Security Threats

Threats Incidents Live News

Start with an app, service or company you use. Unsure what runs your website or work device? Ask your host or IT team for the product name and version. Search covers threats, incidents and news.

September 8, 2026 21 threats

NLTK 3.10.3 (5)

NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

NLTK: Corpus Reader Sandbox Bypass

Microsoft Security Advisory CVE-2026-50646, .NET Remote Code Execution Vulnerability

Trezor Supply Chain Breach Now Impacts 81,000 Customers

LiquidJS: Uncontrolled Resource Consumption in `join` filter

GitPython 3.1.59 (2)

GitPython: Arbitrary local file content disclosure

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

NLTK 3.10.0 (2)

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

NLTK: Symlink escape in CorpusReader

AI Coding Tools Now a Prime Target for Threat Actors, Google Warns

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Shai-Hulud npm Worm Resurfaces After 111 Days and Slips Past Malware Scanning

Coder registry breach steals cloud credentials

Hackers Hijack Coder Module Registry to Distribute Credential-Stealing Malicious Packages

Known npm Worm Returns After 111 Days and Security Scanning Still Let It Through

September 5, 2026 1 threat

Chainguard scans 1 billion container builds for hidden flaws

September 4, 2026 16 threats

Spector Mock Server can be shut down remotely

SurrealDB bug let users reach other tenants' data

deepseek-tui 0.8.41 (9)

Hmbown CodeWhale flaw let AI run hidden shell commands

Hmbown CodeWhale npm packages leak your system info

CodeWhale tools leak files without permission

Hmbown CodeWhale bug lets AI run code without asking

CodeWhale repo config can silently enable shell access

CodeWhale AI tools can read your files

Hmbown CodeWhale coding agent could leak files via symlinks

CodeWhale bug can expose files

CodeWhale AI coding tool had an SSRF bypass bug

OpenChoreo Kubernetes secrets leak

SiYuan (4)

SiYuan bug can expose secrets

SiYuan bug can leak private, locked notes

SiYuan has a security flawCVE-2026-72794

SiYuan has a security flawCVE-2026-72793

September 3, 2026 36 threats

SiYuan (12)

SiYuan encrypted notes leak passwords

SiYuan note-taking app can run SQL commands

SiYuan note app can grant admin access without login

SiYuan bug lets anyone bypass note password lock

SiYuan note app bug can leak private note data

SiYuan notes app has XSS flaws

SiYuan has a security flawCVE-2026-72811

SiYuan bug can expose secrets

SiYuan bug can let attackers read and edit notebooks

SiYuan has a security flawCVE-2026-69083

SiYuan bug leaks private notes to anyone

SiYuan bug exposes private notes in publish mode

Toml-node npm package can let attackers hijack your code

Toml npm package crashes on booby-trapped config files

Phoenix framework flaw lets one visitor crash a site

RabbitMQ client crashes from oversized messages

TOON library bug can corrupt or hijack JS apps

Semaphore UI (2)

Semaphore UI flaw let attackers hijack accounts

Semaphore UI role hack lets managers steal project control

orval 8.21.0 (9)

Orval bug lets a spec file run attacker code

Orval client generator can run attacker code

Orval npm package has a security flaw

Orval npm package can run attacker codeCVE-2026-71871

Orval npm package can run attacker codeCVE-2026-71869

Orval npm package can run attacker codeCVE-2026-71865

Orval code generator can run attacker JavaScript on import

Orval mock generator bug can run attacker code

Orval npm package can run attacker codeCVE-2026-71864

Ffuf security scanner can be crashed by hostile sites

@openclaw/feishu 2026.6.9 (2)

OpenClaw Feishu tools bypass user disables

OpenClaw Feishu bug ignores disabled permissions

LiquidJS bug can freeze sites with one bad string

AI Agent Firewall Startup AIR Security Emerges From Stealth With $50 Million

Unstructured library flaw can leak internal server data

WebSocket bug can expose secrets

claude-code-templates has a security flaw

September 2, 2026 6 threats

github.com/axllent/mailpit 1.30.4 (2)

Mailpit image bug can crash the email-testing tool

Mailpit SMTP server crashes on long emails

SeaweedFS bug lets one tenant read another's files

Scrapy S3 files leak credentials

Omnigent bug lets AI coding agents bypass safety rules

Handlebars.java bug can let attackers read server files

Load more threats

CISA KEV17091h ago

VulnCheck KEV2001h ago

NVD15081h ago

WPScan0never

HIBP801h ago

URLhaus601h ago

GitHub Advisory1201h ago

OSV.dev31h ago

ransomware.live801h ago

Microsoft MSRC2001h ago

CISA Advisory301h ago

Exploit-DB401h ago

BleepingComputer111h ago

KrebsOnSecurity11h ago

TheHackerNews241h ago

SecurityWeek51h ago

SecurityAffairs71h ago

VPNCentral01h ago

SC World11h ago

eSecurityPlanet91h ago

DarkReading131h ago

SchneierOnSecurity11h ago

ThreatFox801h ago

MalwareBazaar101h ago

Chrome Releases41h ago

Apple Security01h ago

Mozilla MFSA301h ago

Adobe PSIRT301h ago

AlienVault OTX321h ago

Pulsedive11h ago

SANS ISC31h ago

Cisco Talos41h ago

Unit 4231h ago

Mandiant02mo ago

Microsoft Threat Intelligence51h ago

Patchstack151h ago

Rapid761h ago

CERT/CC101h ago

Openwall oss-security801h ago

Wordfence71h ago

Socket101h ago

SafeDep51h ago

Sonatype31h ago

Snyk01h ago

StepSecurity11h ago

Oracle Security Alerts71h ago

GitLab Security Releases61h ago

Palo Alto PSIRT111h ago

Veeam Security Advisories61h ago

Plesk Support111h ago

ConnectWise Security Bulletins41h ago

Cisco PSIRT91h ago

CERT-FR Advisories391h ago

CERT-FR Alerts21h ago

CERT-EU Advisories21h ago

CERT-Bund Advisories501h ago

INCIBE Advisories101h ago

ACN CSIRT Italy461h ago

Jenkins Advisories11h ago

Drupal Advisories31h ago

FreeBSD Advisories101h ago

Gentoo Advisories341h ago

QNAP Advisories01h ago

Synology Advisories01h ago

Huawei PSIRT CN01h ago

Debian DSA301h ago

JPCERT/CC61h ago

JVN EN201h ago

Splunk171h ago

Node.js21h ago

HashiCorp231h ago

Joomla251h ago

Elastic Security251h ago

JetBrains11h ago

CISA ICS Advisories301h ago

CISA Medical Advisories21h ago

MS-ISAC91h ago

CCCS Canada501h ago

CERT-SE21h ago

NCSC UK01h ago

CISA News01h ago

Proofpoint01h ago

Datadog Security Labs01h ago

Recorded Future21h ago

Cyble31h ago

Varonis01h ago

Sygnia11h ago

Vectra AI01h ago

JPCERT Blog01h ago

SOCRadar51h ago

Graham Cluley31h ago

SecurityOnline131h ago

GBHackers81h ago

Cyber Security News81h ago

Infosecurity Magazine301h ago

The Cyber Express61h ago

NNS Blog31h ago

elttam11h ago

Intruder Research11h ago

SpaceRaccoon01h ago

Exodus Intelligence41h ago

VoidSec11h ago

Chocapikk41h ago

Exploit Reversing21h ago

Tim Blazytko11h ago

Zellic11h ago

EUVD01h ago

Ubuntu USN401h ago

Red Hat501h ago

Zero Day Initiative401h ago

Fortinet PSIRT71h ago

NeuraCybIntel71h ago

Security Threats - Page 2