The 9.1-CVSS vulnerability enables attackers to circumvent RCE protections in the de facto template engine for the Java Spring ecosystem.

The prompt-injection issue in the agentic AI product for filesystem operations was a sanitization issue that allowed for ...

If you are a CIO or CISO evaluating an agentic AI platform, ask the same questions you would ask about any enterprise ...

A design choice in the MCP SDKs allows remote code execution across the AI supply chain.

A prompt injection flaw in Google’s Antigravity IDE turns a file search tool into a remote code execution vector, bypassing ...

Progress has released patches for multiple remote code execution and OS command injection flaws in MOVEit WAF and LoadMaster.

Microsoft assigned CVE-2026-21520, a CVSS 7.5 indirect prompt injection vulnerability, to Copilot Studio. Capsule Security discovered the flaw, coordinated disclosure with Microsoft, and the patch was ...

A zero-day vulnerability exists in FortiClient EMS, which attackers are already exploiting in the wild. This allows them to inject and execute malicious code without prior authentication. Fortinet ...

Fortinet deployed an emergency patch for yet another zero-day vulnerability that has been exploited in the wild. On Saturday, Fortinet disclosed CVE-2026-35616, which it described as an improper ...

Over 750,000 websites require patching following discovery of DotNetNuke XSS vulnerability ...