The Emergence of Fabricated Vulnerabilities Vulnerability databases recently received reports of critical SQLite flaws. These fictitious vulnerabilities boasted severity scores reaching a staggeri…

TL;DR A Linux kernel use-after-free in SCTP, tracked as CVE-2026-64564, allows local attackers to gain root. Researchers demonstrated privilege escalation and container-to-host escape on five dist…

TL;DR CVE-2026-63077 is a critical unauthenticated remote code execution flaw in JetBrains TeamCity. An attacker who reaches the server can run OS commands without credentials. CISA confirmed the …

TL;DR Metabase disclosed a critical SQL injection zero-day rated CVSS 10. An unauthenticated remote attacker can gain full administrator access to an instance. Metabase confirms active exploitatio…

TL;DR Cisco disclosed seven ClamAV vulnerabilities on August 7, 2026. Each lets an unauthenticated remote attacker crash the scanner with a crafted file. The result is a denial of service that sto…

TL;DR A weak random number generator inside CryptoJS produced predictable wallet seed phrases for over a decade. Attackers confirmed exploitation on-chain as early as May 27, 2026. Users who gener…

TL;DR WSO2 disclosed four critical vulnerabilities across its API and identity products. Several are WSO2 account takeover flaws. The worst, CVE-2026-5430, scores a maximum 10 through a JWT authen…

TL;DR VulnCheck found a Zbtlink router backdoor in every published firmware build across the product line. Named ENDLESSDOORS and tracked as CVE-2026-66747, it scores 9.8 on CVSS. It hands unauthe…

TL;DR Security researcher Hyunwoo Kim (@v4bel) disclosed a KVM escape vulnerability named Zapscape. Tracked as CVE-2026-64561, it lets a guest break out to the host. The attacker can then run comm…

A writeup about HTTP method override leading to massive PII exposure by Anukar.