Researcher: Claude Dispatch Flaw Lets Browser Extension Run Code
November 6, 2026
Forever Security’s Gal Weizman says a Claude Dispatch flaw lets a browser extension send commands to Claude Desktop and run
News
Researcher: Claude Dispatch Flaw Lets Browser Extension Run Code
Forever Security's Gal Weizman says a Claude Dispatch flaw lets a browser extension send commands to Claude Desktop and run code; Anthropic has not fixed ...
Sonatype Fixes Seven Nexus Repository Flaws, Including CVSS 9.1 Bypass
Sonatype's Nexus Repository 3.98.0 fixes seven flaws, led by CVE-2026-113373, a CVSS 9.1 SAML and OAuth2 bypass that lets locked accounts sign back in.
Zoho Patches 11 ManageEngine Flaws in Log360 and Key Manager Plus
Zoho fixed 11 ManageEngine flaws, including CVE-2026-13594, a CVSS 9.1 access-control bug in Log360 and EventLog Analyzer, with no known exploitation.
CISA Flags Two Critical Flaws in Subnet PowerSYSTEM Center
CISA advisory ICSA-26-307-01 covers two CVSS 9.4 flaws in Subnet Solutions PowerSYSTEM Center, software used to manage power-grid equipment worldwide.
CISA Adds Apple CVE-2024-27834 to KEV After APT29 Phone Attacks
CISA added Apple's CVE-2024-27834 to its KEV catalog after Sekoia tied watering-hole attacks on iPhones and Android phones to Russia's APT29 hacking group.
Debian, Ubuntu Patch Critical APT Flaw CVE-2026-109518
Debian and Ubuntu patched CVE-2026-109518, a critical APT flaw that lets a network attacker swap a verified package for malicious code that installs as root.
Credit Mutuel Arkea Confirms Attack Tied to $133M Bank Theft
Credit Mutuel Arkea confirmed a sophisticated supplier-linked attack after ZachXBT reported more than $133 million stolen, saying customer accounts are safe.
Xen Flaws CVE-2026-102703, CVE-2026-102704 Break VM Isolation
Xen advisory XSA-523 covers two grant copy flaws that let a malicious guest read and write any other VM's memory, including dom0, with no known ...
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells on AI servers.
Ten Control Web Panel Flaws Chain Into Root RCE; PoC Public
VulnCheck disclosed ten Control Web Panel flaws that chain into unauthenticated root code execution, with a public exploit module and fixes in version 1.29.
Sonatype Fixes Seven Nexus Repository Flaws, Including CVSS 9.1 Bypass
November 6, 2026
Sonatype’s Nexus Repository 3.98.0 fixes seven flaws, led by CVE-2026-113373, a CVSS 9.1 SAML and OAuth2 bypass that lets locked
Zoho Patches 11 ManageEngine Flaws in Log360 and Key Manager Plus
November 6, 2026
Zoho fixed 11 ManageEngine flaws, including CVE-2026-13594, a CVSS 9.1 access-control bug in Log360 and EventLog Analyzer, with no known
CISA Flags Two Critical Flaws in Subnet PowerSYSTEM Center
November 6, 2026
CISA advisory ICSA-26-307-01 covers two CVSS 9.4 flaws in Subnet Solutions PowerSYSTEM Center, software used to manage power-grid equipment worldwide.
CISA Adds Apple CVE-2024-27834 to KEV After APT29 Phone Attacks
November 5, 2026
CISA added Apple’s CVE-2024-27834 to its KEV catalog after Sekoia tied watering-hole attacks on iPhones and Android phones to Russia’s
Debian, Ubuntu Patch Critical APT Flaw CVE-2026-109518
November 5, 2026
Debian and Ubuntu patched CVE-2026-109518, a critical APT flaw that lets a network attacker swap a verified package for malicious
Credit Mutuel Arkea Confirms Attack Tied to $133M Bank Theft
November 5, 2026
Credit Mutuel Arkea confirmed a sophisticated supplier-linked attack after ZachXBT reported more than $133 million stolen, saying customer accounts are
Xen Flaws CVE-2026-102703, CVE-2026-102704 Break VM Isolation
November 5, 2026
Xen advisory XSA-523 covers two grant copy flaws that let a malicious guest read and write any other VM’s memory,
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
November 5, 2026
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells
Ten Control Web Panel Flaws Chain Into Root RCE; PoC Public
November 5, 2026
VulnCheck disclosed ten Control Web Panel flaws that chain into unauthenticated root code execution, with a public exploit module and
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.