⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
This article describes a critical vulnerability in Gitea that allows unauthenticated attackers to read arbitrary server files. The flaw, CVE-2026-59774, is triggered through the markup rendering endpoint using Org-mode markup on a public repository.
This article reports a critical file-read vulnerability (CVE-2026-59774) in Gitea versions 1.22.1 through 1.27.0, allowing unauthenticated attackers to read any file accessible by the service account. The attack requires only a public repository and crafted Org-mode markup.
Researchers found that leaked n8n API tokens from public GitHub commits allowed authenticated access to 321 out of 896 reachable instances. These tokens can be used to access workflow definitions, execution data, and stored credentials, potentially compromising connected systems.
Researchers found that leaked n8n API tokens from public GitHub commits allowed authenticated access to 321 out of 896 reachable instances. These tokens can be used to access workflow definitions, execution data, and stored credentials, potentially compromising connected systems.
A cluster of 77 malicious 'evil twin' extensions was discovered on the Open VSX marketplace, impersonating legitimate developer tools to exfiltrate system information. The extensions, uploaded between July 26 and August 1, 2026, have since been removed.
A cluster of 77 malicious 'evil twin' extensions was discovered on the Open VSX marketplace, impersonating legitimate developer tools to exfiltrate system information. The extensions, uploaded between July 26 and August 1, 2026, have since been removed.