Critical Vulnerabilities in Claude Code and Gemini CLI Expose CI Workflow Secrets
PremiumFlaws in Claude Code and Google's Gemini CLI let an unprivileged GitHub issue execute code on CI runners and expose secrets.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesMonday, August 10
TrueConf Servers Compromised: Backdoor Infiltration Discovered
PremiumThreat actors exploited unpatched TrueConf servers to replace client installers with trojanized backdoors for remote access.
Atlassian's Rovo AI Vulnerability Risks Enterprise Data Exposure
PremiumVaronis found a one-click RovoBlast vulnerability that could expose Confluence, Jira and SharePoint data to attackers.
CSS Bomb Attacks Exploit Email Vulnerabilities to Steal Passwords
PremiumCSS bomb technique manipulates webmail UI to spy on user activity and capture passwords and tokens without JavaScript.
N-able Enhances Security with New N-central Hotfix Amid Exploitation Concerns
PremiumN-able released hotfixes after active exploitation of N-central enabled persistent attacker access to managed systems.
Google Chrome 151 Update Resolves Critical Security Flaws
PremiumChrome 151 fixes multiple memory-safety bugs, including critical use-after-free issues — prioritize browser updates.
Critical Metabase Vulnerability Exploited to Gain Unauthorized Access
PremiumCritical Metabase SQLi zero-day allows unauthenticated admin access and active data-theft; immediate mitigation required.
Friday, August 7
Critical Vulnerability in Popular Code Editors Puts Millions at Risk
PremiumCritical one-click RCE affecting Cursor, VS Code, and Google Antigravity could compromise developers by executing code via malicious links.
Security Researcher Uncovers Vulnerability in ChatGPT's Sandbox Environment
PremiumResearcher demonstrated a PoC providing C2-style influence over ChatGPT's isolated sandbox, highlighting container escape risks.
AI Coding Agents Expose Critical Vulnerabilities
PremiumRepeatable vulnerabilities across Anthropic, Google, and OpenAI coding agents allow RCE, API credential theft, and supply-chain compromise.
AI Browsers Under Siege: Zero-Click Vulnerabilities Threaten ChatGPT Atlas and Claude
PremiumZero-click prompt injection vulnerabilities let attackers hijack Claude and ChatGPT Atlas via crafted emails and social posts, unpatched as reported.
Severe Paperclip Flaw Exposes Admin Access and Code Execution Risks
PremiumCritical Paperclip flaw allowed unauthenticated admin access and code execution via board-level API and company import feature.
SQL Injection Exploited in Oracle Database for SYSTEM-Level Access
PremiumAttackers used SQL injection to compile khunt toolkit inside Oracle DBs, executing post-exploitation tasks without writing executables to disk.
Critical Security Flaws Fixed in AWS, Google, and Vercel Tools
PremiumAgent infrastructure flaws at AWS, Google, and Vercel allow forged instructions to invoke agent tools without model authorization, bypassing guardrails.
Critical JetBrains TeamCity Flaw Actively Exploited by Hackers
PremiumCritical unauthenticated RCE CVE-2026-63077 in JetBrains TeamCity is being actively exploited for remote code execution.
Thousands of Rockwell PLCs Vulnerable Online, Urgent Action Needed
PremiumForescout found 4,407 internet-exposed Rockwell PLCs worldwide, including 22 in cities impacted by recent water utility attacks.
CISA Calls for Immediate Action on Critical Software Vulnerabilities
PremiumCISA warns of active exploitation and urges three-day mitigations for IBM Langflow, N-central, and Apache Tomcat vulnerabilities.
Wednesday, August 5
Coldcard Bitcoin Wallet Breach Results in $89 Million Theft
Coldcard hardware wallet firmware bug exploited, resulting in $89M stolen and product inventory destroyed to prevent further compromise.
Security Flaws in Hugging Face Diffusers Expose AI Supply Chain Risks
Three high-severity Diffusers library flaws let crafted model repositories execute arbitrary code, bypassing trust_remote_code protections.
Critical Flaws in Flowise AI Workflow Servers Expose Systems to Remote Code Execution Risks
Six Flowise remote code execution flaws let authenticated attackers run commands on AI workflow servers, risking credentials and data.
Get these articles delivered to your inbox.
Subscribe free