Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

cycognito

Emerging Threat: CVE-2025-15467 - OpenSSL CMS AuthEnvelopedData Stack-Based Buffer Overflow

Jan 31, 2026 By Amit Sheps In CyCognito
CVE-2025-15467 is a stack-based buffer overflow vulnerability in the Cryptographic Message Syntax (CMS) implementation of OpenSSL, specifically within handling of AuthEnvelopedData structures. The flaw occurs during parsing of attacker-controlled CMS messages where length fields are not sufficiently validated before being copied into fixed-size stack buffers.
Read Post
Arctic Wolf

CVE-2026-1281 and CVE-2026-1340: Unauthenticated RCE Zero-Day Vulnerabilities in Ivanti Endpoint Manager Mobile

Jan 30, 2026 By Andres Ramos In Arctic Wolf
On January 29, 2026, Ivanti released fixes for two critical zero-day code injection vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM). The vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340, impact the In-House Application Distribution and Android File Transfer Configuration features and allow unauthenticated remote threat actors to achieve remote code execution.
Read Post
foresiet

CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Zero-Day Analysis

Jan 30, 2026 By foresiet In Foresiet
CVE-2026-24858 is a critical authentication bypass vulnerability(CWE-288: Authentication Bypass Using an Alternate Path or Channel) in Fortinet products. It affects FortiOS, FortiAnalyzer, FortiManager, and potentially FortiProxy. An attacker with a FortiCloud account and registered device can log into devices registered to other accounts if FortiCloud SSO is enabled. Disclosed January 27, 2026, as actively exploited zero-day. CVSS 9.4 (some sources cite 9.8).
Read Post
Arctic Wolf

Multiple Critical Authentication Bypass and Remote Code Execution Vulnerabilities Fixed in SolarWinds Web Help Desk

Jan 28, 2026 By Andres Ramos In Arctic Wolf
On January 28, 2026, SolarWinds released fixes for multiple vulnerabilities impacting Web Help Desk (WHD). WHD is an IT service management platform that may contain sensitive information, making it a valuable target for threat actors if compromised. Among the vulnerabilities addressed, four were rated as critical: At the time of writing, Arctic Wolf has not observed exploitation of these vulnerabilities in the wild, nor identified a publicly available proof-of-concept exploit.
Read Post
Arctic Wolf

CVE-2026-24858: FortiCloud SSO Authentication Bypass Vulnerability Exploited

Jan 28, 2026 By Julian Tuin In Arctic Wolf
On January 27, 2026, Fortinet released an advisory detailing a critical authentication bypass vulnerability affecting FortiOS, FortiAnalyzer, FortiManager, and FortiProxy products. Designated CVE-2026-24858, the vulnerability allows an unauthenticated threat actor with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Read Post
astra

Common Web Application Vulnerabilities: Expert's Opinion [2026]

Jan 28, 2026 By Keshav Malik In Astra
Hackers love web applications. Why? Because 9 out of 10 vulnerabilities exist at the application layer, and exploiting them lets attackers bypass firewalls and perimeter defenses completely. In 2025, a total of 48,448 Common Vulnerabilities and Exposures (CVEs) were published, up 17% from the previous year, where such exploited vulnerabilities in web applications cost organizations an average of $4.44 million in damages, excluding the lost reputation.
Read Post
cyberark

CVE-2025-60021 (CVSS 9.8): Command injection in Apache bRPC heap profiler

Jan 28, 2026 By Simcha Kosman In CyberArk
This research is published following the public release of a fix and CVE, in accordance with coordinated vulnerability disclosure best practices. CVE‑2025‑60021, a critical command injection issue in Apache bRPC’s /pprof/heap profiler endpoint, was identified during broader analysis of diagnostic and debugging surfaces in the framework. The issue was discovered using Vulnhalla, CyberArk Labs’ AI tool that assists in triaging CodeQL results using an LLM.
Read Post
cycognito

Emerging Threat: CVE-2026-24061 - Telnet Authentication Bypass in GNU Inetutils

Jan 28, 2026 By Amit Sheps In CyCognito
CVE-2026-24061 is an authentication bypass vulnerability affecting the Telnet service provided by GNU Inetutils. The issue allows an unauthenticated remote attacker to bypass expected authentication checks and gain access to the Telnet service under certain conditions.
Read Post
nucleus

Practical Tips for Tracking Vulnerability Remediation Progress

Jan 27, 2026 By Doug Drew In Nucleus
When vulnerability remediation succeeds at enterprise scale, it’s very rarely because the vulnerability management team is finding more vulnerabilities. It’s because the program was built around the idea of turning messy findings into steady, measurable risk reduction. That’s not an easy task. It’s easier to make it a numbers game, pointing to vulnerability volumes and how many findings were addressed, rather than accurately depicting how much real risk was eliminated.
Read Post
seemplicity

When Hundreds of Patch Findings Require One Fix

Jan 27, 2026 By Kevin Swan In Seemplicity
In large-scale security environments, the primary challenge is often execution rather than a lack of detection. When multiple security tools report the same missing patch on a single machine, it creates hundreds of redundant findings that inflate backlogs and cause ticket-based workflows to break down. By aggregating these overlapping alerts into a single remediation action centered on the root cause, organizations can align their work with actual outcomes.
Read Post
bitsight

The Top 5 Vulnerabilities Attackers Are Using Against Your Vendors (And What It Says About Third-Party Risk)

Jan 27, 2026 By Emma Stevens In BitSight
When threat actors target your vendors, they’re not just looking to exploit a system for a single attack. They’re looking for every opportunity to scale up their operations. This means seeking ways to push their compromises as far downstream into the supply chain as they can go.
Read Post

Why CVEs Alone Don't Explain Risk | Ed Amoroso & Garrett Hamilton on Actionable Security

Jan 26, 2026 By Reach Security In Reach Security
Vulnerability data isn’t the starting point. Context is. Ed Amoroso and Garrett Hamilton unpack why CVEs on their own don’t explain risk. What matters first: ⇢ What assets actually exist⇢ How controls are deployed and configured⇢ What the live posture looks like, not last month’s report With that context in place, vulnerabilities stop being noise and start becoming decisions. Garrett also makes a critical point near the end: many security tools are excellent at producing findings, but far less effective at helping teams resolve them.
View Video

GLM 4.7 vs. The Giants: Is This the New King of AI Coding?

Jan 26, 2026 By Snyk In Snyk
Can a lesser-known model compete with the likes of OpenAI, Google, and Anthropic? In this video, we put Z.ai’s GLM 4.7 to the ultimate test. We task it with building a production-ready, secure Node.js note-taking application from a single prompt to see if its code quality and security stand up to the big name foundational models.
View Video

CVE-2025-55131: Node.js Memory Exposure Risk

Jan 23, 2026 By Indusface In Indusface
Node.js patched a serious vulnerability (CVE-2025-5513) that could expose uninitialized memory and leak secrets like tokens or application data due to a race condition in the buffer allocation logic. This vulnerability affects the vm module with timeouts and is part of a broader coordinated security update across all active Node.js release lines.
View Video
Arctic Wolf

CVE-2026-21962: Maximum-severity Vulnerability in Oracle HTTP Server/WebLogic Proxy Plug-In

Jan 23, 2026 By Andres Ramos In Arctic Wolf
On January 20, 2026, Oracle patched a maximum‑severity vulnerability in its Fusion Middleware suite affecting Oracle HTTP Server and the WebLogic Server Proxy Plug‑in, tracked as CVE‑2026‑21962. An unauthenticated remote threat actor can exploit this flaw to gain unauthorized creation, deletion, or modification access to critical data. The issue stems from improper handling of incoming requests by the WebLogic Server Proxy Plug‑ins for Apache HTTP Server and Microsoft IIS.
Read Post
indusface

CVE-2025-3248: Critical Langflow Unauthenticated Remote Code Execution Vulnerability

Jan 23, 2026 By Bhargavi Pallati In Indusface
A critical vulnerability in Langflow’s code validation mechanism allows unauthenticated attackers to execute arbitrary Python code on exposed systems. Tracked as CVE-2025-3248, the vulnerability resides in a publicly accessible API endpoint and affects all Langflow versions prior to 1.3.0. Active exploitation has been confirmed, with attackers using the vulnerability to deploy malware and onboard compromised systems into botnet infrastructure.
Read Post
seemplicity

Seemplicity Year in Review: Turning a Year of Security Data in Actionable Risk Insight

Jan 22, 2026 By Kevin Swan In Seemplicity
Seemplicity’s Year in Review is a product feature that provides each customer with a year-end view of how risk and exposure moved through their own environment. This post walks through the metrics included in the latest experience and what they help teams reflect on as they refine their exposure management processes.
Read Post
Arctic Wolf

CVE202620045: Exploited Unauthenticated Remote Code Execution Vulnerability in Cisco Unified Communications Products

Jan 22, 2026 By Andres Ramos In Arctic Wolf
On January 21, 2026, Cisco released fixes for a high-severity vulnerability impacting Cisco Unified Communications products that is under active exploitation, tracked as CVE-2026-20045. The flaw arises from improper input validation of user-supplied data in HTTP requests to the web-based management interface of affected devices.
Read Post
safebreach

SafeBreach Labs Releases Root Cause Analysis & Proof-of-Concept Exploit for CVE-2026-24061: Telnetd RCE as Root Vulnerability

Jan 22, 2026 By SafeBreach In SafeBreach
In January 2026, the GNU telnetd service from GNU InetUtils was found to be vulnerable to authentication-bypass by Simon Josefsson. Tracked as CVE-2026-24061, this flaw allows an attacker to establish a Telnet session without providing valid credentials, granting unauthorized access to the target system. The vulnerability exists all the way up to version 2.7-2 of the GNU telnetd service and, as indicated by Simon, looks like it was taken right out of the 90s.
Read Post
Arctic Wolf

Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts

Jan 21, 2026 By Arctic Wolf Labs In Arctic Wolf
Starting on January 15, 2026, Arctic Wolf began observing a new cluster of automated malicious activity involving unauthorized firewall configuration changes on FortiGate devices. This activity involved the creation of generic accounts intended for persistence, configuration changes granting VPN access to those accounts, as well as exfiltration of firewall configurations.
Read Post
nucleus

Custom Risk Scoring Is the Missing Link Between Disconnected Findings and Real Exposure Management

Jan 20, 2026 By Rob Gibson In Nucleus
Most large organizations rely on multiple vulnerability and exposure scanning tools out of necessity. Infrastructure scanners, cloud security platforms, application security testing tools, container scanners, and attack surface management solutions all play a role. Each one is designed to answer a specific question. But when it comes to understanding the risk of the vulnerabilities and exposures they detect, each tool has its own approach to quantifying it.
Read Post
Snyk

Live From Davos: The End of Human-Speed Security

Jan 20, 2026 By Peter McKay In Snyk
This week, I am joining global policymakers and innovators in Davos for the World Economic Forum. The theme for 2026 is "A Spirit of Dialogue", a recognition that our toughest challenges require shared understanding and cooperation. As we gather to discuss the future of the global economy, we have an opportunity to lead an urgent conversation. It centers on the reality of artificial intelligence (AI), not the hype about what it might do, but on what it is already doing in our enterprises.
Read Post
Can Manufacturing Defects Really Compromise Your Network's Data?

Can Manufacturing Defects Really Compromise Your Network's Data?

Jan 20, 2026 By SecuritySenses In SecuritySenses
Whenever we consider network security, it tends to cross our mind that we are dealing with hackers, malware or poor passwords. However, there is a less conspicuous danger that never makes the news: the physical elements that constitute your network infrastructure. In particular, the printed circuit boards (PCBs) that drive your routers, switches, and servers may have manufacturing defects that open holes in your security that you never thought of.
Read Post
outpost 24

The 2026 Cybersecurity Threat Landscape: Persistent Adversaries, Repeatable Playbooks

Jan 19, 2026 By Lidia López Sanz In Outpost 24
As a threat intelligence team, our job is to separate noise from persistence in the cybersecurity threat landscape. In this article, we assess the threats most likely to remain and evolve through 2026 based on the threat actors, campaigns, and malware we have tracked and researched during the last year. Our work centers on tracking adversaries with a strong footprint in the underground ecosystem: forums, Telegram channels, data leak sites, and marketplaces where cybercriminals operate.
Read Post
cloudflare

How we mitigated a vulnerability in Cloudflare's ACME validation logic

Jan 19, 2026 By Hrushikesh Deshpande In Cloudflare
On October 13, 2025, security researchers from FearsOff identified and reported a vulnerability in Cloudflare's ACME (Automatic Certificate Management Environment) validation logic that disabled some of the WAF features on specific ACME-related paths. The vulnerability was reported and validated through Cloudflare’s bug bounty program. The vulnerability was rooted in how our edge network processed requests destined for the ACME HTTP-01 challenge path (/.well-known/acme-challenge/*).
Read Post

Testing MiniMax M2.1 for AI Coding: The Results Might Surprise You

Jan 19, 2026 By Snyk In Snyk
Can "lesser-known" AI models actually keep up with the giants like Google, OpenAI, and Anthropic? In today’s video, we put MiniMax M2.1 to the ultimate test: building a production-ready, secure Node.js note-taking application from a single prompt. We’ll explore how to access MiniMax natively in the Windsurf IDE, walk through the debugging process for common errors (like environment variables and OS-specific dependencies), and perform a deep-dive security audit using Snyk. Stick around until the end to learn how to integrate MiniMax M2.1 into VS Code using OpenRouter.
View Video

Why Vulnerability Management Falls Short - And How Exposure Management Fixes It

Jan 19, 2026 By Reach Security In Reach Security
Vulnerability management identifies weaknesses. Exposure management helps prioritize them based on real-world risk and context. Ed and Garrett unpack why traditional vulnerability programs struggle to drive real risk reduction. The challenge isn’t discovery. It’s prioritization and follow-through. Too often, vulnerabilities are treated as isolated IT tasks—handed off, tracked by SLAs, and stripped of the context that explains why they matter in the first place.
View Video
foresiet

CVE-2026-23745: A Deep Dive into the node-tar Arbitrary File Overwrite Vulnerability

Jan 19, 2026 By foresiet In Foresiet
CVE-2026-23745 is a high-severity path traversal flaw in node-tar (the tar library for Node.js). Versions ≤7.5.2 fail to sanitize linkpath in hardlink and symlink entries when preservePaths is false (default secure mode). Malicious tar archives bypass extraction root restrictions, enabling arbitrary file overwrite via hardlinks and symlink poisoning via absolute targets. Discovered January 2026, patched in 7.5.3. Impacts npm ecosystems, CI/CD pipelines, and apps extracting untrusted archives.
Read Post
indusface

Critical Node.js Vulnerabilities Expose Uninitialized Memory (CVE-2025-55131)

Jan 16, 2026 By Aayush Vishnoi In Indusface
CVE-2025-55131 is a high-severity buffer allocation race condition vulnerability in Node.js that can lead to uninitialized memory exposure when using the vm module with execution timeouts. This vulnerability is part of a coordinated Node.js security update addressing eight vulnerabilities across all active release lines.
Read Post
indusface

CodeBreach: Critical AWS CodeBuild Misconfiguration Enabling Supply Chain Repository Takeover

Jan 16, 2026 By Aayush Vishnoi In Indusface
A critical misconfiguration in Amazon Web Services (AWS) CodeBuild could have allowed attackers to gain complete control over GitHub repositories used in AWS CI/CD pipelines, including the widely used AWS JavaScript SDK, introducing a severe software supply chain risk. This vulnerability, codenamed CodeBreach, stemmed from insufficiently restrictive CI pipeline configurations, build triggers, and webhook filters.
Read Post
Arctic Wolf

CVE-2025-64155: FortiSIEM Remote Unauthenticated Command Injection Vulnerability

Jan 15, 2026 By Andres Ramos In Arctic Wolf
On January 13, 2025, Fortinet released fixes for a critical-severity FortiSIEM vulnerability (CVE-2025-64155) that stems from improper neutralization of special elements used in OS commands within the phMonitor service (TCP/7900). An unauthenticated, remote threat actor can exploit this vulnerability via crafted TCP requests to execute unauthorized code or commands on affected systems.
Read Post
outpost 24

New attack analysis: What you need to know about the Endesa data breach

Jan 15, 2026 By Lydia Atienza In Outpost 24
Following the recent cyberattack on Endesa, one of Spain’s largest electricity and gas providers, Outpost24’s threat intelligence team has compiled a comprehensive analysis of the incident based on publicly available evidence from underground forums, leaked dataset listings, and the threat actor’s own statements.
Read Post
Why One-Time Vulnerability Scans Aren't Enough

Why One-Time Vulnerability Scans Aren't Enough

Jan 15, 2026 By SecuritySenses In SecuritySenses
A single vulnerability scan provides a tempting snapshot of security health. Too many companies rely on such periodic checks for compliance and some semblance of risk assessment. This, however, leads to an extremely dangerous illusion of security. Modern digital environments, as well as threat actors, move at speeds that are much too high for a static, point-in-time evaluation. Treating cybersecurity as an exercise in box-ticking leaves gaps that adversaries can use.
Read Post
jfrog

Dissecting and Exploiting CVE-2025-62507: Remote Code Execution in Redis

Jan 14, 2026 By Ori Hollander In JFrog
A recent stack buffer overflow vulnerability in Redis, assigned CVE-2025-62507, was fixed in version 8.3.2. The issue was published with a high severity rating and assigned a CVSS v3 score of 8.8. According to the official advisory, “a user can run the XACKDEL command with multiple IDs and trigger a stack buffer overflow, which may potentially lead to remote code execution”.
Read Post
Snyk

ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations

Jan 14, 2026 By Stephen Thoemmes In Snyk
The recent disclosure of what security researchers are calling "the most severe AI-driven vulnerability uncovered to date" in ServiceNow's platform serves as a stark reminder: securing agentic AI isn't just about new AI-specific controls; it requires getting the fundamentals right first.
Read Post

Intel Chat: Ni8mare CVSS 10.0, malicious AI extensions, Venezuela blackout & BlackCat insiders [281]

Jan 14, 2026 By LimaCharlie In LimaCharlie
A newly disclosed vulnerability in the workflow automation platform n8n, tracked as CVE-2026-21858 and rated CVSS 10.0, allows unauthenticated remote attackers to fully compromise exposed instances. Two malicious Chrome extensions impersonating a legitimate product from AITOPIA were found exfiltrating sensitive user data, including full AI chat histories, according to a report from OX Security. The recent U.S. military operation in Venezuela that led to the capture of President Nicolás Maduro may have included cyber operations, but official confirmation of cyber’s role remains ambiguous.
View Video

Exploit Intel & Detected Products - Tanium Comply - Tanium Tech Talks #153

Jan 14, 2026 By Tanium In Tanium
Cut through vulnerability noise! Learn how Tanium Comply’s new Exploit Intel, Endpoint Criticality, and Detected Products help you prioritize and remediate faster. What you’ll learn: Why CVSS alone isn’t enough How EPSS and exploit maturity change the game Dynamic criticality rules for business impact Detected Products for pinpoint remediation Visualize risk with the Exploitability Dashboard.
View Video
seal security

Announcing Our Partnership with Wiz: Seal Hardened Base Images Now Seamlessly Integrated in Wiz

Jan 13, 2026 By Itamar Sher In Seal Security
Security teams can now eliminate container vulnerabilities at the source without developer effort or version upgrades. At Seal Security, we believe vulnerability management should start with secure foundations.That’s why we’re excited to share that Seal’s pre-patched packages to harden base and secure images are now officially integrated in Wiz. This partnership brings together Wiz’s best-in-class cloud visibility with Seal’s remediation-first approach to container security.
Read Post
Arctic Wolf

CVE-2025-25249: Remote Code Execution Vulnerability in FortiOS and FortiSwitchManager

Jan 13, 2026 By Julian Tuin In Arctic Wolf
On January 13, 2026, Fortinet released an advisory describing a high-severity remote code execution vulnerability affecting its FortiOS and FortiSwitchManager products. According to Fortinet, the vulnerability stems from a flaw in the CAPWAP Wireless Aggregate Controller Daemon and could allow an unauthenticated, remote threat actor to execute arbitrary code or commands. The vulnerability was discovered internally by Fortinet’s Product Security Team.
Read Post
protecto

Sensitive Data Is the Common Thread Across Most OWASP Top 10 Issues. Here's Why

Jan 13, 2026 By Anwita In Protecto
The OWASP Top 10 is usually presented as a list of technical failures. Broken access control. Injection. Insecure design. Misconfiguration. Each category points to something that went wrong in the application. What it doesn’t say explicitly is what was actually at risk when it went wrong. In most real incidents, the answer is not “the application.” It’s the data inside it. Sensitive data is the reason attackers care about OWASP failures in the first place. Credentials.
Read Post
Arctic Wolf

CVE-2025-69258: Trend Micro Apex Central Remote Code Execution Vulnerability

Jan 12, 2026 By Julian Tuin In Arctic Wolf
On January 7, 2026, Trend Micro released a critical patch for Apex Central on-premises versions below Build 7190, addressing multiple vulnerabilities. The most severe of the vulnerabilities disclosed is CVE-2025-69258, a critical severity vulnerability, which allows unauthenticated threat actors to load malicious DLLs and execute arbitrary code as SYSTEM without user interaction. The advisory also includes two medium-severity denial-of-service vulnerabilities, CVE-2025-69259 and CVE-2025-69260.
Read Post

A New Era for AI Coding? GPT 5.2 vs. Security Vulnerabilities

Jan 12, 2026 By Snyk In Snyk
Can OpenAI’s GPT 5.2 actually build a production-ready, secure application from a single prompt? In this video, we put the latest model to the test by asking it to build a full-stack Node.js note-taking app. We evaluate its dependency choices, dive into a surprising fix for a long-standing CSRF vulnerability, and run a full security audit using Snyk. Is this the new gold standard for AI coding models?
View Video
sentrium

Critical jsPDF Vulnerability Enables Arbitrary File Read in Node.js (CVE-2025-68428)

Jan 12, 2026 By Theklis Stefani In Sentrium
In January 2026, a critical security vulnerability was disclosed in jsPDF, a popular JavaScript library used to generate PDF documents. The issue, tracked as CVE-2025-68428, affects server-side Node.js deployments of jsPDF prior to version 4.0.0 and has been assigned a CVSS score of 9.2. The vulnerability is a path traversal issue that can be abused to read arbitrary files from the local filesystem.
Read Post
Arctic Wolf

CVE-2026-21858: Critical Unauthenticated File Access Vulnerability in n8n "Ni8mare"

Jan 9, 2026 By Andres Ramos In Arctic Wolf
On January 7, 2026, fixes were released for a maximum severity vulnerability (CVE-2026-21858) impacting n8n, a workflow automation application primarily used with artificial intelligence. Labeled “Ni8mare” by the researchers who discovered it, the vulnerability allows unauthenticated remote threat actors to take over locally deployed instances via publicly accessible webhook and form endpoints.
Read Post
Snyk

Beyond Detection: Building a Resilient Software Supply Chain (Lessons from the Shai-Hulud Post-Mortem)

Jan 8, 2026 By Liran Tal In Snyk
The Shai-Hulud npm supply chain incident was a wake-up call for the industry. The attack involved malicious packages containing hidden exfiltration scripts that targeted developers’ machines and CI environments. At Snyk, we watched this incident unfold in real-time, observing how quickly attackers can pivot from one compromised credential to a full-scale ecosystem infection.
Read Post
protecto

How OWASP Top 10 Maps to Data Exposure Risks: 5 Hidden Threats Explained

Jan 8, 2026 By Protecto In Protecto
Most teams learn the OWASP Top 10 as a list of application security failures. Injection flaws. Broken access control. Security misconfiguration. Items to scan for, remediate, and close before the next audit or penetration test. But data exposure rarely arrives neatly packaged as a single OWASP finding. When sensitive data leaks, it is almost never because one category failed in isolation.
Read Post
Snyk

Secure by Default: Why Snyk and Augment Code are the New Standard for AI Development

Jan 7, 2026 By Lindsay Kitendaugh In Snyk
AI coding assistants have fundamentally changed development velocity. With tools like Augment Code, developers can now build and iterate at a pace that was unimaginable just a few years ago. However, this explosion in speed has created a new challenge: security teams, often still relying on manual review processes, are becoming the bottleneck.
Read Post
seal security

The Versioning Ghost: Why OS Context is the Missing Coordinate

Jan 7, 2026 By Amit Agam In Seal Security
In the world of Software Composition Analysis (SCA), we often treat the tuple of (package_name, version) as a unique identifier. For example, given an NPM package angular version 1.8.0 - we would know precisely which source code was used, and what vulnerabilities affect that version.It is a common misconception that a package version maps directly to a fixed set of source code and, by extension, a static vulnerability profile.
Read Post
foresiet

Exploiting Monsta FTP: Technical Analysis of CVE-2025-34299

Jan 7, 2026 By foresiet In Foresiet
CVE-2025-34299 is a critical vulnerability in Monsta FTP, a web-based file transfer tool, unauthenticated arbitrary file write via remote download leading to remote code execution (RCE). Affecting versions 2.11 and earlier, it enables attackers to upload malicious files via a crafted SFTP or FTP connection, compromising servers without credentials. This flaw has seen active exploitation through opportunistic scans. By January 2026, Vulnerable instances remain exposed.
Read Post
outpost 24

KrakenLabs Research Highlights 2025: The Shifts That Redefined the Threat Landscape

Jan 6, 2026 By KrakenLabs In Outpost 24
In 2025, KrakenLabs tracked a series of shifts that reshaped how cyber threats materialized across organizations. Drawing on research conducted throughout the year, this article highlights the most consequential developments observed by KrakenLabs in 2025, where attacker success depended less on new tools or novel exploits and more on the large-scale exploitation of people, identity, and trusted access.
Read Post
seemplicity

What is Exposure Management? From Visibility to Action

Jan 6, 2026 By Jessica Amado In Seemplicity
Exposure Management has quickly become one of the most talked-about concepts in cybersecurity. This article breaks down what exposure management really is, how it differs from vulnerability management, and why the ability to take action is what ultimately drives meaningful risk reduction.
Read Post
cato networks

Cato CTRL Threat Research: Vulnerability Discovered in Open WebUI Enables Account Takeover and Remote Code Execution (CVE-2025-64496)

Jan 5, 2026 By Vitaly Simonovich In Cato Networks
Cato CTRL’s Vitaly Simonovich (senior security researcher) has discovered a vulnerability (CVE-2025-64496 with a “High” severity rating of 7.3 out of 10) in Open WebUI in versions 0.6.34 and older. This flaw affects the Direct Connections feature, which lets users connect to external AI model servers (ex: OpenAI’s API). If a threat actor tricks a user into connecting to a malicious server, it can lead to an account takeover attack.
Read Post
sentrium

MongoBleed: unauthenticated memory disclosure in MongoDB (CVE-2025-14847)

Jan 5, 2026 By Tom Keech In Sentrium
On December 12, 2025, the MongoDB Security Engineering team disclosed a high-severity vulnerability in MongoDB that allows unauthenticated memory disclosure. The issue is tracked as CVE-2025-14847 and has a CVSS score of 8.7 and was quickly nicknamed MongoBleed in the security community due to the way it exposes server memory.
Read Post
nucleus

Why 2025 Marked a Turning Point for Exposure Management and for Nucleus

Jan 5, 2026 By Steve Carter In Nucleus
For years, the cybersecurity industry has told itself that vulnerability management has been improving. This story is centered around “more”: more scanners, more data, more dashboards. Despite this abundance, by 2025 the gap between activity and outcomes became impossible to ignore. Security teams were doing more work than ever but struggled to show that risk was actually going down.
Read Post
aikido

IDOR Vulnerabilities Explained: Why They Persist in Modern Applications

Jan 2, 2026 By Sooraj Shah In Aikido
Insecure Direct Object References, commonly referred to as IDORs, remain one of the most common and damaging classes of application vulnerabilities. Despite being well documented and widely understood at a conceptual level, they continue to appear in real production systems, particularly in modern, API-driven applications.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.