Articles

Palo Alto GlobalProtect Flaws Let Attackers Intercept Encrypted

VulnerabilitiesMay 15, 2026

Palo Alto GlobalProtect Flaws Let Attackers Intercept Encrypted

CVE-2026-0249: Multiple improper certificate validation flaws in Palo Alto Networks GlobalProtect app let local or same-subnet attackers intercept encrypted traffic and install...

CVE-2026-0249

protobufjs Flaw CVE-2026-45740 Enables DoS via Deeply Nested JSON

VulnerabilitiesMay 15, 2026

protobufjs Flaw CVE-2026-45740 Enables DoS via Deeply Nested JSON

CVE-2026-45740 (CVSS 7.5) in protobufjs lets attackers crash Node.js apps by sending crafted JSON descriptors with deeply nested namespaces — affects versions before 7.5.8 and...

CVE-2026-45740

AI Hallucinations Exploit Human Trust in Critical Infrastructure

AI Hallucinations Exploit Human Trust in Critical Infrastructure

AI models produce confident but incorrect outputs that have led to misconfigured firewalls and pipeline valve errors, researchers warn.

AI Security Startup Funding Surpasses Acquisitions by $1B in 1Q26

INFORMATIONAL

AI Security Startup Funding Surpasses Acquisitions by $1B in 1Q26

Dark Reading reports AI security startup investments exceeded acquisition value by over $1 billion in 1Q26, signaling a widening 'valley of death' for maturing firms.

2 min read

Cisco Catalyst SD-WAN Controller Flaw CVE-2026-20182 Scores Perfect

CRITICAL

CVE-2026-20182CVE-2026-20127

Cisco Catalyst SD-WAN Controller Flaw CVE-2026-20182 Scores Perfect

Rapid7 discovered CVE-2026-20182, a 10.0-CVSS authentication bypass in Cisco Catalyst SD-WAN Controller. Unauthenticated attackers can inject SSH keys and issue NETCONF commands.

4 min read

CRITICAL

CVE-2026-42945CVE-2026-41225CVE-2026-41957+2

F5 Patches 51 Flaws: NGINX DoS, BIG-IP RCE Among Critical Fixes

F5 fixed 19 high-severity and 32 medium-severity bugs across BIG-IP, BIG-IQ, and NGINX. The most severe, CVE-2026-42945 (CVSS 9.2), enables heap overflow DoS in NGINX rewrite...

4 min read

Hackers Exploit PraisonAI Auth Bypass Hours After Disclosure

Hackers Exploit PraisonAI Auth Bypass Hours After Disclosure

Sysdig detected CVE-2026-44338 exploitation attempts within 3 hours 44 minutes of public advisory — attackers probed /agents on exposed PraisonAI instances.

CVE-2026-44338

Hono Patches CSS Injection and Cache Poisoning Flaws

MEDIUM

CVE-2026-44457CVE-2026-44458

Hono Patches CSS Injection and Cache Poisoning Flaws

Hono 4.12.18 fixes CVE-2026-44458 (CSS injection in JSX renderer, CVSS 4.3) and CVE-2026-44457 (cache poisoning via Vary header bypass, CVSS 5.3).

4 min read

Malwarebytes Blocks Suspicious Yahoo Mail Redirects to Opaque Domains

MEDIUM

Malwarebytes Blocks Suspicious Yahoo Mail Redirects to Opaque Domains

Malwarebytes blocks background connections from Yahoo Mail to domains like cook.howduhtable.com — third-party infrastructure with poor reputation and opaque redirect chains.

Mythos AI Excels at Code Audits but Struggles With Exploit Validation

INFORMATIONAL

AI SecurityMay 14, 2026

Mythos AI Excels at Code Audits but Struggles With Exploit Validation

XBOW benchmarks show Anthropic's Mythos AI is potent for source code audits and reverse engineering, but inconsistent at exploit validation and prone to overstating findings.

NIST NVD Enrichment Change Creates CVSS Gap for 80% of CVEs

MEDIUM

NIST NVD Enrichment Change Creates CVSS Gap for 80% of CVEs

NIST now enriches only 15-20% of CVEs under new policy as of April 2026, leaving 80% without CVSS scores or product mappings.