Vulnerabilities
Curated coverage and analysis in this editorial area.
Selected coverage
Langflow Under Attack: MCP Servers Become Vector for Authenticated RCE
CVE-2026-105740 in Langflow has triggered 1,423 exploit attempts on a honeypot. The attack mechanism exploits opaque MCP server config…
Palo Alto Networks: Active Exploit for CVE-2026-0322 in PAN-OS Management
Palo Alto Networks confirms active exploitation of CVE-2026-0322, an authenticated RCE with root privileges on PAN-OS firewalls. CISA…
CVE-2026-108065: Critical Pre-Auth SQL Injection in WebAlliance B2B E-Commerce Platform
An unauthenticated SQL injection flaw with a CVSS 9.8 score affects Channel Software WebAlliance eCommerce. The vulnerability allows s…
Chrome and Firefox: 114 Vulnerabilities Patched as Mozilla Launches Firefox Enterprise
On October 14, 2026, Google and Mozilla released security updates fixing a combined 114 vulnerabilities — 37 in Chrome 155 and 77 in F…
Vercel Sandbox: AI Agents Bypass Network Restrictions via Manipulated Certificates
AIR researchers have demonstrated a vulnerability in the Vercel Sandbox that allows confined AI agents to exfiltrate sensitive data by…
LG webOS: Three-Flaw Chain Enables Pre-Auth Root Takeover from Local Network Without PIN
Three vulnerabilities in LG webOS chain together to grant an attacker on the same local network pre-authentication root access on cert…
Bricksforge RCE Exploited in the Wild: Automated Attacks Within Hours of Oct. 7 Disclosure
CVE-2026-85097 in the WordPress Bricksforge plugin enables unauthenticated RCE. The official CVE record assigns CVSS 9.8, not the 10.0…
Adobe Patches PDF Zero-Day Exploited for Four Months: CVE-2026-34621
Adobe has fixed CVE-2026-34621, a zero-day vulnerability in its PDF products that was actively exploited from November 2025. Opening a…
Atlassian Patches CVE-2026-21589: Path Traversal Hits 8 Data Center Products at CVSS 9.3
Atlassian released fixes on October 5, 2026 for a critical path traversal flaw affecting eight Data Center products. The vulnerability…
Dell System Update Critical 9.6 Bug Opens PowerEdge Servers to Remote Root
A path traversal vulnerability in Dell System Update allows unauthenticated remote code execution with root privileges. Version 2.3.0.…
GitLab Patches Critical RCE in AI Gateway: Self-Hosted Deployments at Risk
CVE-2026-90970, rated CVSS 9.9, allows authenticated users with Duo Agent Platform access to escape the prompt template sandbox and ex…
Meta Muse Zero-Day Turns AI Assistant Into Backdoor: Attack Explained
Patrick Wardle discovered a zero-day in Meta's Muse AI agent for macOS. An undocumented setting, `endo_voyager_dictation_endpoint`, le…