Vulnerabilities
Anthropic's OSS Scanner offers free security flaw detection for open-source codebases
The AI firm introduces a new tool to help maintainers identify security flaws in their codebases without cost.
Vulnerabilities
Vulnerabilities coverage from Payload Report holds 16 articles, 8 of them reference guides. The newest was published on October 10, 2026. New stories are added as soon as they are confirmed, from more than 50 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include MITRE CWE and CISA Known Exploited Vulnerabilities Catalog.
Vulnerabilities
Blocksy Companion Auth Bypass Lets Attackers Publish Content Without Login
A critical flaw in the Blocksy Companion WordPress plugin lets attackers bypass security checks to seize seller roles and publish content without logging in.
Vulnerabilities
Smart Casa Deserialization Defect Scores 9.8 CVSS in NVD for Versions Through 1.0.12
National Vulnerability Database lists this deserialization defect as critical with a CVSS score of 9.8 for ThemeREX Group software.
Vulnerabilities
Vikunja 2.4.0 Fixes Critical IDOR in Task Collection Endpoint
Vikunja has released version 2.4.0 to address a critical flaw that allowed attackers to extract user data via unvalidated view IDs in share links.
Vulnerabilities
Vulnerability Scanning for Small Teams: Practical Steps and Limits
Automated scanning misses logic flaws and business logic errors that only manual review can find, making it a partial safety net rather than a full shield.
Vulnerabilities
Attack Surface Definition: How to Measure and Reduce Exposure
Your attack surface includes invisible data flows and legacy protocols that standard scanners miss entirely, creating hidden entry points for adversaries.
Vulnerabilities
Weak Password Policies Explained: Why Your Rules Fail
Tight rules often force users to reuse passwords, creating a wider attack surface than loose rules would.
Vulnerabilities
SBOM Checklist: Verify Components and Reduce Dependency Risk
A software bill of materials exposes hidden legacy code that creates silent entry points for attackers, regardless of your external security controls.
Vulnerabilities
How Penetration Testing Works: The Mechanics Behind the Breach
Penetration testing reveals how control failures chain together to create exploitable paths, exposing gaps that automated scanning tools consistently miss.
Vulnerabilities
IoT Vulnerability Myths: Why Common Security Beliefs Fail
Most IoT security failures stem from architectural oversights and supply chain gaps rather than weak passwords or outdated firmware versions.
Vulnerabilities
Bug Bounty Best Practices: Build a Program That Catches Real Threats
Most bug bounty failures stem from poor scope definition, leaving critical assets exposed while wasting resources on low-value noise.
Vulnerabilities
Prevent Server-Side Template Injection: Stop Code Execution
Template engines process data as code, meaning a single unsanitized input can bypass your firewall and execute commands directly on the host operating system.
Vulnerabilities
ONLYOFFICE Docs RCE via path traversal gets CISA KEV status, federal deadline Oct 11
Federal agency mandates urgent action for critical remote code execution flaw in document server software.
Vulnerabilities
Apache Struts RCE via DMI: Agencies Must Patch CVE-2016-3081 by Oct 11 After KEV Catalog Listing
Federal agencies must address CVE-2016-3081 in Apache Struts by mid-October following its addition to the Known Exploited Vulnerabilities catalog.
Vulnerabilities
AWS databases-on-aws plugin fix stops unauthenticated remote code execution in v1.7.1
Amazon Web Services has released a fix for a high-severity flaw allowing remote command execution via crafted database commands.
Vulnerabilities
Handlebars Remote Code Execution Bug in 4.0-4.7.9 Lets Attackers Inject JavaScript
A critical remote code execution vulnerability in Handlebars allows attackers to inject arbitrary JavaScript via manipulated AST objects, prompting an urgent update.