Articles

Meari SDK Flaw CVE-2026-33357 Leaks WAN IP of IoT Cameras

CVE-2026-33357 (CVSS 7.5) in Meari SDK lets attackers retrieve WAN IPs for any device via CloudEdge, Arenti, and white-label apps — no authentication required.

CVE-2026-33357

Microsoft Patches 120 Flaws in May 2026 Patch Tuesday Update

Industry NewsMay 12, 2026

Microsoft Patches 120 Flaws in May 2026 Patch Tuesday Update

Microsoft's May 2026 Patch Tuesday fixes 120 vulnerabilities across Windows 11 25H2, 24H2, and 23H2. KB5089549 and KB5087420 include security fixes, Xbox mode, and batch file...

CVE-2026-41103CVE-2026-40364CVE-2026-40361

Microsoft Patches 137 Flaws, SSO Plugin Bug Rated Critical

CVE-2026-41103 in Microsoft SSO Plugin for Jira & Confluence allows privilege escalation via flawed authentication.

4 min read

CVE-2026-34260CVE-2026-34263CVE-2026-34259

SAP Patches Critical S/4HANA, Commerce Flaws with 9.6 CVSS

SAP released 15 security notes for May 2026, fixing two critical code injection flaws in S/4HANA (CVE-2026-34260) and Commerce (CVE-2026-34263), both rated 9.6 CVSS, and a...

TrickMo Android Trojan Uses TON Blockchain for C2, SOCKS5 Pivots

MalwareMay 12, 2026

TrickMo Android Trojan Uses TON Blockchain for C2, SOCKS5 Pivots

ThreatFabric tracked a TrickMo variant using The Open Network (TON) for C2 and SOCKS5 proxies to pivot into victim networks, targeting banking and crypto users in France, Italy,...

3 min readTrickMo

UK Fines South Staffordshire Water $1.3M for 2022 Breach

Industry NewsMay 12, 2026

UK Fines South Staffordshire Water $1.3M for 2022 Breach

ICO fined South Staffordshire Water £963,900 after Cl0p ransomware gang leaked data of 663,887 customers — phishing attack went undetected for 20 months.

3 min readCl0p

Unauthenticated SQL Injection in MuuCMF T6 Allows Database Takeover

Unauthenticated SQL Injection in MuuCMF T6 Allows Database Takeover

CVE-2026-36962: Unauthenticated SQL injection in MuuCMF T6 v1.9.4.20260115 lets attackers dump databases, gain admin access, and achieve RCE via file writes.

CVE-2026-36962

West Pharma Hit by Ransomware, Systems Disrupted Globally

Industry NewsMay 12, 2026

West Pharma Hit by Ransomware, Systems Disrupted Globally

West Pharmaceutical Services took systems offline globally after a May 4 ransomware attack with data exfiltration. Unit 42 is investigating; ransom may have been paid.

2 min readLockBit

Active Directory Password Resets Fail to Expel Attackers

Industry NewsMay 11, 2026

Active Directory Password Resets Fail to Expel Attackers

Specops Software explains how cached credentials, Kerberos tickets, and ACL persistence let attackers survive password resets in AD and hybrid Entra ID environments.

Angular Expressions Sandbox Escape CVE-2026-44643 Allows RCE

VulnerabilitiesMay 11, 2026

Angular Expressions Sandbox Escape CVE-2026-44643 Allows RCE

CVE-2026-44643 in Angular Expressions <1.5.2 lets attackers escape the sandbox via malicious filter expressions to execute arbitrary code on the system.

CVE-2026-44643

Casdoor LFS Flaw CVE-2026-6815 Lets Admins Write Files Anywhere

VulnerabilitiesMay 11, 2026

Casdoor LFS Flaw CVE-2026-6815 Lets Admins Write Files Anywhere

CVE-2026-6815 in Casdoor's Local File System storage provider lets authenticated admins traverse paths to write arbitrary files outside the sandbox. No patch yet.

CVE-2026-6815

Corteza SQL Injection Flaw CVE-2026-6093 Lets Attackers Dump Databases

VulnerabilitiesMay 11, 2026

Corteza SQL Injection Flaw CVE-2026-6093 Lets Attackers Dump Databases

CVE-2026-6093: A SQL injection vulnerability in Corteza's MSSQL backend allows unauthenticated attackers to extract database contents via Compose record meta-field filters.

CVE-2026-6093