Posts of last 24 hours

CVE-2025-15646 | BPS HTML::Gumbo up to 0.18 on Perl lib/HTML/Gumbo.xs strlen type confusion
A vulnerability was found in BPS HTML::Gumbo up to 0.18 on Perl. It has been declared as critical. This affects the function strlen in the library lib/HTML/Gumbo.xs. The manipulation results in type confusion. This vulnerability is known as CVE-2025-15646. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/375571
CVE-2026-13706 | Wikimedia UrlShortener up to 1.46.0/1.45.4/1.44.6/1.43.9 input validation
A vulnerability was found in Wikimedia UrlShortener up to 1.46.0/1.45.4/1.44.6/1.43.9. It has been classified as critical. The impacted element is an unknown function. The manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-13706. It is possible to initiate the attack remotely. There is no exploit available.
https://vuldb.com/vuln/375570
CVE-2026-24245 | NVIDIA Megatron-Bridge on Linux deserialization
A vulnerability was found in NVIDIA Megatron-Bridge on Linux and classified as critical. The affected element is an unknown function. Executing a manipulation can lead to deserialization. This vulnerability appears as CVE-2026-24245. The attack requires local access. There is no available exploit.
https://vuldb.com/vuln/375569
CVE-2026-24244 | NVIDIA Megatron-Bridge on Linux deserialization
A vulnerability has been found in NVIDIA Megatron-Bridge on Linux and classified as critical. Impacted is an unknown function. Performing a manipulation results in deserialization. This vulnerability is reported as CVE-2026-24244. The attack requires a local approach. No exploit exists.
https://vuldb.com/vuln/375568
CVE-2026-24243 | NVIDIA Megatron-Bridge on Linux deserialization
A vulnerability, which was classified as critical, was found in NVIDIA Megatron-Bridge on Linux. This issue affects some unknown processing. Such manipulation leads to deserialization. This vulnerability is documented as CVE-2026-24243. The attack needs to be performed locally. There is not any exploit available.
https://vuldb.com/vuln/375567
CVE-2026-24240 | NVIDIA Megatron-Bridge on Linux deserialization
A vulnerability, which was classified as critical, has been found in NVIDIA Megatron-Bridge on Linux. This vulnerability affects unknown code. This manipulation causes deserialization. This vulnerability is registered as CVE-2026-24240. The attack needs to be launched locally. No exploit is available.
https://vuldb.com/vuln/375566
CVE-2026-13707 | Wikimedia OAuth up to 1.46.0/1.45.4/1.44.6/1.43.9 /Backend/MWOAuthServer session fixiation
A vulnerability classified as critical was found in Wikimedia OAuth up to 1.46.0/1.45.4/1.44.6/1.43.9. This affects an unknown part of the file /Backend/MWOAuthServer. The manipulation results in session fixiation. This vulnerability is cataloged as CVE-2026-13707. The attack may be launched remotely. There is no exploit available.
https://vuldb.com/vuln/375565
Hackers target Microsoft 365 accounts with 81 million login attempts
An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period. [...]
https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-365-accounts-with-81-million-login-attempts/
Indian Govt Halts Meta’s WhatsApp Usernames Rollout Over Fraud Concerns

The Indian government has issued a formal notice to WhatsApp LLC (Meta), directing the platform to justify why regulatory action should not be taken against its newly announced “usernames” feature and instructing the company not to roll it out in India until consultations are satisfactorily concluded. The letter, addressed to WhatsApp’s Chief Compliance Officer for […]

The post Indian Govt Halts Meta’s WhatsApp Usernames Rollout Over Fraud Concerns appeared first on Cyber Security News.

https://cybersecuritynews.com/indian-govt-whatsapp-usernames/
Critical Cursor IDE RCE Vulnerabilities Enable Prompt Injection in Zero-Click

Two critical remote code execution (RCE) vulnerabilities in Cursor IDE, the AI-powered development environment used by more than half of Fortune 500 companies. Cato AI Labs has disclosed two flaws, dubbed ” DuneSlide, ” both of which carry a 9.8 CVSS severity score and were assigned CVE-2026-50548 and CVE-2026-50549, allowing attackers to break out of […]

The post Critical Cursor IDE RCE Vulnerabilities Enable Prompt Injection in Zero-Click appeared first on Cyber Security News.

https://cybersecuritynews.com/cursor-ide-rce-vulnerabilities/

Managed ad