cyberintel.kalymoon.com · 46445 articles · updated every 4 hours · grows forever
A vulnerability, which was classified as critical , has been found in MervinPraison PraisonAIAgents up to 1.5.127 . The affected element is an unknown function of the file praisonaiagents/tools/web_cr…
A vulnerability, which was classified as critical , was found in OpenClaw up to 2026.3.22 . The impacted element is the function authorizeCanvasRequest . Such manipulation leads to authentication bypa…
A vulnerability has been found in MervinPraison PraisonAI up to 4.5.127 and classified as problematic . This affects the function _safe_extractall . Performing a manipulation results in highly compres…
A vulnerability was found in wolfSSL up to 5.9.0 and classified as critical . This impacts an unknown function of the component DTLS Handler . Executing a manipulation can lead to heap-based buffer ov…
A vulnerability was found in Rapid7 Insight Agent up to 3.3.0 on Windows. It has been classified as problematic . Affected is an unknown function of the file …/bootstrap/common/ssl of the component Ce…
A vulnerability was found in wolfSSL up to 5.9.0 . It has been declared as critical . Affected by this vulnerability is the function wc_CmacUpdate of the component Message Handler . The manipulation r…
A vulnerability was found in YITH WooCommerce Wishlist Plugin up to 4.12.x on WordPress. It has been rated as critical . Affected by this issue is the function save_title of the file /wishlist/ of the…
A vulnerability categorized as problematic has been discovered in Japan Computer Emergency Response Team Coordination Center Emocheck . This affects an unknown part. Such manipulation leads to uncontr…
A vulnerability identified as critical has been detected in YML for Yandex Market Plugin up to 5.0.25 on WordPress. This vulnerability affects unknown code. Performing a manipulation results in code i…
A vulnerability labeled as problematic has been found in parisneo lollms up to 2.1.x . This issue affects the function create_post of the file backend/routers/social/__init__.py . Executing a manipula…
I spotted an interesting piece of JavaScript code that was delivered via a phishing email in a RAR archive. The file was called “cbmjlzan.JS†(SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c…
Amazon Web Services (AWS) has released an important security bulletin addressing three severe vulnerabilities in its Research and Engineering Studio (RES). These flaws could allow authenticated attack…
A newly detailed jailbreak technique known as “sockpuppeting” allows attackers to bypass the safety guardrails of 11 major large language models (LLMs) using a single line of code. Unlike complex atta…
A massive Magecart campaign compromising 99 Magento e-commerce stores using an innovative evasion technique. Discovered on April 7, 2026, the attack relies on invisible Scalable Vector Graphics (SVG) …
A high-severity vulnerability has been discovered in React Server Components, exposing modern web applications to Denial of Service (DoS) attacks. Tracked as CVE-2026-23869, this flaw allows unauthent…
A new Remote Access Trojan known as DesckVB has been targeting systems in 2026, using obfuscated JavaScript and a fileless .NET loader to stay hidden from traditional security tools. The malware gives…
A critical security alert warns of a severe default password vulnerability affecting Support Insights Virtual Lightweight Collector (vLWC) appliances. This flaw enables unauthenticated network-based a…
Here’s a look at the most interesting products from the past week, featuring releases from Advenica, Intruder, Mallory, and Secureframe. Mallory brings contextual threat intelligence to security opera…
Instant messaging has been around for decades, but it became widely adopted with the emergence of smartphones. Earlier, communication was limited to basic text messages. Messaging expanded to include …
Lead generation websites that offer health insurance quotes collect sensitive personal data and sell it to multiple buyers within seconds of a user clicking submit. A study by researchers at UC Davis,…
In this Help Net Security interview, Aqsa Taylor, Chief Security Evangelist, Exaforce, explains vibe hunting, an AI-driven approach to threat detection that inverts traditional hypothesis-driven metho…
I just blinked and the first quarter of the year is GONE. Where does the time go? I looked back at my article from last month where I touched on the use of AI and some of the vulnerabilities associate…
The security hole affected an EngageLab SDK and it was reported by Microsoft to the vendor one year ago. The post Microsoft Finds Vulnerability Exposing Millions of Android Crypto Wallet Users appeare…
New Device Bound Session Credentials render stolen session cookies unusable by cryptographically binding authentication. The post Google Rolls Out Cookie Theft Protections in Chrome appeared first on …