A critical CI/CD flaw in remote caches allows undetectable code injection and privilege escalation via cache poisoning, bypassing all security controls.

A write-up covering XSS, HTML Injection, and SSTI in real-world web applications

This article was originally published on May 6, 2021, written by Ted Udelson

Amazon was forced to withdraw a compromised version of its AI assistant, Q, after a malicious pull request instructed it to delete local files and AWS resources.

SAP’s August 2025 Patch Day fixes critical code injection flaws in S/4HANA and SLT that could allow full ERP compromise via RFC exploits.

NVIDIA released an urgent update for its Megatron-LM LLM framework, patching four high-severity code injection flaws that could allow attackers to compromise AI workflows.

CISA added two critical DELMIA Apriso flaws (CVE-2025-6204/6205) to its KEV Catalog due to active exploitation. The flaws risk RCE and privileged access to manufacturing management systems.

Self process injection occurs when a program loads or executes a malicious payload in its own address space (rather than writing to or…

NVIDIA patched two High-severity flaws in its NeMo Framework. CVE-2025-23361 and CVE-2025-33178 allow local code injection and privilege escalation in AI training environments. Update to v2.5.0.

NVIDIA patches two high-severity code injection flaws (CVE-2025-33183/4) in Isaac-GROOT, risking code execution & privilege escalation in robotics.

SAP's final patch of 2025 fixes a Critical Code Injection flaw (CVSS 9.9) in Solution Manager risking full system control. Also patched: Tomcat flaws (9.6) in Commerce Cloud and jConnect RCE.

Critical Orval flaw CVE-2026-25141 (CVSS 9.3) allows code injection via OpenAPI comments. 2.8M+ downloads affected. Update to v7.21.0 now.

SAP Feb 2026 update fixes critical CVE-2026-0488 (CVSS 9.9). Code injection in CRM & S/4HANA allows full database compromise. Patch immediately.

NVIDIA has released a critical software update for its Megatron Bridge, a key component used in training large language models (LLMs). The bulletin discloses two high-severity vulnerabilities hidd…

CISA adds critical Ivanti EPMM flaw (CVE-2026-1340) to KEV catalog. The 9.8 CVSS code injection allows unauthenticated RCE. Patch mandated by April 11!

A critical injection flaw (CVE-2026-40563) in Apache Atlas lets attackers manipulate Gremlin logic to extract restricted enterprise data. Patch to v2.5.0!

CVE-2026-46442 in Flowise allows authenticated users to escape the NodeVM sandbox and execute system commands. Secure your AI infrastructure now!

The Dangerous Scope of Browser Data Exfiltration Artificial Intelligence has rapidly transformed how we work and communicate every single day. Therefore, millions of professionals now rely on auto…

NVIDIA has issued an urgent fix for its NeMo Framework, the popular open-source toolkit for building generative AI models. The update tackles an NVIDIA NeMo vulnerability set spanning three separa…

TL;DR SonicWall has released hotfixes for two actively exploited flaws in SMA1000 secure access appliances. The SonicWall SMA1000 SSRF vulnerability, tracked as CVE-2026-15409, carries a maximum C…