Author
Ostorlab Team
WFX Phantom: GitHub Actions Secret Stealer Campaign
A campaign using stolen GitHub tokens pushed the wfx stealer into thousands of repositories, harvesting CI secrets and cloud credentials since November 10.
Nov 12, 2026
Portabase Master Key Overwrite, Fixed in 1.21.2 (CVE-2026-67449)
An unauthenticated path traversal in Portabase's TUS webhook overwrites the AES-256 master key th...
Nov 12, 2026
Apache HTTP Server HTTP/2 RCE, Fixed in 2.4.71 (CVE-2026-119618)
A thread-safety flaw in Apache HTTP Server's mod_http2 lets an unauthenticated HTTP/2 client corr...
Nov 12, 2026
79% vs 51%: Independent Neobanks Lag on App Security
Independent neobanks trail traditional banks by 28.1 percentage points on serious app security fi...
Nov 12, 2026
More by Ostorlab Team
Red Hat Quay Registry Takeover via Key Rotation (CVE-2026-123710)
Red Hat Quay before the fixed branch builds lets an unauthenticated caller install a signing key and forge registry tokens for any repository.
Nov 12, 2026
Traccar LDAP Auth Bypass via Empty Password (CVE-2026-126777)
Traccar 3.15 through 6.16.0 accepts an empty password on LDAP logins, so an attacker who knows a username can sign in as any user, including administrators.
Nov 12, 2026
node-opcua RBAC Bypass: Anonymous Writes to OPC UA (CVE-2026-95860)
node-opcua ignores namespace default role permissions, so anonymous OPC UA clients can write variables and call methods; fixed in 2.180.0.
Nov 11, 2026
Checkmk RCE: Three Critical Flaws in One Patch (CVE-2026-121374)
Three Checkmk flaws let rule editors, malicious remote sites or compromised hosts run code as the site user; fixed in 2.5.0p19.
Nov 11, 2026
Mongoose NoSQL Injection Bypass, Fixed in 9.11.4 (CVE-2026-125120)
Mongoose applies sanitizeFilter unevenly, so attacker-controlled filters reach countDocuments and connection-level queries; fixed in 9.11.4.
Nov 11, 2026
Plone Unauthenticated RCE, Fixed in 6.2.3 (Hotfix 20261110)
A five-flaw chain lets an anonymous visitor run code on Plone 6.0 to 6.2 and older sites; the November 10 package updates and hotfix close it.
Nov 11, 2026
Xen Orchestra Auth Bypass Exploited for Host Takeover (VSA-2026-062)
An empty JSON cookie object bypasses Xen Orchestra authentication and yields admin access; attackers are exploiting it, and 6.9.2 fixes it.
Nov 11, 2026
7-Zip LZX Heap Overflow RCE via Crafted CAB (CVE-2026-125742)
A heap overflow in 7-Zip's LZX decoder lets a crafted multi-volume CAB archive run code during extraction; fixed in 26.06.
Nov 10, 2026
Dokploy Panel RCE: A Member Becomes Host Root
A Dokploy member who can create a database can put a backtick in its password and run commands as root on the host; the fix is on canary only.
Nov 10, 2026
worse_query: iOS Sandbox Escape Exposes App Data
A public iOS 26 and 27 sandbox escape lets a sideloaded app read and modify other apps' containers; Apple's November 9 updates do not fix it.
Nov 10, 2026