JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild
November 4, 2026
JPCERT/CC warns that a CVSS 9.9 code-execution flaw in self-managed Airbyte before 2.2.0 is being exploited in the wild; Airbyte
Application Security
JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild
JPCERT/CC warns that a CVSS 9.9 code-execution flaw in self-managed Airbyte before 2.2.0 is being exploited in the wild; Airbyte Cloud users need no action.
Public Exploit Released for Puppet Server RCE CVE-2026-115731
A working exploit is public for CVE-2026-115731, a CVSS 9.4 remote code execution flaw in Puppet Server and OpenVox that can hand attackers the CA ...
24,664 Lovable-Built Apps Leak Passports and Chat Messages
Crissy Field found 24,664 Lovable-built apps on Supabase returning database records with no authentication, exposing passports, payments and chat messages.
Attackers Exploit CVSS 10.0 Node-RED Flaw CVE-2026-58115
VulnCheck caught attackers exploiting CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Node-RED, to drop Linux bots on exposed Siemens devices.
BTCPay Server Hot Wallets Drained on Outdated Instances
Attackers drained Bitcoin and Litecoin hot wallets on BTCPay Server instances running version 2.4.1 or older, and the project urges updating to 2.4.7.
cPGuard Update Channel Hijacked to Push Linux Server Backdoor
An attacker used stolen credentials to push a malicious script through OPSSHIELD's cPGuard update channel, installing a backdoor and stealing root SSH keys.
Russian and Ukrainian Emergency Alert Apps Hacked, Fake Warnings Sent
Ukraine's Air Alert app and Russia's Emergency Ministry app were hacked to send fake nuclear, chemical and missile warnings, though national alert systems held.
Unpatched CVSS 10.0 CryptoPayment Gateway Plugin Flaw Under Attack
Attackers are targeting CVE-2026-81648, an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that exposes wallet credentials in cleartext.
Apache Fixes Eight Flaws in Syncope, Fineract and Arrow
Apache patched eight flaws in Syncope, Fineract and Arrow Rust, including CVE-2026-64618, a CVSS 9.8 SQL injection needing no login; no exploitation reported.
Apache Wicket Discloses 19 Vulnerabilities Across Three Release Lines
Apache Wicket disclosed 19 vulnerabilities across versions 8.x, 9.x and 10.x, including XSS, missing authorization and upload DoS bugs. Upgrade to 10.12.0.
Public Exploit Released for Puppet Server RCE CVE-2026-115731
November 4, 2026
A working exploit is public for CVE-2026-115731, a CVSS 9.4 remote code execution flaw in Puppet Server and OpenVox that
24,664 Lovable-Built Apps Leak Passports and Chat Messages
November 4, 2026
Crissy Field found 24,664 Lovable-built apps on Supabase returning database records with no authentication, exposing passports, payments and chat messages.
Attackers Exploit CVSS 10.0 Node-RED Flaw CVE-2026-58115
November 3, 2026
VulnCheck caught attackers exploiting CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Node-RED, to drop Linux bots on exposed Siemens devices.
BTCPay Server Hot Wallets Drained on Outdated Instances
November 3, 2026
Attackers drained Bitcoin and Litecoin hot wallets on BTCPay Server instances running version 2.4.1 or older, and the project urges
cPGuard Update Channel Hijacked to Push Linux Server Backdoor
November 3, 2026
An attacker used stolen credentials to push a malicious script through OPSSHIELD’s cPGuard update channel, installing a backdoor and stealing
Russian and Ukrainian Emergency Alert Apps Hacked, Fake Warnings Sent
November 3, 2026
Ukraine’s Air Alert app and Russia’s Emergency Ministry app were hacked to send fake nuclear, chemical and missile warnings, though
Unpatched CVSS 10.0 CryptoPayment Gateway Plugin Flaw Under Attack
November 3, 2026
Attackers are targeting CVE-2026-81648, an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that exposes wallet credentials in
Apache Fixes Eight Flaws in Syncope, Fineract and Arrow
November 3, 2026
Apache patched eight flaws in Syncope, Fineract and Arrow Rust, including CVE-2026-64618, a CVSS 9.8 SQL injection needing no login;
Apache Wicket Discloses 19 Vulnerabilities Across Three Release Lines
November 2, 2026
Apache Wicket disclosed 19 vulnerabilities across versions 8.x, 9.x and 10.x, including XSS, missing authorization and upload DoS bugs. Upgrade
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.