Tag: application security
43 articles
SAP Cloud SDK Flaw Exposes OAuth2 Credentials to Theft
A critical flaw in SAP's Cloud SDK for Python, rated a perfect 10.0 on the CVSS scale, can be exploited to steal sensitive OAuth2 credentials, putting applications that rely on it at risk. This vulnerability allows attackers to intercept client IDs and secrets, giving them unauthorized access to sensitive data.
GitHub Actions Re-Exposure Leaves Developers Vulnerable
GitHub Actions were recently re-exposed, leaving developers vulnerable to attacks after two compromised third-party actions were re-enabled with malicious code still linked to their release tags. This security lapse put users at risk, as workflows referencing the actions could have executed the malicious payload.
GitLab Exposes Private Email Addresses to Code Push Risks
GitLab's helpful hack for easy bug reporting has turned into a security risk, with researchers discovering that publicly exposed email addresses can be easily manipulated to create unauthorized merge requests. Simply tweaking a few characters in the address can open up a project's inner workings to potential code push risks.
BigCommerce Breach Exposes Merchant Data via Compromised Ribon Apps
Hackers struck BigCommerce by compromising a key held by Ribon, a third-party app, and used it to siphon off customer data - but the e-commerce platform quickly sprang into action to contain the breach. BigCommerce swiftly removed the tainted apps, cut off the hackers' access, and alerted affected merchants to take control of their data.
Microsoft Axes Companion Apps, Shifts Focus to New Authentication Methods
Microsoft is phasing out its 365 companion apps - Calendar, People, and Files - and setting December 16, 2026 as the end-of-life date, after which they'll no longer function or be supported. Admins are advised to remove the apps from devices by then to ensure a seamless transition.
Microsoft Resolves Excel Copy-Paste Issue After Security Updates
Microsoft has fixed a frustrating issue in Excel where copying and pasting data would fail silently, leaving users none the wiser - until now, that is! The problem, which emerged after September's security updates, affected various versions of Excel, including 2016, 2019, 2021, and 2024, as well as Excel Online.
Microsoft Warns of App Crashes on Windows Server 2025
Beware: a recent change in Windows Server 2025's memory management can cause apps to crash, resulting in access violations, memory corruption, or sudden termination. Microsoft is working on a fix, but for now, some applications may be at risk.
Plex Urges Immediate Patching for Multiple Security Vulnerabilities
Plex is urging users to update their media servers and desktop clients ASAP due to multiple security vulnerabilities that could put their data at risk. To stay safe, simply update to Plex Media Server 1.43.3 and Plex Desktop 1.115.0.
Malicious Chrome Extensions Expose Crypto, Browser Data Theft
Malicious Chrome extensions have been caught stealing cryptocurrency and browser data, with a recent investigation uncovering a sophisticated malware campaign that may have been active since early 2024. The attack used 16 distinct modules to deliver a modular malware framework to unsuspecting Chrome and Edge users.
PaperCut Flaws Chained for Remote Code Execution
Researchers have uncovered a vulnerability in PaperCut that allows an unauthenticated attacker to gain remote control, enabling them to execute arbitrary Java code within the application's process. This flaw can be exploited through a clever two-step chaining technique, putting unpatched PaperCut NG and MF instances at risk.
Next.js Patches Flaws Enabling Unauthenticated Remote Code Execution
If your Next.js application is hosted on Windows, upgrade immediately to patch a critical vulnerability that allows unauthenticated remote code execution. This flaw, tracked as CVE-2026-75604, affects apps using both Pages Router and App Router without Cache Components.
Citrix Warns of Two New NetScaler Flaws
Citrix is urging customers to take immediate action to protect their NetScaler ADC and Gateway deployments from two newly discovered vulnerabilities, including a critical authentication bypass flaw that could allow remote attackers to gain unauthorized access. Upgrade to the recommended builds as soon as possible to safeguard your systems.
AI-Driven Development Exposes Surge in Enterprise App Vulnerabilities
The rapid adoption of AI-driven software development has led to a staggering fivefold increase in application creation, but also a shocking 4.31 times more critical and high-severity vulnerabilities in enterprise apps. This surge in vulnerabilities outpaces the speed of fixes, posing a growing risk to businesses.
Fake Chrome VPN Extensions Expose Users to Proxy Routing Risks
Beware of Chrome VPN extensions that may be putting your online security at risk: over 737 extensions impersonated popular VPN and proxy services, secretly routing users' traffic through unsecured SOCKS5 proxies. This exposed users to potential data breaches and surveillance, as their browsing activity was intercepted by a single, unknown provider.
Zoom Flaws Let Meeting Participants Hijack Other Attendees' Clients
Critical security flaws in Zoom's annotation code, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, could have allowed a meeting participant to hijack others' clients without warning. Fortunately, Zoom has patched these vulnerabilities, and no exploitation has been reported.
Metabase Zero-Day Exploits Grant Admin Access
A critical zero-day vulnerability in Metabase allows hackers to gain admin access and wreak havoc on your data, with a perfect 10.0 CVSS score highlighting the severity of this threat. Attackers can inject malicious SQL, steal sensitive credentials, and export data, making immediate patching a top priority.
Prompt Injection Tops List of LLM Threats
Despite having relatively few recorded incidents, prompt injection tops the list of LLM threats due to the significant efforts and resources security teams invest in preventing it. This threat's prominence highlights the substantial risk it poses, even if it doesn't always make the public headlines.
AI Applications Expose Widespread Security Vulnerabilities
A shocking 100% of AI applications tested harbored security vulnerabilities, with prompt injection flaws being the most common and damaging threat. This critical weakness, found in 28% of tested apps, highlights a glaring vulnerability that attackers are exploiting to manipulate model inputs.
Check Point Flaw Exploited as Researchers Release Public PoC
A critical flaw in Check Point's SmartConsole, known as CVE-2026-16232, allows hackers to bypass authentication and gain full administrative privileges with a staggering CVSS score of 9.3. This vulnerability lets unauthenticated remote attackers obtain a login token and take control, potentially modifying security policies and configurations.
Compromised npm Packages Deliver DEV#POPPER Malware via Blockchain
Malicious npm packages have been discovered delivering DEV#POPPER malware via blockchain, with two beta releases in the @joyfill namespace containing a sneaky JavaScript implant that springs into action the moment Node.js loads the package. This stealthy implant can execute in any process that requires the compromised package, making it a serious threat.
SAP Patches High-Severity Flaws in NetWeaver, Commerce Cloud
SAP has urgently patched a critical vulnerability in NetWeaver Application Server ABAP, known as CVE-2026-44747, which could allow attackers to corrupt memory, exposing sensitive data or bringing systems to a grinding halt. This high-severity flaw, scoring 9.9 under CVSS, highlights the importance of updating your systems ASAP to prevent potential chaos.
Adobe ColdFusion Flaw Exploited in Targeted Attacks
With 775 exposed ColdFusion instances online, a newly patched flaw is being exploited by attackers, putting countless systems at risk. Adobe has urgently warned customers to apply updates immediately to protect against this and 10 other critical vulnerabilities.
Adobe ColdFusion Flaw Exploited in Ongoing Attacks
A critical Adobe ColdFusion vulnerability, CVE-2026-48282, is under attack - and it's crucial to patch now to prevent remote code execution on your system. This maximum-severity flaw affects ColdFusion releases 2025.9, 2023.20, and earlier, and can be exploited without privileges.
phpBB Fixes Decade-Old Auth Bypass Bug
A major vulnerability in phpBB has been uncovered, allowing attackers to bypass authentication and log in as any user, including administrators, with ease and no special knowledge required. This decade-old bug, exploitable in default configurations, has been patched - but only after researchers took steps to privately disclose the issue to prevent widespread exploitation.