News

2 stories in the last 24h

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Advisory 64 AI industry 42 Vulnerability 39 AI research 31 AI safety & security 30 Exploit / PoC 28 Research 24 Industry 22 Data breach 17 Threat actor 13 Malware 11 Tools 11 Policy & legal 9 Phishing & fraud 9

SeverityAll critical 9 high 67 medium 84 low 19 info 190

CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).

Apache NiFi 2.11.0 supports migrating version-controlled Process Group contents into a Connector via REST API methods that list eligible migration sources and submit migration requests. Both methods were authorized only against the target Connector, without evaluating user access to the involved Process Groups. The flaw, tracked as CVE-2026-86089, is rated Low severity and affects the nifi-web-api component.

oss-securitySep 16, 15:19 UTC · 16h agoVulnerability 4 sources CVE-2026-86089

Multiple vulnerabilities in Jenkins plugins

Jenkins releases security fixes for multiple plugins including Bitbucket, GitLab, Gitee, Coverage, and Gradle integrations.

Jenkins published security updates for several plugins, including Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, GitLab Plugin 1.2152.veec0897048b_0, and the Gradle Plugin. The announcement is a routine open-source security release notice without exploit details.

oss-securitySep 16, 15:09 UTC · 16h agoVulnerability 2 sources1