Aggregator

Malicious PDF reveals active Adobe Reader zero-day in the wild

Security Affairs
2 weeks 6 days ago
Hackers used an Adobe Reader zero-day for months. Researcher Haifei Li found a malicious PDF and asks the community to help analyze it. Hackers used an Adobe Reader zero-day for months to deliver a sophisticated PDF exploit. Cybersecurity researcher Haifei Li, founder of Expmon, discovered the malicious file and warned the community. On March 26, […]
Pierluigi Paganini

[un]prompted 2026 – Zeal Of The Convert: Taming Shai-Hulud With AI

Security Boulevard
2 weeks 6 days ago

Author, Creator & Presenter: Rami McCarthy, Principal Security Researcher At Wiz

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations' YouTube Channel.

Permalink

The post [un]prompted 2026 – Zeal Of The Convert: Taming Shai-Hulud With AI appeared first on Security Boulevard.

Marc Handelman

CVE-2026-1491

CVE Trends
2 weeks 6 days ago
Currently trending CVE - Hype Score: 2 - IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 IBM Security Verify could allow a remote attacker to ...

CVE-2026-0049

CVE Trends
2 weeks 6 days ago
Currently trending CVE - Hype Score: 1 - In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48651

CVE Trends
2 weeks 6 days ago
Currently trending CVE - Hype Score: 1 - In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for ...

CVE-2026-40072 | Ethereum web3.py up to 7.14.x/8.0.0b1 Backend Service eth_call/call offchain_lookup_payload["urls"] server-side request forgery

VulDB Recent Entries
2 weeks 6 days ago
A vulnerability categorized as critical has been discovered in Ethereum web3.py up to 7.14.x/8.0.0b1. This affects the function eth_call/call of the component Backend Service. Executing a manipulation of the argument offchain_lookup_payload["urls"] can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-40072. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.
vuldb.com

CVE-2026-40070 | sgbett bsv-ruby-sdk/bsv-sdk/bsv-wallet prior 0.8.2 WalletClient signature verification

VulDB Recent Entries
2 weeks 6 days ago
A vulnerability was found in sgbett bsv-ruby-sdk, bsv-sdk and bsv-wallet. It has been rated as critical. Affected by this issue is the function BSV::Wallet::WalletClient. Performing a manipulation results in improper verification of cryptographic signature. This vulnerability was named CVE-2026-40070. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.
vuldb.com

CVE-2026-40069 | sgbett bsv-ruby-sdk up to 0.8.1 Transaction BSV::Network txStatus unusual condition

VulDB Recent Entries
2 weeks 6 days ago
A vulnerability was found in sgbett bsv-ruby-sdk up to 0.8.1. It has been declared as problematic. Affected by this vulnerability is the function BSV::Network of the component Transaction Handler. Such manipulation of the argument txStatus leads to improper check for unusual conditions. This vulnerability is uniquely identified as CVE-2026-40069. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-40071 | pyLoad up to 0.5.0b3.dev96 WebUI JSON Endpoint /json/package_order authorization

VulDB Recent Entries
2 weeks 6 days ago
A vulnerability was found in pyLoad up to 0.5.0b3.dev96. It has been classified as problematic. Affected is an unknown function of the file /json/package_order of the component WebUI JSON Endpoint. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2026-40071. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.
vuldb.com

Managed ad