Talkback

AI Powered Infosec Resource Aggregator to Boost Productivity.

Developed by elttam

Resources See all

Calif Research unveiled WeWorm, a zero-click worm exploiting a WeChat VoIP vulnerability to spread via calls on iOS and Android, highlighting AI’s role in rapid bug discovery and urging industry collaboration for improved security.

Tue 8 Sep calif.io

MariaDB disclosed on HackerOne: Out-of-bounds read in MariaDB .frm... app exp

MariaDB's `.frm` parsing vulnerability allows remote attackers with certain privileges to craft malicious `.frm` files, enabling out-of-bounds reads and forging `Field` objects that lead to control-flow hijacking and arbitrary code execution within the `mariadbd` process.

Tue 8 Sep hackerone.com

MariaDB disclosed on HackerOne: MariaDB GRANT PROXY permits... exp app

A MariaDB user with only USAGE privileges can exploit GRANT PROXY and an empty authentication method to hijack an existing administrator account, escalating privileges to full DBA access without needing ALTER USER rights.

Mon 7 Sep hackerone.com

MariaDB disclosed on HackerOne: MariaDB: heap buffer overflow in... app

A heap-buffer overflow in MariaDB's Tina storage engine, caused by misusing `chain_size` as a byte count during `chain_append()`, enables attacker-controlled out-of-bounds writes via specific row deletion patterns, leading to remote denial of service with server hangs and crashes detectable by ASan.

Mon 7 Sep hackerone.com

MariaDB disclosed on HackerOne: KILL authorization trusts the... app

MariaDB fixed a security flaw where anonymous login fallback allowed attackers to kill other connections by checking the client-supplied username instead of the authenticated user, enabling privilege escalation.

Mon 7 Sep hackerone.com

MariaDB disclosed on HackerOne: ACL cache collision lets a role... app

MariaDB's privilege cache key mishandles role and UNIX-socket user lookups with identical names, enabling cache poisoning and privilege inheritance across principals.

Mon 7 Sep hackerone.com

Vulnerabilities See all

CVE-2026-48273 9.9

Awaiting Analysis

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit thi…

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws
...

Tue 8 Sep

CVE-2026-75746 9.1

Undergoing Analysis

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploi…

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Tue 8 Sep

CVE-2026-82004 10.0

Analyzed

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exp…

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Tue 8 Sep

CVE-2026-76969 9.4

Awaiting Analysis

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and ab…

SAP Patches Critical Extended Passport Processing Vulnerability

Tue 8 Sep

CVE-2026-66768 9.0

Awaiting Analysis

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected function…

SAP Patches Critical Extended Passport Processing Vulnerability

Tue 8 Sep

CVE-2026-58240 9.8

Awaiting Analysis

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an …

SAP Patches Critical Extended Passport Processing Vulnerability

Tue 8 Sep

Topics See all

Metabase Metabase

Business intelligence / analytics platform

Mathspace Data Breach Exposes Over 1 Million People
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
14,000 Trezor Customers Impacted by Data Breach at ShipMonk
...

Mon 14 Sep

RouterOS MikroTik

Network operating system / router firmware

GitHub - dinosn/mikrotrick-poc: CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC
MikroTik Patches Critical Flaws Chained to Hack Routers
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
...

Mon 14 Sep

ChatGPT OpenAI

Large language model (LLM)

ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
Frontier Models’ Vulnerability Patches are Often F.L.A.W.E.D. - Fix-Like Artifacts With Embedded Defects: Common failure modes of LLM-generated security patches
...

Mon 14 Sep

PowerShell Microsoft

Scripting/automation framework

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve
또 김수키? 이번엔 수산 식자재 구매 요청서로 위장
...