https://vulnpocalypse.dev/feeds/WordPress, Drupal, e-commerce platforms, plugins and web servers: exploited flaws and how to check your sites.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/vibe-coded-apis-ex-hacker-says-they-are-riddled-with-flaws/https://vulnpocalypse.dev/advisories/vibe-coded-apis-ex-hacker-says-they-are-riddled-with-flaws/Thu, 12 Nov 2026 12:00:00 +0000Bank Info Security reports an ex-hacker says vibe-coded APIs are riddled with flaws; details unconfirmed, so review AI-generated API code.ai-toolsai-toolswebhttps://vulnpocalypse.dev/advisories/ndiligence-attack-the-glass-client-side-supply-chain-flaw-study/https://vulnpocalypse.dev/advisories/ndiligence-attack-the-glass-client-side-supply-chain-flaw-study/Thu, 12 Nov 2026 12:00:00 +0000nDiligence published Attack the Glass research on runtime client-side rendering supply-chain risk; review third-party code your apps load.supply-chainwebhttps://vulnpocalypse.dev/advisories/muji-operator-reportedly-apologizes-for-data-breach-databreachesnet-says/https://vulnpocalypse.dev/advisories/muji-operator-reportedly-apologizes-for-data-breach-databreachesnet-says/Thu, 12 Nov 2026 12:00:00 +0000DataBreaches.net reports that the Muji operator apologized for a data breach; details are not confirmed, so watch official notices from the company.breachenterprisewebhttps://vulnpocalypse.dev/advisories/econotimes-reports-cyberattack-defaced-ukrinform-site-and-x-profile/https://vulnpocalypse.dev/advisories/econotimes-reports-cyberattack-defaced-ukrinform-site-and-x-profile/Thu, 12 Nov 2026 12:00:00 +0000EconoTimes reports Ukrinform's website and X profile were altered Wednesday; treat its channels with caution until it confirms restoration.breachwebhttps://vulnpocalypse.dev/advisories/cherokee-county-sheriff-says-man-arrested-on-child-exploitation-charges/https://vulnpocalypse.dev/advisories/cherokee-county-sheriff-says-man-arrested-on-child-exploitation-charges/Thu, 12 Nov 2026 12:00:00 +0000Local 3 News reports the Cherokee County Sheriff's Office says a man was arrested on child exploitation charges; contact CCSO with information.ecosystemwebhttps://vulnpocalypse.dev/advisories/castlerat-stealc-gootloader-bleepingcomputer-reports-europol-takedown/https://vulnpocalypse.dev/advisories/castlerat-stealc-gootloader-bleepingcomputer-reports-europol-takedown/Thu, 12 Nov 2026 12:00:00 +0000BleepingComputer reports Europol seized servers tied to CastleRAT, StealC and Gootloader; check if your credentials were exposed.breachendpointwebhttps://vulnpocalypse.dev/advisories/apify-discloses-breach-rotates-api-tokens-and-urges-2fa-resets/https://vulnpocalypse.dev/advisories/apify-discloses-breach-rotates-api-tokens-and-urges-2fa-resets/Thu, 12 Nov 2026 12:00:00 +0000BleepingComputer reports Apify says an unauthorized party accessed internal systems; affected users are told to reset 2FA in Apify Console.breachwebcloudhttps://vulnpocalypse.dev/advisories/chatgpt-shared-link-mathlive-xss/https://vulnpocalypse.dev/advisories/chatgpt-shared-link-mathlive-xss/Thu, 12 Nov 2026 12:00:00 +0000A public ChatGPT share link could run attacker JavaScript as chatgpt.com and read private chats. OpenAI fixed it on 26 Oct; MathLive users should update.ai-toolsai-toolswebnpmhttps://vulnpocalypse.dev/advisories/denmark-cpr-register-breach/https://vulnpocalypse.dev/advisories/denmark-cpr-register-breach/Thu, 12 Nov 2026 12:00:00 +0000Attackers used one firm's CPR access to pull names, addresses and CPR numbers of 8.8 million people in Sep 2026. A CPR number no longer proves identity.breachenterprisewebhttps://vulnpocalypse.dev/advisories/polands-digital-ministry-says-it-stopped-a-cyberattack-on-epuap/https://vulnpocalypse.dev/advisories/polands-digital-ministry-says-it-stopped-a-cyberattack-on-epuap/Wed, 11 Nov 2026 12:00:00 +0000The Record reports Poland took ePUAP offline as a precaution after a cyberattack the ministry says was stopped; check gov.pl for service status.ecosystemwebhttps://vulnpocalypse.dev/advisories/parks-victoria-says-it-knows-of-bookeasy-breach-suspicious-whatsapp-messages/https://vulnpocalypse.dev/advisories/parks-victoria-says-it-knows-of-bookeasy-breach-suspicious-whatsapp-messages/Wed, 11 Nov 2026 12:00:00 +0000Parks Victoria says it is aware of a Bookeasy data breach and reports of suspicious WhatsApp messages; do not click links or pay.breachwebhttps://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/Wed, 11 Nov 2026 12:00:00 +0000Microsoft reports threat actors deploy GSocket on compromised Linux servers for persistent access; remove the client, not just patch the app.ecosystemwebendpointopen-sourcehttps://vulnpocalypse.dev/advisories/hacker-claims-to-have-sold-stolen-exams-to-au-students-databreachesnet-reports/https://vulnpocalypse.dev/advisories/hacker-claims-to-have-sold-stolen-exams-to-au-students-databreachesnet-reports/Wed, 11 Nov 2026 12:00:00 +0000DataBreaches.net reports a hacker claims to have sold stolen exams to students in Australia; details are not confirmed, so monitor official notices.breachwebhttps://vulnpocalypse.dev/advisories/grok-app-builder-35578-public-grokme-apps-expose-data-and-passwords/https://vulnpocalypse.dev/advisories/grok-app-builder-35578-public-grokme-apps-expose-data-and-passwords/Wed, 11 Nov 2026 12:00:00 +0000Researchers found 35,578 of 37,571 Grok-built apps open without sign-in, some with passwords; check app access settings and unpublish unowned apps.ai-toolsai-toolswebcloudhttps://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/https://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/Wed, 11 Nov 2026 12:00:00 +0000GBHackers reports Huntress research on fake Cloudflare CAPTCHA ClickFix lures that run PowerShell; never paste commands from a web page.ecosystemendpointwebhttps://vulnpocalypse.dev/advisories/databreachesnet-reports-2013-russian-forum-breach-data-resurfaces/https://vulnpocalypse.dev/advisories/databreachesnet-reports-2013-russian-forum-breach-data-resurfaces/Wed, 11 Nov 2026 12:00:00 +0000DataBreaches.net reports credentials from a 2013 Russian cybercrime forum breach have resurfaced; details are not confirmed, so monitor this story.breachwebhttps://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/https://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/Wed, 11 Nov 2026 12:00:00 +0000Google patched an actively exploited Chrome XML use-after-free, CVE-2026-125350; update Chrome to 157.0.8103.50 or later and relaunch.exploitedwebendpointhttps://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/Wed, 11 Nov 2026 12:00:00 +0000The Hacker News reports Check Point links three China-nexus espionage clusters via Sparrow malware; review indicators and sideloading alerts.breachendpointnetwork-edgewebhttps://vulnpocalypse.dev/advisories/australia-to-mandate-ai-breach-reporting-after-openai-agent-hit-medicare-site/https://vulnpocalypse.dev/advisories/australia-to-mandate-ai-breach-reporting-after-openai-agent-hit-medicare-site/Wed, 11 Nov 2026 12:00:00 +0000Australia will make AI firms report breaches after an OpenAI agent accessed a Medicare portal; AI operators should review incident reporting.ai-toolsai-toolswebhttps://vulnpocalypse.dev/advisories/who-gives-a-crap-says-supplier-breach-exposed-customer-data/https://vulnpocalypse.dev/advisories/who-gives-a-crap-says-supplier-breach-exposed-customer-data/Wed, 11 Nov 2026 12:00:00 +0000Who Gives A Crap says an unnamed US marketing software supplier was breached, per The Register; customers should watch for phishing.breachwebhttps://vulnpocalypse.dev/advisories/sega-says-22m-customer-emails-exposed-in-arara-vendor-breach/https://vulnpocalypse.dev/advisories/sega-says-22m-customer-emails-exposed-in-arara-vendor-breach/Wed, 11 Nov 2026 12:00:00 +0000Sega says about 2.2 million newsletter email addresses were exposed via Arara, its email provider; treat unexpected Sega emails with caution.breachwebhttps://vulnpocalypse.dev/advisories/gbhackers-reports-modsecurity-waf-upload-bypass-and-xml-flaw/https://vulnpocalypse.dev/advisories/gbhackers-reports-modsecurity-waf-upload-bypass-and-xml-flaw/Wed, 11 Nov 2026 12:00:00 +0000GBHackers reports two ModSecurity advisories, an upload filter bypass and an XML bug; set SecParseXmlIntoArgs Off and validate decoded filenames.exploitedopen-sourcewebhttps://vulnpocalypse.dev/advisories/iris-ohyama-says-iris-plaza-cloud-breach-may-expose-77-million-people/https://vulnpocalypse.dev/advisories/iris-ohyama-says-iris-plaza-cloud-breach-may-expose-77-million-people/Wed, 11 Nov 2026 12:00:00 +0000Iris Ohyama says unauthorized cloud access may have exposed data of 7.7 million Iris Plaza users, so change any reused Iris Plaza password now.breachcloudwebhttps://vulnpocalypse.dev/advisories/tata-motors-connected-car-app-flaws/https://vulnpocalypse.dev/advisories/tata-motors-connected-car-app-flaws/Wed, 11 Nov 2026 12:00:00 +0000CERT-In CIVN-2026-0537 details four high-severity flaws in Tata Motors iRA apps that let attackers impersonate car owners. Patched in iRA 2.0 26.8.2 / iRA.ev.exploitedendpointwebhttps://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/Wed, 11 Nov 2026 12:00:00 +0000Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.ecosystemendpointcryptowebhttps://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/https://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/Wed, 11 Nov 2026 12:00:00 +0000A critical Rails Active Storage flaw lets unauthenticated uploads write files through ImageMagick, fixed in activestorage 8.1.4.1 and 8.0.5.2.exploitedwebopen-sourcehttps://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/https://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/Wed, 11 Nov 2026 12:00:00 +0000Attackers reached Beget's management systems and ran wipe scripts, destroying VPS, cloud storage and Kubernetes data and all binary VPS backups.breachcloudwebenterprisehttps://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/https://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/Wed, 11 Nov 2026 12:00:00 +0000Russia-linked APT29 used hacked sites, cloned domains and the Plerdy tracker to serve patched-flaw exploits to out-of-date iPhones and Android phones.supply-chainendpointwebhttps://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/https://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/Wed, 11 Nov 2026 12:00:00 +0000Google released Chrome 157 with 213 security fixes, seven rated critical, and has not said any of them are exploited in the wild.exploitedwebendpointhttps://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/https://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/Wed, 11 Nov 2026 12:00:00 +0000Explicit video appeared on LED billboards in Egypt, Malaysia and Brazil; operators should keep screen content systems off the public internet.exploitednetwork-edgewebenterprisehttps://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/https://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/Wed, 11 Nov 2026 12:00:00 +0000A DebugBear monitoring script on Polymarket.com was swapped for wallet-draining code on October 29, costing traders about 2.7 million dollars.supply-chainwebcryptohttps://vulnpocalypse.dev/advisories/florida-department-of-education-confirms-financial-aid-site-breach-exposing-ssns/https://vulnpocalypse.dev/advisories/florida-department-of-education-confirms-financial-aid-site-breach-exposing-ssns/Wed, 11 Nov 2026 12:00:00 +0000Florida's education department says hackers accessed its student financial aid website, exposing Social Security numbers and other data of about 4.9 millionbreachwebhttps://vulnpocalypse.dev/advisories/revolve-card-data-breach-exposes-saved-payment-card-numbers-and-expiry-dates/https://vulnpocalypse.dev/advisories/revolve-card-data-breach-exposes-saved-payment-card-numbers-and-expiry-dates/Wed, 11 Nov 2026 12:00:00 +0000Revolve says an unauthorized actor may have taken names, contact details, card numbers and expiry dates from saved payment info in customer accounts.breachwebhttps://vulnpocalypse.dev/advisories/italy-intel471-reports-outlier-rates-of-vulnerability-based-initial-access/https://vulnpocalypse.dev/advisories/italy-intel471-reports-outlier-rates-of-vulnerability-based-initial-access/Wed, 11 Nov 2026 12:00:00 +0000Dark Reading reports Intel471 data showing Italian firms are outliers in sold access via vulnerabilities; patch exposed web systems and retire old PHP.exploitedwebphpenterprisehttps://vulnpocalypse.dev/advisories/wordpress-7-1-4-core-update-race-rce/https://vulnpocalypse.dev/advisories/wordpress-7-1-4-core-update-race-rce/Wed, 11 Nov 2026 12:00:00 +0000Full core updates in WordPress 4.7 to 7.1.3 open a brief unauthenticated RCE window. Update to 7.1.4 or your branch's fix and block wp-content/upgrade.exploitedphpwebhttps://vulnpocalypse.dev/advisories/fec-e-filing-system-offline-after-reported-attempt-to-breach-reuters-reports/https://vulnpocalypse.dev/advisories/fec-e-filing-system-offline-after-reported-attempt-to-breach-reuters-reports/Wed, 11 Nov 2026 12:00:00 +0000Reuters reports the US FEC took its e-filing system offline after a bad actor attempted to breach it, so filers should watch FEC status notices.ecosystemwebhttps://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/Wed, 11 Nov 2026 12:00:00 +0000An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.exploitedphpwebopen-sourcehttps://vulnpocalypse.dev/advisories/dhs-employee-data-leak-41000-workers-exposed-in-icepick-archive-said-to-come-fro/https://vulnpocalypse.dev/advisories/dhs-employee-data-leak-41000-workers-exposed-in-icepick-archive-said-to-come-fro/Wed, 11 Nov 2026 12:00:00 +0000A group called Department of Peace leaked records on more than 41,000 DHS staff and contractors, which it says came from the DHS Okta login system.breachenterprisewebhttps://vulnpocalypse.dev/advisories/cisco-finesse-cve-2026-20362-ssrf-horizon3-reports-unpatched-flaw/https://vulnpocalypse.dev/advisories/cisco-finesse-cve-2026-20362-ssrf-horizon3-reports-unpatched-flaw/Wed, 11 Nov 2026 12:00:00 +0000Horizon3 reports an unauthenticated SSRF in Cisco Finesse with fixes due in 2027; restrict the web interface to trusted networks or VPN until patched.exploitedenterprisewebhttps://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/https://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/Wed, 11 Nov 2026 12:00:00 +0000Anthropic says an unreleased model chained flaws into five working exploits for Chrome, Safari, Android, Windows and Linux, all reported and patched.ai-toolsai-toolswebendpointopen-sourcehttps://vulnpocalypse.dev/advisories/123-reg-discloses-ai-driven-cyberattack-on-customer-data-suspects-china-nexus/https://vulnpocalypse.dev/advisories/123-reg-discloses-ai-driven-cyberattack-on-customer-data-suspects-china-nexus/Wed, 11 Nov 2026 12:00:00 +0000123 Reg says a September 18 intrusion exposed customer contact and account data, and customers should turn on two-step verification and watch for phishing.breachwebhttps://vulnpocalypse.dev/advisories/growi-jvn-discloses-three-authorization-flaws-up-to-v806-fixed-in-v807/https://vulnpocalypse.dev/advisories/growi-jvn-discloses-three-authorization-flaws-up-to-v806-fixed-in-v807/Wed, 11 Nov 2026 12:00:00 +0000JVN discloses three authorization flaws in GROWI up to v8.0.6 that let users read or alter pages they should not, so upgrade GROWI to v8.0.7.exploitedwebopen-sourcehttps://vulnpocalypse.dev/advisories/afd-email-hosting-provider-attack-exposed-345k-accounts-the-register-reports/https://vulnpocalypse.dev/advisories/afd-email-hosting-provider-attack-exposed-345k-accounts-the-register-reports/Wed, 11 Nov 2026 12:00:00 +0000The Register reports an attack on the AfD email hosting provider exposed over 345,000 addresses. Check Have I Been Pwned for your address.breachwebenterprisehttps://vulnpocalypse.dev/advisories/gmo-internet-and-park24-disclose-cyberattacks-and-pay-users-report-says/https://vulnpocalypse.dev/advisories/gmo-internet-and-park24-disclose-cyberattacks-and-pay-users-report-says/Wed, 11 Nov 2026 12:00:00 +0000GMO Internet Group and Park24 say they will compensate users after cyberattacks, Indian Express reports; customers should follow company notices.breachenterprisewebphphttps://vulnpocalypse.dev/advisories/apple-ios-macos-safari-27-2-webkit/https://vulnpocalypse.dev/advisories/apple-ios-macos-safari-27-2-webkit/Wed, 11 Nov 2026 12:00:00 +0000Apple's 26 October updates fix 163 CVEs in iOS 27.2, including WebKit code execution and a sandbox escape. Update iOS, macOS, Safari and older-device builds.exploitedendpointwebhttps://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/Wed, 11 Nov 2026 12:00:00 +0000Symantec reports an AI attack agent built to hijack unauthenticated OpenAI-style endpoints, so require authentication on any model endpoint you expose.ai-toolsai-toolswebnextjscloudcryptohttps://vulnpocalypse.dev/advisories/ahold-delhaize-cyberattack-2026/https://vulnpocalypse.dev/advisories/ahold-delhaize-cyberattack-2026/Wed, 11 Nov 2026 12:00:00 +0000Ahold Delhaize took most brands' websites and apps offline in Europe and the US after malicious activity in its network on 12 Oct 2026. No data theft found yet.breachenterprisewebhttps://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/Wed, 11 Nov 2026 12:00:00 +0000CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.ai-toolsai-toolsenterprisecloudwebcryptohttps://vulnpocalypse.dev/advisories/artex-ai-pentest-framework-abused-in-data-theft-from-south-korean-banks/https://vulnpocalypse.dev/advisories/artex-ai-pentest-framework-abused-in-data-theft-from-south-korean-banks/Wed, 11 Nov 2026 12:00:00 +0000A suspected Chinese-speaking, financially motivated actor used the ARTEX agentic pentest tool to steal data from South Korean financial firms.ai-toolsai-toolsopen-sourcewebenterprisehttps://vulnpocalypse.dev/advisories/sph-media-says-no-customer-financial-data-exposed-after-cyberattacks/https://vulnpocalypse.dev/advisories/sph-media-says-no-customer-financial-data-exposed-after-cyberattacks/Tue, 10 Nov 2026 12:00:00 +0000DataBreaches.net reports SPH Media says cyberattacks hit it, no customer financial data exposed; check SPH Media's own notices.breachenterpriseweb