Search: “code injection”

8 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 12 Vulnerability 9 Malware 7 Industry 6 Threat actor 6 Research 5 AI safety & security 4 Tools 2 Advisory 1 AI industry 1 AI tools & infra 1

SeverityAll critical 8 high 23 medium 8 low 1 info 14

CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Apache Syncope patches an important Groovy sandbox escape (CVE-2026-77147) allowing administrators to achieve code injection via empty CommandArgs.

CVE-2026-77147 is an important-severity improper control of code generation vulnerability in Apache Syncope, rated as a Groovy sandbox escape for empty CommandArgs. An administrator with adequate privileges can exploit the flaw to achieve code injection. Affected versions include syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-securitySep 14, 15:43 UTC · 1d agoVulnerability CVE-2026-77147

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.

Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.

Cyber Security News03:01 UTC · 6h agoVulnerability CVE-2026-91721 CVE-2026-91749 CVE-2026-91726+27 CVEs

Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.

Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.

GBHackers05:00 UTC · 4h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749+27 CVEs

Telegram Desktop Flaw Lets Attackers Steal Chat Messages Through Poisoned HTML Exports

Telegram Desktop XSS in bot inline keyboard buttons let attackers steal chat content from exported HTML archives; patched in 7.0.1.

ExPatch researchers Denis and Aleksander Rostilov found a stored cross-site scripting flaw in Telegram Desktop's HTML export feature, present since version 4.15.1 (March 2024). JavaScript hidden in bot inline keyboard button text executes when a user opens an exported chat HTML file with JavaScript enabled, exposing messages, metadata, and enabling DOM manipulation such as fake verification screens. Fixes shipped in Desktop Beta 6.9.4 (July 3, 2026) and Stable 7.0.1 (July 14, 2026), but previously exported HTML files remain unsafe.

Cyber Security NewsSep 15, 09:47 UTC · 23h agoVulnerability 2 sources

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackersSep 15, 11:24 UTC · 22h agoVulnerability 2 sources CVE-2026-78006 CVE-2026-78159

Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps

ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.

ExPatch researchers Denis and Aleksander Rostilov found a stored XSS flaw (CVSS 8.2) where bot inline keyboard button text was written unescaped into HTML chat exports, executing attacker JavaScript in browsers. The payload can persist in chat history for months, exfiltrate messages, metadata, and local file paths, and rewrite the page, spreading via forwarded messages without bot membership. Telegram fixed it by applying SerializeString(), first stable fixed release 7.0.1 shipped July 14, 2026, but HTML exports created with vulnerable versions remain dangerous.

Security AffairsSep 15, 07:48 UTC · 1d agoVulnerability1· 1 read

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Rootnew

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security News09:24 UTC · 18m agoVulnerability CVE-2026-90894

Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories

Stored XSS in Telegram Desktop HTML chat exports (CVSS 8.2) could let attacker-controlled inline keyboard buttons steal full chat histories.

ExPatch researchers Denis and Aleksander Rostilov found a stored XSS in Telegram Desktop's HTML chat export pipeline affecting builds before Beta 6.9.4 and Stable 7.0.1. Unsanitized inline keyboard button text becomes executable JavaScript when a user exports a chat and opens the HTML file in a browser, exposing messages, metadata, and local file paths, and enabling phishing overlays. Telegram patched the issue in commit 8457d13a during July 2026; no CVE had been assigned at disclosure time.

GBHackersSep 15, 10:11 UTC · 23h agoVulnerability