Topic

#Vulnerability

15 articles on Vulnerability — news, releases, guides and analysis from the SourceFeed engine.

CosmosEscape: One Key Unlocked Every Azure Cosmos DB

Wiz's second Cosmos DB break in five years exposed a platform-wide master key — and the auth model most apps still trust.

Emeka Okafor

Attackers Found Cisco's Hardcoded FMC Password Before You Did

CVE-2026-20316 shows why CVSS-based triage fails when the firewall management plane is the target.

Article · 2w ago2

Tailscale SSH Flag Injection Broke Non-Root ACLs

A getent argument-handling bug let any allowed SSH user become root with the username -i.

Article · 4w ago1

Motorola MR2600 LAN RCE via Firmware Path

Two broken auth checks plus unsigned SEAMA images let any LAN host flash and own the gateway.

Article · 1mo ago0

GhostLock: The 15-Year-Old Linux Kernel Bug That Defeated Lockdep

A deep dive into CVE-2026-43499, a stack use-after-free in the rtmutex subsystem affecting nearly every Linux distribution.

Article · 1mo ago0

OpenBSD kernel race gives local users a root shell

CVE-2026-57589 is a use-after-free in the SysV semaphore path, hard to exploit but total in impact.

News · 1mo ago2

Januscape: The 16-Year-Old KVM Flaw Breaking x86 Isolation

A cross-architecture guest-to-host escape in the KVM shadow MMU threatens multi-tenant cloud infrastructure and nested virtualization.

Article · 1mo ago0

Why Apple's Hide My Email Leak Is an Architectural Warning

A year-old unfixed vulnerability exposing real iCloud email addresses highlights the fragility of relying on platform-level privacy proxies.

Article · 1mo ago5

Inside the Active Exploitation of Oracle EBS Payment Gateways

Attackers are using private exploits against a critical Oracle Payments vulnerability to hijack exposed enterprise systems.

Article · 1mo ago0

The MCP Security Blind Spot in AI Coding Assistants

A high-severity flaw in Amazon Q Developer highlights how repository-carried configuration files are turning simple git clones into cloud compromises.

Article · 1mo ago0

The Cordyceps Exploits: Why Your CI/CD Pipelines Are Wide Open

A systemic workflow composition flaw exposes hundreds of major repositories, proving we must stop treating CI/CD as passive configuration.

Article · 1mo ago0

GitHub Hardens actions/checkout to Block Pwn Request Attacks

The latest security update stops common pipeline exploits but leaves structural CI/CD risks for developers to manage.

Article · 1mo ago0

Anatomy of a 27-Year-Old OpenBSD Authentication Bypass

A simple validation omission in OpenBSD's PPP stack shows how easily decoupled memory bounds can compromise system security.

Article · 1mo ago0

Critical Ivanti Sentry RCE Under Active Exploitation

A maximum-severity unauthenticated command injection vulnerability in Ivanti Sentry is being actively targeted following a public exploit release.

News · 2mos ago0

How an Insecure Update Flow Exposed AMD Systems to RCE

A trivial MITM vulnerability in AMD's AutoUpdate tool highlights the risks of ignoring transport security in software updates.

Article · 2mos ago0