Vulnerability

The DNS Trap: How a “Hidden” Path Allowed ChatGPT to Silently Leak Your Private Data

• Data Leak

The DNS Trap: How a “Hidden” Path Allowed ChatGPT to Silently Leak Your Private Data

Do Son April 6, 2026 0

Check Point Research uncovers a DNS tunneling flaw in ChatGPT allowing silent data theft. OpenAI deployed a fix on Feb 20, 2026. Is your AI chat truly private?

Password Hijack in the Modern Stack: Payload CMS Patches Critical 9.1 CVSS Reset Flaw

• Vulnerability Report

Password Hijack in the Modern Stack: Payload CMS Patches Critical 9.1 CVSS Reset Flaw

Do Son April 3, 2026 0

Payload CMS fixes a critical 9.1 CVSS flaw (CVE-2026-34751) in its password reset flow. Attackers could hijack accounts. Update to v3.79.1 immediately!

The MuPDF Vulnerability Turning “Safe” PDFs into System Hijackers

• Vulnerability Report

The MuPDF Vulnerability Turning “Safe” PDFs into System Hijackers

Do Son April 3, 2026 0

Artifex MuPDF faces a 7.8 CVSS integer overflow (CVE-2026-3308) allowing RCE via "crafted" PDFs. With no official patch, sandboxing is vital. Update now.

Critical 9.8 CVSS RCE Vulnerabilities Exposed in Progress ShareFile

• Vulnerability Report

Critical 9.8 CVSS RCE Vulnerabilities Exposed in Progress ShareFile

Do Son April 3, 2026 0

Progress ShareFile hit by critical 9.8 CVSS RCE flaws (CVE-2026-2699). Unauthenticated attackers can hijack configuration and execute code. Update to v5.12.4!

200,000+ Sites at Risk: Perfmatters Flaw Enables Full WordPress Site Takeover

• Vulnerability Report

200,000+ Sites at Risk: Perfmatters Flaw Enables Full WordPress Site Takeover

Do Son April 3, 2026 0

A critical 8.1 CVSS flaw in Perfmatters (200k+ installs) allows unauthenticated attackers to delete wp-config.php and hijack sites. Update to 2.6.0 now!

Joomla! Issues Security Patch: Critical File Deletion and Webservice Flaws Exposed

• Vulnerability Report

Joomla! Issues Security Patch: Critical File Deletion and Webservice Flaws Exposed

Do Son April 2, 2026 0

Joomla releases critical 8.6 CVSS patches for CVE-2026-23898 & CVE-2026-23899. Prevent arbitrary file deletion and API leaks—update to 5.4.4 or 6.0.4 today!

Lodash Patches High-Severity Code Injection Vulnerability

• Vulnerability Report

Lodash Patches High-Severity Code Injection Vulnerability

Do Son April 2, 2026 0

Lodash (CVE-2026-4800) faces an 8.1 CVSS code injection flaw in the _.template function. Attackers can bypass validation via imports. Update to 4.18.0 now!

Critical 9.2 Severity Flaw in Gigabyte Control Center Exposed

• Vulnerability Report

Critical 9.2 Severity Flaw in Gigabyte Control Center Exposed

Do Son April 2, 2026 0

Gigabyte Control Center faces a critical 9.2 severity flaw (CVE-2026-4415). Unauthenticated attackers can write files and execute code—update to 25.12.10.01 now.

Critical 9.8 CVSS Flaw in Cisco SSM On-Prem Grants Unauthenticated Root Access

• Vulnerability Report

Critical 9.8 CVSS Flaw in Cisco SSM On-Prem Grants Unauthenticated Root Access

Do Son April 2, 2026 0

Cisco patches a critical 9.8 CVSS flaw (CVE-2026-20160) in SSM On-Prem. Unauthenticated attackers gain root access via exposed APIs. Update to 9-202601 now!

NocoBase Critical Alert: Sandbox Escape Grants Attackers Root Access

• Vulnerability Report

NocoBase Critical Alert: Sandbox Escape Grants Attackers Root Access

Do Son April 1, 2026 0

NocoBase patches a CVSS 10.0 RCE vulnerability (CVE-2026-34156). A simple console object bypasses the sandbox for root access. Update to 2.0.28 now!

Exploited in the Wild: Google Issues Emergency Patch for Chrome Zero-Day (CVE-2026-5281) in Dawn Component

• Vulnerability Report

Exploited in the Wild: Google Issues Emergency Patch for Chrome Zero-Day (CVE-2026-5281) in Dawn Component

Do Son April 1, 2026 0

Google warns that CVE-2026-5281 is currently being exploited in the wild. Update Chrome to version 146.0.7680.177 immediately to fix this high-severity flaw.

Critical Vulnerability in Perl Core Modules Leaves Systems Exposed

• Vulnerability Report

Critical Vulnerability in Perl Core Modules Leaves Systems Exposed

Do Son March 31, 2026 0

Perl (CVE-2026-4176) faces a 9.8 CVSS flaw due to a vulnerable zlib module. Affecting versions since 5.9.4, it demands an urgent update. Learn how to patch.

Public PoC Exploit and Full Details Disclosed for Nginx UI’s 9.4 CVSS Backup Flaw

• Vulnerability Report

Public PoC Exploit and Full Details Disclosed for Nginx UI’s 9.4 CVSS Backup Flaw

Do Son March 31, 2026 0

Public PoC exploit and details are out for Nginx UI’s 9.4 CVSS backup flaw (CVE-2026-33026). Attackers can hijack servers via tampered backups. Update now!

CISA Issues Emergency Mandate as Critical 9.3 NetScaler Flaw “Bleeds” Admin Sessions

• Vulnerability Report

CISA Issues Emergency Mandate as Critical 9.3 NetScaler Flaw “Bleeds” Admin Sessions

Do Son March 31, 2026 0

CISA adds Citrix NetScaler CVE-2026-3055 to KEV. This 9.3 CVSS flaw "bleeds" admin sessions via SAML. Federal agencies must patch by April 2, 2026.

The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution

• Vulnerability Report

The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution

Do Son March 30, 2026 0

Node-convict (CVE-2026-33864) faces a 9.4 CVSS Prototype Pollution flaw. Bypass filters and hijack Node.js apps. Update to version 6.2.5 now to stay secure.

Vim Under Fire: High-Severity “Tabpanel” Bug Allows RCE via Simple File Open

• Vulnerability Report

Vim Under Fire: High-Severity “Tabpanel” Bug Allows RCE via Simple File Open

Do Son March 30, 2026 0

Vim patches a critical 8.2 CVSS bug chain in modelines and tabpanels. Opening a malicious file triggers instant RCE. Update to 9.2.0272 now to stay safe.

Scriban’s “Leaky” Cache: A 9.1 CVSS Sandbox Escape Hits 40 Million .NET Installs

• Vulnerability Report

Scriban’s “Leaky” Cache: A 9.1 CVSS Sandbox Escape Hits 40 Million .NET Installs

Do Son March 30, 2026 0

Scriban’s 9.1 CVSS flaw allows sandbox escapes in .NET apps via a cache bypass. Over 40M downloads affected. Update to version 7.0.0 to secure your templates.

Telegram Denies “Zero-Click” Sticker Exploit as 9.8 CVSS Security Alert Ignites a Global Standoff

• Vulnerability Report

Telegram Denies “Zero-Click” Sticker Exploit as 9.8 CVSS Security Alert Ignites a Global Standoff

Do Son March 27, 2026 0

A critical 9.8 CVSS zero-click flaw (ZDI-CAN-30207) hits Telegram, affecting 1 billion users. No interaction needed for full system hijack. Patching now!

High-Severity Spring Cloud Config Flaw Triggers File Leaks and SSRF

• Vulnerability Report

High-Severity Spring Cloud Config Flaw Triggers File Leaks and SSRF

Do Son March 24, 2026 0

Spring Cloud Config faces a high-severity CVSS 8.6 flaw (CVE-2026-22739). Attackers can manipulate profiles to access local files or launch SSRF attacks.

Memory Leaks and Mixed Sessions: NetScaler’s Critical 9.3 CVSS Flaw Demands Immediate Action

• Vulnerability Report

Memory Leaks and Mixed Sessions: NetScaler’s Critical 9.3 CVSS Flaw Demands Immediate Action

Do Son March 24, 2026 0

Cloud Software Group warns of a critical 9.3 CVSS memory overread in NetScaler. Patch now to prevent data exposure and session hijacking.

The Undocumented Backdoor: Critical 10.0 CVSS Flaw Hits WAGO Managed Switches

• Vulnerability Report

The Undocumented Backdoor: Critical 10.0 CVSS Flaw Hits WAGO Managed Switches

Do Son March 23, 2026 0

A critical 10.0 CVSS flaw in WAGO managed switches (CVE-2026-3587) allows unauthenticated remote takeover via an undocumented CLI backdoor. Update immediately.

Below the EDR: How Unsecured IP-KVM Switches Grant Total System Takeover

• Vulnerability Report

Below the EDR: How Unsecured IP-KVM Switches Grant Total System Takeover

Do Son March 22, 2026 0

Eclypsium researchers reveal how compromised IP-KVM switches bypass EDR and software security to grant attackers total, BIOS-level system takeover.