19:57:22.000Z GHSA-3c93-f73f-qc9h: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing https://skopnix.com/news/CVE-2026-571-ghsa-r4vp-3vw6-r2x5-trestle-is-vulnerable-to-arbitrary-file skopnix en 2026-09-24T19:52:34.000Z GHSA-r4vp-3vw6-r2x5: Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix o https://skopnix.com/news/CVE-2026-597-ghsa-3cj3-hqcr-g934-cline-cross-origin-websocket-hijacking-i skopnix en 2026-09-24T19:48:34.000Z GHSA-3cj3-hqcr-g934: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint) https://skopnix.com/news/CVE-2026-618-ghsa-36h5-qg4p-q2qf-zbatesonmail-mime-parser-has-crlf-header skopnix en 2026-09-24T19:46:32.000Z GHSA-36h5-qg4p-q2qf: zbateson/mail-mime-parser has CRLF header injection via attachment filename https://skopnix.com/news/CVE-2026-618-ghsa-f6v3-2qmr-vfjx-zbatesonmail-mime-parser-has-uncontrolle skopnix en 2026-09-24T19:45:05.000Z GHSA-f6v3-2qmr-vfjx: zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME https://skopnix.com/news/CVE-2026-617-ghsa-jmg2-rcxh-w8q3-rsdoctorrspack-plugin-has-unauthenticate skopnix en 2026-09-24T19:42:10.000Z GHSA-jmg2-rcxh-w8q3: @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata https://skopnix.com/news/CVE-2026-572-ghsa-4hq8-gpf5-8p68-podman-malformed-image-can-trick-podman skopnix en 2026-09-24T19:40:20.000Z GHSA-4hq8-gpf5-8p68: Podman: Malformed Image can trick podman run into leaking host environment variables into the container https://skopnix.com/news/CVE-2026-617-ghsa-mwwr-p57h-56pf-bytebasedbhubs-read-only-mode-does-not-p skopnix en 2026-09-24T19:37:59.000Z GHSA-mwwr-p57h-56pf: @bytebase/dbhub's read-only mode does not prevent database writes https://skopnix.com/news/CVE-2026-617-ghsa-fm8p-53ww-hf6w-dbhub-http-transport-dns-rebinding-allow skopnix en 2026-09-24T19:36:57.000Z GHSA-fm8p-53ww-hf6w: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution https://skopnix.com/news/CVE-2026-617-ghsa-cjx3-73hr-rpw7-http4s-scala-xml-has-an-xml-external-ent skopnix en 2026-09-24T19:35:16.000Z GHSA-cjx3-73hr-rpw7: http4s-scala-xml has an XML External Entity (XXE) processing issue https://skopnix.com/news/CVE-2026-567-ghsa-36f9-7rg5-cpf8-bsvwallet-toolbox--client--mobile-dont-v skopnix en 2026-09-24T19:32:00.000Z GHSA-36f9-7rg5-cpf8: `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against c https://skopnix.com/news/CVE-2026-567-ghsa-rw77-vq4g-x3hp-phpmyfaq-has-sql-injection-in-stopwordsa skopnix en 2026-09-24T19:30:07.000Z GHSA-rw77-vq4g-x3hp: phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion https://skopnix.com/news/CVE-2026-567-ghsa-8gpw-xvpf-hvx5-phpmyfaqs-two-factor-authentication-logi skopnix en 2026-09-24T19:29:27.000Z GHSA-8gpw-xvpf-hvx5: phpMyFAQ's two-factor authentication login bypasses the password factor https://skopnix.com/news/CVE-2026-567-ghsa-pgwp-vc7q-cvj3-phpmyfaq-has-stored-xss-in-admin-faq-edi skopnix en 2026-09-24T19:28:43.000Z GHSA-pgwp-vc7q-cvj3: phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission https://skopnix.com/news/c5b9968833d4-ghsa-g28h-2cmm-rj9x-langchain-nvidia-ai-endpoints-has-local skopnix en 2026-09-24T19:25:36.000Z GHSA-g28h-2cmm-rj9x: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs https://skopnix.com/news/CVE-2026-616-ghsa-w3rp-4cm2-4wgc-ixo-blockchain-xbonds-did-resolved-payer skopnix en 2026-09-24T19:22:53.000Z GHSA-w3rp-4cm2-4wgc: ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass https://skopnix.com/news/CVE-2026-617-ghsa-g5f9-3xfg-p9mf-decepticon-role-boundary-forgery-via-cha skopnix en 2026-09-24T19:17:49.000Z GHSA-g5f9-3xfg-p9mf: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM cont https://skopnix.com/news/CVE-2026-634-ghsa-396x-xmvh-p563-snipe-it-stored-xss-via-inline-xml-rende skopnix en 2026-09-24T18:19:38.000Z GHSA-396x-xmvh-p563: Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API https://skopnix.com/news/CVE-2026-850-ghsa-9993-rfwp-rhwf-zitadel-mfa-bypass-via-session-reuse-in skopnix en 2026-09-24T18:19:35.000Z GHSA-9993-rfwp-rhwf: ZITADEL: MFA bypass via session reuse in Login V2 https://skopnix.com/news/CVE-2026-850-ghsa-fgmf-7rf8-m6vf-zitadel-actions-v1-sandbox-escape-host-f skopnix en 2026-09-24T18:19:32.000Z GHSA-fgmf-7rf8-m6vf: ZITADEL: Actions V1 sandbox escape: host file read via require() https://skopnix.com/news/CVE-2026-623-ghsa-p9h3-gvpq-5539-snipe-it-stored-xss-via-custom-field-nam skopnix en 2026-09-24T18:19:30.000Z GHSA-p9h3-gvpq-5539: Snipe-IT: Stored XSS via Custom Field name in asset-list column headers https://skopnix.com/news/CVE-2026-591-ghsa-6rf4-v2fh-m6p4-suneditor-critical-xss-vulnerability---s skopnix en 2026-09-24T14:57:55.000Z GHSA-6rf4-v2fh-m6p4: SunEditor: Critical XSS vulnerability - sanitizer bypass https://skopnix.com/news/54c1206098ba-kyiv-internet-providers-report-major-outages-after-russian-a skopnix en 2026-09-24T13:30:00.000Z Kyiv internet providers report major outages after Russian attacks damage data centers https://skopnix.com/news/8ae4194eda2b-hackers-now-exploit-critical-roundcube-flaw-in-code-injectio skopnix en 2026-09-24T13:27:57.000Z Hackers now exploit critical Roundcube flaw in code injection attacks https://skopnix.com/news/da7f985e1c2e-one-week-five-flaws-same-weak-point-the-management-layer skopnix en 2026-09-24T13:15:42.000Z One Week, Five Flaws, Same Weak Point: The Management Layer https://skopnix.com/news/CVE-2024-455-when-business-email-compromise-starts-rewriting-reality skopnix en 2026-09-24T13:00:00.000Z When Business Email Compromise Starts Rewriting Reality https://skopnix.com/news/f90f2426c716-openai-agent-breached-australian-government-health-website-a skopnix en 2026-09-24T12:30:00.000Z OpenAI agent breached Australian government health website, Albanese says https://skopnix.com/news/849a3d02ea1a-cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw skopnix en 2026-09-24T10:42:37.000Z CISA: Ransomware gangs now exploiting critical TeamCity flaw https://skopnix.com/news/CVE-2026-820-ncsc-2026-0393-100-mh-kwetsbaarheden-verholpen-in-adobe-camp skopnix en 2026-09-24T06:43:17.000Z NCSC-2026-0393 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic https://skopnix.com/news/639e8904565a-closedquorum-the-malware-that-asks-four-ai-models-what-to-do skopnix en 2026-09-24T05:44:13.000Z CLOSEDQUORUM, the malware that asks four AI models what to do next https://skopnix.com/news/9df47e688838-your-security-program-knows-about-the-firewall-but-does-it-k skopnix en 2026-09-24T04:30:14.000Z Your security program knows about the firewall, but does it know about the elevator? https://skopnix.com/news/CVE-2026-566-ghsa-9643-4qgh-g8mx-elysia-has-inefficient-algorithmic-compl skopnix en 2026-09-23T21:54:50.000Z GHSA-9643-4qgh-g8mx: elysia has Inefficient Algorithmic Complexity and Interpretation Conflict https://skopnix.com/news/CVE-2026-616-ghsa-wmw4-mw6x-6vfm-reactpress-has-sql-injection-via-dynamic skopnix en 2026-09-23T21:51:59.000Z GHSA-wmw4-mw6x-6vfm: ReactPress has SQL injection via dynamic column names in TypeORM query builders https://skopnix.com/news/CVE-2026-773-ghsa-gvf2-2rh5-mpgf-openc3-cosmos-stored-cross-user-xss-via skopnix en 2026-09-23T21:24:11.000Z GHSA-gvf2-2rh5-mpgf: OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget https://skopnix.com/news/CVE-2026-824-ghsa-9wh6-9hq7-9688-klever-go-validator-registration-accepts skopnix en 2026-09-23T21:24:08.000Z GHSA-9wh6-9hq7-9688: Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS https://skopnix.com/news/CVE-2026-824-ghsa-7c7c-373r-gfjj-klever-go-elasticsearch-bulk-painless-in skopnix en 2026-09-23T21:24:06.000Z GHSA-7c7c-373r-gfjj: Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery https://skopnix.com/news/CVE-2026-824-ghsa-26r5-4mm2-px5c-klever-go-zombie-order-theft-buy-missing skopnix en 2026-09-23T21:24:03.000Z GHSA-26r5-4mm2-px5c: Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace https://skopnix.com/news/CVE-2026-760-ghsa-9rg8-2wvr-fgjh-formie-missing-authorization-on-sent-not skopnix en 2026-09-23T21:24:01.000Z GHSA-9rg8-2wvr-fgjh: Formie: Missing authorization on sent notification resend modal exposes submission PII https://skopnix.com/news/CVE-2026-618-ghsa-w4cm-gvhj-cgw6-jawn-quadratic-parsing-effort-in-asyncpa skopnix en 2026-09-23T21:23:58.000Z GHSA-w4cm-gvhj-cgw6: Jawn: Quadratic parsing effort in AsyncParser https://skopnix.com/news/CVE-2026-599-ghsa-cc4v-rvgp-2pf3-jawn-uncontrolled-nesting-depth-in-json skopnix en 2026-09-23T21:23:54.000Z GHSA-cc4v-rvgp-2pf3: Jawn: Uncontrolled nesting depth in JSON parser