🕵️ RESEARCH & DEEP DIVES
CenterPoint Energy confirms customer data stolen in cyberattack — BleepingComputer
VectraRAT Can Hack Windows Enterprises for $250 per Month — Dark Reading
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists — The Hacker News
MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) onl... — CVE ThreatInt
MCPVault: PathFilter restricted-directory deny-list bypass via case and trail... — CVE ThreatInt
mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url... — CVE ThreatInt
Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for... — CVE ThreatInt
mcp-searxng: DNS-resolved Private Hostname SSRF in
web_url_readmcp-searxng ... — CVE ThreatIntmcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by ... — CVE ThreatInt
mcp-searxng hardened-mode SSRF bypasses permit internal URL accessmcp-searxng... — CVE ThreatInt
Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still... — CVE ThreatInt
IBM MQ .NET client is vulnerable to remote code executionIBM MQ 9.1.0.0 throu... — CVE ThreatInt
Shopper: Negative discount values accepted and propagated through order calcu... — CVE ThreatInt
Shopper: Authorization bypass in Filament bulk actions allows browse-only sta... — CVE ThreatInt
Shopper: Unauthorized inventory stock manipulation via unlocked variant prope... — CVE ThreatInt
In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users updat... — CVE ThreatInt
Shopper: Missing authorization on product removal actions in CollectionProduc... — CVE ThreatInt
githubtoplanguages: Command Injection via Issue Title in Discord Notification... — CVE ThreatInt
CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse — Cyber Security News
Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit — r/netsec
MediaWiki EmbedVideo HTML Injection / Stored XSS — thehackerwire.com (discovered)