Stories tagged “Software Security.”
21 stories
A high-severity security flaw in Marimo's notebook software allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook. The vulnerability, tracked as CVE-2026-75149, affects versions prior to 0.23.15 and has be…
AI coding tools can introduce open-source packages at a pace security teams were never built to handle, leading to remediation debt and security work accumulating faster than teams can close it.
A critical security flaw in Keycloak's password reset feature allows unauthenticated attackers to take over any user account by forcing a password reset. Red Hat has released patches to address the issue.
Cisco has published security updates for Crosswork platforms and Secure Workload Software, addressing nine vulnerabilities, including five with a CVSS score of 10.0. The issues affect Cisco Crosswork Release version 7.2.1 and earlier and have been addressed in version 7.2…
A maximum-severity zero-day vulnerability in Metabase's business intelligence software is being actively exploited, allowing unauthenticated remote attackers to gain administrator access.
The article discusses the challenges faced by open source software in the current security landscape, where it is being forced to grow up and meet the demands of regulated enterprises. It highlights the need for open source projects to be accountable, reachable, and able …
Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review.
Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them.
A critical Active Storage vulnerability in Ruby on Rails allows unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. The flaw, tracked as CVE-2026-66066, can expose secrets such as secret_key_base, the Rails master key,…
2026 Minimum Elements for a Software Bill of Materials (SBOM)
CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners released joint guidance on the 2026 Minimum Elements for a Software Bill of Materials (SBOM). This updates and replaces the minimum elements for an SBOM published by the Na…
NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents. The alliance's first named technical contribution is NVIDIA-labs OO Agent…
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform.
A security researcher has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. The exploit is build-specific to GitLab 18.11.3 on x86-64 and affects broader releases.
NodeBB, a popular open-source forum software, has patched eight security flaws discovered by Aikido Security's AI pentest agents. The flaws, which affect all versions before 4.14.0, expose admin access and private chats. NodeBB has released a patch, and administrators are…
Google's DeepMind has announced the release of Gemini 3.5 Flash Cyber, a specialized AI model designed to discover, validate, and patch vulnerabilities quickly and efficiently. The model will be exclusively available to governments and trusted partners via CodeMender as p…
A new vulnerability in 7-Zip's XZ archive handler could let attackers run code on a machine by opening a crafted XZ archive. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data.
A critical NGINX vulnerability can crash workers and may allow remote code execution. The flaw, CVE-2026-42533, was patched in nginx 1.30.4 and 1.31.3, and in NGINX Plus 37.0.3.1.
Zoom has released urgent security updates for its Windows clients to address a critical vulnerability (CVE-2026-53412) that could allow unauthenticated account takeover.
Mozilla has released updates to address two critical flaws in Firefox, while Google has shipped fixes for 15 security flaws in Chrome, including two critical use-after-free bugs. Adobe has also published security updates for 88 vulnerabilities, including multiple critical…
Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers
CISA, NSA, and international partners have developed joint guidance on establishing a coordinated vulnerability disclosure program for software manufacturers and online service providers to work with external security researchers.
Grok Build, a coding CLI developed by xAI, was found to be uploading entire Git repositories to a Google Cloud Storage bucket, including files that were not read by the model. This behavior was discovered by a researcher who tested version 0.2.93 of the binary and found t…