Recent Advisories

Severity ID Title Vendor Product Date Type
NONE THN:425C8F77D2E...

ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API_THN:425C8F77D2E775E794A788739D4B6222

![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMMnC-1ujLiZRcV1xgXbB3qFoIREcbSiGqLCFID8-G-z8GFI3YEY8VniprVEBW4b4TZKJUvoRDg27elntNJW...

N/A N/A THN
NONE SCHNEIER:E75959...

Cybersecurity Mission Creep in the US_SCHNEIER:E759596C7E656DDAABCCFE50B4F0D1BE

Interesting paper: "Cybersecurity Mission Creep." > **Abstract:** Cybersecurity is experiencing mission creep. Policymakers are casting more and m...

N/A N/A SCHNEIER
NONE HACKREAD:E56D6B...

Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation_HACKREAD:E56D6B8E8719F548D5BBEDBAE6A485A9

A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in...

N/A N/A HACKREAD
NONE THN:952025EBFDC...

Identity Lifecycle Management Wasn’t Built for AI Agents _THN:952025EBFDC8E034F24F24D839ADBC97

![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwwp0Bf4s6Xp_L13nlIV5Pf2D0awJsA5cDdev6yCr9f7nLVbmJmzqJ01cmdJkO4K0E3KEvdHhK10ZDai_tXV...

N/A N/A THN
CRITICAL 10 A03A5F4B-FAEF-

vuln-research-mcp_A03A5F4B-FAEF-5645-B215-DA2D4B834049

Vulnerability Research MCP Server A vulnerability research MCP server designed for penetration testing experts. It integrates multiple vulnerabilit...

N/A N/A GITHUBEXPLOIT
MEDIUM 5.1 CVE-2026-54431

Improper Data Validation in liboauth2_CVE-2026-54431

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. R...

OpenIDC liboauth2 CVE
MEDIUM 5.1 CVE-2026-54430

Server-Site Request Forgery in liboauth2_CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and k...

OpenIDC liboauth2 CVE
HIGH 8.8 CVE-2026-57766

WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability_CVE-2026-57766

Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor

XplodedThemes WPIDE – File Manager & Code Editor n/a CVE
HIGH 8.5 CVE-2026-57765

WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability_CVE-2026-57765

Contributor SQL Injection in WP EasyCart

Levelfourdevelopment WP EasyCart n/a CVE
MEDIUM 6.5 CVE-2026-57764

WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability_CVE-2026-57764

Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode

Surbma Surbma | Yoast SEO Breadcrumb Shortcode n/a CVE