CISA Adds Ray Code-Injection Flaw CVE-2025-62593 to KEV Catalog
CISA adds Ray RCE flaw to KEV catalog, CircleCI MCP server hit by unauthenticated RCE, and Certighost exposes AD privilege escalation via Enterprise CAs.
In this digest
Security Intel Feed
Cyber Hose
Page 60 of 93
Read digest
TeamPCP Trivy Compromise Led to Malicious LiteLLM Releases
A supply-chain attack on LiteLLM exposed 2,500+ organizations, plus a French tax data breach affecting 678,000 users and an AppFlowy SQL injection flaw.
In this digest
Attackers Probe GeoServer SQL Injection That Can Enable RCE
GeoServer pre-auth SQL injection enabling RCE headlines this run, alongside a criminal AI service and a high-severity Google Cloud SecOps CVE.
In this digest
SafePal breach exposes order data of nearly 40,000 customers
SafePal's authorization flaw exposed personal order data of 39,798 customers, leading to phishing and impersonation scams.
In this digest
Black Hat: Enterprise Java pre-auth RCE and AI-agent hijacking
Black Hat speakers detail pre-auth RCE in enterprise Java and AI coding-agent hijacking, plus an authenticated command-injection flaw in Zyxel devices.
In this digest
DDoS attacks disrupt Threema messaging services for two days
Threema secure messaging hit by large-scale DDoS outages, plus a CVSS 9.8 privilege escalation in Pods and a SiYuan API token brute-force flaw.
In this digest
TheHatman Sells Azure Directory Data From Nine Major Enterprises
TheHatman is selling employee directories stolen from Azure and Entra tenants of nine major enterprises including McDonald's, Vodafone, and TCS.
Read digestCritical CVSS 9.8 flaw in ARforms plugin through 1.8.5
A CVSS 9.8 unauthenticated vulnerability in the ARforms WordPress plugin headlines this digest.
In this digest
WP Travel Engine up to 6.8.4 exposes customer booking data
Multiple WordPress plugin vulnerabilities surface, including unauthenticated customer data exposure in WP Travel Engine and stored XSS in Bookly.
In this digest
CVE-2026-16098: Unauthenticated File Upload in ProSolution WP
A CVSS 9.8 unauthenticated file upload vulnerability in ProSolution WP Client headlines this run of WordPress plugin CVEs.
In this digest
Assess Your Exposure
Start with the free Posture Self-Check to see where you stand against the current threat landscape.
Free Posture Self-Check