When the Shield Needs a Patch: Defender Zero-Days Put Trust at Risk

Microsoft began rolling out fixes for two Microsoft Defender flaws after they were reportedly exploited before a public patch was broadly available.

Microsoft’s Defender Patch Shows How the Guardian Can Become the Target

Exploited flaws in two Defender-related components could let an attacker climb to SYSTEM or knock protection offline, underscoring how endpoint security software can become part of the attack surface.

Rsync’s Trust Boundary Just Got Smaller: Five Flaws, One Hard Lesson

A cluster of vulnerabilities in the file-sync staple shows why exposure is shaped less by product name than by the way the service is deployed.

ChromaDB Flaw Turns an AI Backend Into a Remote Control Panel

A max-severity issue in the Python FastAPI build of ChromaDB shows how one exposed AI service can become a takeover path when authentication and request handling fail in the wrong order.

Exchange Webmail Flaw Triggers a Race to Contain Live Attacks

Microsoft has warned that a critical XSS issue in Exchange Server’s OWA interface is being exploited while defenders wait for a permanent fix.

Linux’s Quietest Failure Mode: A Local Bug That Can End in Root

Fragnesia is a reminder that the most dangerous Linux flaws are often not remote fireworks, but local kernel breaks that can hand an ordinary account the keys to the host.

Avatar Uploads, Full Trust: The Open WebUI Flaw That Turned a Profile Feature Into a Security Fault Line

A reported stored XSS issue in Open WebUI’s upload path shows how a routine profile-image workflow can become a persistent browser-side attack surface, with a claimed route to account hijacking and even deeper compromise in chained scenarios.

Three Flaws, One Admin Plane: cPanel and WHM Put Hosting Servers on Alert

A May 8 disclosure tied to cPanel, WHM, and WP Squared shows how small mistakes in hosting-control logic can create outsized risk when the vulnerable code sits close to server administration.

Edge of Danger: Microsoft’s Password Problem Exposes Enterprises to Silent Credential Theft

Microsoft Edge’s design flaw leaves user passwords vulnerable in process memory, posing a significant risk for organizations relying on the browser.

Shadow Code: How a Cursor AI Extension Flaw Left Developer Secrets Up for Grabs

A critical oversight in Cursor’s extension architecture allows malicious add-ons to silently steal API keys and session tokens—no hacking skills required.

Open Source, Open Door: Hugging Face LeRobot Exposes AI Systems to Silent Takeover

A critical flaw in the popular LeRobot ML framework lets hackers seize control—no password required.

Behind the Wiki Curtain: Notion’s Public Pages Leak Editors’ Identities

Security flaw in Notion exposes names, emails, and profile pictures of editors on public pages—no password required.

Silent Sabotage: How a “By Design” Flaw in Anthropic’s MCP Could Trigger the Next AI Supply Chain Meltdown

An overlooked vulnerability in the Model Context Protocol exposes millions to cascading AI-powered cyberattacks.

Marimo Mayhem: Zero-Day Python Notebook Hackers Strike Within Hours

A critical flaw in Marimo’s open-source Python notebook platform was weaponized less than 10 hours after disclosure, exposing sensitive credentials worldwide.

Docker’s Invisible Door: How a Security Flaw Let Attackers Slip Past Defenses

A newly uncovered bug in Docker’s authorization system left critical systems open to stealthy attacks—here’s what went wrong and what you need to know.

Silent Sabotage: How Claude Code’s Hidden Flaw Left Developers Wide Open

A critical vulnerability in Anthropic’s AI coding assistant quietly disabled security rules, putting sensitive data and systems at risk.

Cracked Wide Open: How a Simple Logic Bug Nearly Turned Open VSX into a Malware Paradise

When “Nothing to Scan” Lets in the Crooks: The Silent Flaw in Open VSX’s Security Wall

A subtle software bug let bad actors slip malicious VS Code extensions past Open VSX’s security checks—no hacking required.

Oracle Under Fire: Critical Security Flaw Exposes Global Enterprises

A newly detected vulnerability in Oracle’s software ecosystem sends shockwaves through the business world, raising urgent questions about data safety and corporate risk.

Invisible Gatecrashers: How a Simple Web Request Put Millions of AdGuard Home Users at Risk

A critical flaw in AdGuard Home let hackers waltz past logins, triggering a global scramble to lock down networks.