8 stories, newest first · one card per story
The exposeServiceMetadata service parameter is enforced only on ?wsdl, ?wsdl2 and ?xsd queries, allowing forced browsing of .wsdl and .xsd routes in Apache Axis2/Java before 2.0.2.
Even encrypted relays can reveal that two radios communicated, exposing both origin and destination locations.
Apache Kylin 4.0.0–5.0.4 may allow unauthenticated replacement of job metadata if services are exposed.
Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.
A follow-up corrects the VCS repository cited for Catalyst::Seal CVE-2026-85491, citing bad module metadata.
npm keeps timestamps for removed package versions but drops the removal reason, hindering supply-chain response.
Attackers exploited a Gyazo upload-server vulnerability, exposing 24 million user records and 490 million metadata records including IPs, EXIF locations and OCR text.
Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.
Today 1.5K readers · 2.4K views · 757 reads · all time 189K views