Stories tagged “Open Source Security.”
6 stories
A high-severity security flaw in Marimo's notebook software allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook. The vulnerability, tracked as CVE-2026-75149, affects versions prior to 0.23.15 and has be…
AI coding tools can introduce open-source packages at a pace security teams were never built to handle, leading to remediation debt and security work accumulating faster than teams can close it.
A maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, allows unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726, impacts all versions of the project before version 3.16.3.
A security researcher has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. The exploit is build-specific to GitLab 18.11.3 on x86-64 and affects broader releases.
A new WordPress core flaw, dubbed wp2shell, allows unauthenticated attackers to run code on a WordPress site. The bug is in core, making a bare install with zero plugins exploitable. WordPress has released 6.9.5 and 7.0.2 to fix the issue.
Injective Labs' GitHub repository was compromised, allowing threat actors to publish a malicious package on the npm registry that steals cryptocurrency wallet private keys and mnemonic seed phrases.