Tag: flaw
-
Android’s March 2026 security patch fixes over 100 flaws, one under targeted exploitation
The Android March 2026 security patch addresses vulnerabilities across dozens of components and includes one CVE confirmed under active exploitation. Devices running a patch … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/03/android-march-2026-security-patch-cve-2026-21385/
-
Android gets patches for Qualcomm zero-day exploited in attacks
Google has released security updates to patch 129 Android security vulnerabilities, including an actively exploited zero-day flaw in a Qualcomm display component. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-patches-android-zero-day-actively-exploited-in-attacks/
-
MS-Agent Vulnerability Exposes AI Agents to Remote Hijacking, Granting Full System Control
A critical vulnerability has been discovered in the MS-Agent framework, a lightweight software tool used to build and run autonomous AI agents. Tracked as CVE-2026-2256, this command injection flaw allows remote attackers to hijack these AI agents, potentially granting them full control over the underlying computer systems. MS-Agent is designed to help developers create AI…
-
Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited
Google on Monday disclosed that a high-severity security flaw impacting an open-source Qualcomm component used in Android devices has been exploited in the wild.The vulnerability in question is CVE-2026-21385 (CVSS score: 7.8), a buffer over-read in the Graphics component.”Memory corruption when adding user-supplied data without checking available buffer space,” Qualcomm said in an advisory, First…
-
Hackerbot-Claw Bot Exploits GitHub Actions CI/CD Flaw to Attack Microsoft and DataDog
Tags: ai, attack, automation, cyber, exploit, flaw, github, microsoft, open-source, remote-code-executionHackerbot-claw, an autonomous AI bot, has launched a week-long campaign abusing GitHub Actions misconfigurations to hit CI/CD pipelines at Microsoft, DataDog, and other major open-source projects, achieving remote code execution (RCE) and even full repo compromise in some cases. The attacks highlight how unsafe pull_request_target workflows and shell interpolation bugs can turn routine automation into…
-
Angular i18n Flaw Lets Hackers Execute Malicious Code via Critical XSS Vulnerability
A high-severity security flaw has been discovered in Angular, one of the most popular web application frameworks. This vulnerability, tracked as CVE-2026-27970, affects the framework’s internationalization (i18n) pipeline. If exploited, it allows attackers to execute malicious code within an application, posing a significant risk to user data and application integrity. The Core of the Vulnerability…
-
Android Security Update Fixes 129 Flaws and Tackles Actively Exploited Zero-Day Flaw
Google has rolled out the highly anticipated March 2026 Android Security Bulletin, delivering critical fixes for 129 security vulnerabilities across the Android ecosystem. This massive update represents one of the highest numbers of patches issued in a single month. The rollout is structured into two distinct security patch levels, 2026-03-01 and 2026-03-05, giving device manufacturers…
-
Critical OpenClaw Vulnerability Exposes AI Agent Risks
The now-patched flaw is the latest in a growing string of security issues associated with the viral AI tool, which has seen rapid adoption among developers. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/critical-openclaw-vulnerability-ai-agent-risks
-
Latest OpenClaw Flaw Can Let Malicious Websites Hijack Local AI Agents
Oasis Security researchers find another security problem with the OpenClaw autonomous AI agent, uncovering a vulnerability dubbed “ClawJacked” that allows malicious websites to silently take full control of a developer’s system and steal data. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/latest-openclaw-flaw-can-let-malicious-websites-hijack-local-ai-agents/
-
New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel
Cybersecurity researchers have disclosed details of a now-patched security flaw in Google Chrome that could have permitted attackers to escalate privileges and gain access to local files on the system.The vulnerability, tracked as CVE-2026-0628 (CVSS score: 8.8), has been described as a case of insufficient policy enforcement in the WebView tag. It was patched by…
-
TPMS Flaw in Toyota, Mercedes, and Other Major Brands Enables Covert Vehicle Tracking
Tire pressure monitoring systems (TPMS) in popular brands like Toyota, Mercedes, and many others quietly broadcast radio signals that can be turned into a powerful vehicle”‘tracking tool. New research shows that these routine safety messages can be harvested at scale, allowing anyone with cheap hardware to map where cars go, when they move, and even…
-
MSHTML Zero-Day in Windows Exploited by APT28 Prior to Feb 2026 Security Update
Microsoft released its Patch Tuesday updates, addressing 59 vulnerabilities, including a critical zero-day flaw in the Windows MSHTML framework. Tracked as CVE-2026-21513, this actively exploited vulnerability allows attackers to bypass security features and execute arbitrary code. APT28 is a well-documented advanced persistent threat group known for sophisticated malware campaigns. Security researchers from Akamai discovered that…
-
ProofConcept Released for Windows ALPC Privilege Escalation via Error Reporting
A critical local privilege escalation (LPE) vulnerability, identified as CVE-2026-20817, has been publicly documented following the release of a proof-of-concept (PoC) exploit. Discovered in the Windows Error Reporting (WER) service, the flaw allows an authenticated, low-privileged user to execute arbitrary code with SYSTEM-level access. Vulnerability Overview Feature Details CVE ID CVE-2026-20817″‹ Severity Score CVSS 7.8…
-
UXSS Vulnerability in DuckDuckGo Browser’s AutoConsent JS Bridge Allows Cross-Origin Attacks
A critical vulnerability was recently discovered in the DuckDuckGo browser for Android, exposing users to Universal Cross-Site Scripting (UXSS) attacks. This flaw, found in the browser’s AutoConsent JS bridge, allows malicious code from an untrusted source to run on a trusted webpage. Security researcher Dhiraj Mishra reported the vulnerability via HackerOne. It has since been…
-
OneUptime Command Injection Vulnerability Poses Major Risk of Full System Takeover
A critical command injection vulnerability, identified as CVE-2026-27728, has been discovered in OneUptime, a platform for monitoring and managing online services. This flaw allows authenticated users to execute arbitrary operating system commands on the Probe server, posing a significant risk of a full system takeover. Organizations using versions prior to 10.0.7 are urged to patch…
-
ClawJacked flaw exposed OpenClaw users to data theft
“ClawJacked” flaw let malicious sites hijack OpenClaw AI agents to steal data; patch released in version 2026.2.26. A high-severity vulnerability called ClawJacked in OpenClaw allowed malicious websites to brute-force and take control of local AI agent instances. Oasis Security discovered the flaw, which enabled silent data theft. OpenClaw addressed the issue with version 2026.2.26, released…
-
ClawJacked flaw exposed OpenClaw users to data theft
“ClawJacked” flaw let malicious sites hijack OpenClaw AI agents to steal data; patch released in version 2026.2.26. A high-severity vulnerability called ClawJacked in OpenClaw allowed malicious websites to brute-force and take control of local AI agent instances. Oasis Security discovered the flaw, which enabled silent data theft. OpenClaw addressed the issue with version 2026.2.26, released…
-
GUEST ESSAY: Real cyber risks arise when small flaws combine and alerts are viewed in isolation
Security teams are drowning in signals. Alerts fire. Logs accumulate. Dashboards light up. Yet breaches still unfold quietly, often through a series of low-level actions that never trigger a single catastrophic alarm. Related: How ‘observability’ drives security Attackers do not… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/guest-essay-real-cyber-risks-arise-when-small-flaws-combine-and-alerts-are-viewed-in-isolation/
-
Purpose-built AI Security Agent Detected 92% of DeFi Contracts Vulnerabilities
Baseline coding agents didn’t fare too well against purpose-built AI security agents in detecting flaws in DeFi contracts underscoring that organizations must not rely on audits and must press AI into use for detecting vulnerabilities. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/purpose-built-ai-security-agent-detected-92-of-defi-contracts-vulnerabilities/
-
ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket
OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control.”Our vulnerability lives in the core system itself no plugins, no marketplace, no user-installed extensions just the bare OpenClaw gateway, running exactly as documented,” Oasis…
-
iOS Penetration Testing: Definition, Process and Tools
Tags: breach, control, data, flaw, iphone, penetration-testing, reverse-engineering, tool, vulnerabilityWhile iPhones boast robust security, attackers constantly seek weak points. Enter iOS penetration testing the security validation exercise against your controls attempting to stop data breaches and unauthorised access. Through manual and automated techniques like vulnerability scanning and reverse engineering, it uncovers hidden flaws in your iOS apps, protecting sensitive data and user trust…. First…
-
Lovable-hosted app littered with basic flaws exposed 18K users, researcher claims
Who’s to blame the vibey platforms or the humans who ignore security warnings? First seen on theregister.com Jump to article: www.theregister.com/2026/02/27/lovable_app_vulnerabilities/
-
Security hole could let hackers take over Juniper Networks PTX core routers
The hole is “especially dangerous, because these devices often sit in the middle of the network, not on the fringes,” said Piyush Sharma, CEO of Tuskira. “If an attacker gains control of a PTX, the impact is bigger than a single device compromise because it can become a traffic vantage point and a control point…
-
Juniper PTX Flaw Could Allow Full Router Takeover
A critical Juniper flaw could let attackers take full control of PTX core routers. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/juniper-ptx-flaw-could-allow-full-router-takeover/
-
FreeBSD Jail Escape Flaw Breaks Filesystem Isolation
Tags: flawFreeBSD patched a critical jail escape flaw that can break filesystem isolation and expose the host system. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/freebsd-jail-escape-flaw-breaks-filesystem-isolation/
-
Trend Micro Patches Critical Apex One RCE Flaws
Trend Micro has fixed critical Apex One flaws that could enable remote code execution. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/trend-micro-patches-critical-apex-one-rce-flaws/