No Permissions Needed: OxygenOS Bugs Could Hand Root Access to Any App on a OnePlus 15
Two unpatched flaws in OnePlus's latest OxygenOS build could let an app that requests zero permissions still seize root-level control of the device, by abusing privileged system services...
Actively Exploited Roundcube Flaw Lets Attackers Slip Past the Login Screen Entirely
Canadian cybersecurity officials have confirmed active, in-the-wild exploitation of a pre-authentication SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842. The flaw requires no valid credentials to exploit,...
Cloudflare Patches Container Flaw That Exposed Residual Cross-Tenant Data
Cloudflare fixed a storage-layer weakness that could reveal fragments left behind by other customers using its Containers platform. The company found no malicious exploitation in retained telemetry and...
AWS Integration Lambda Could Turn Limited IAM Access Into Privileged Cloud Actions
CVE-2026-94384 allowed callers of an Amazon Connect Salesforce setup function to make AWS requests with the Lambda execution role's privileges. AWS has fixed the issue in AmazonConnectSalesforceLambda 5.26...
cPanel Security Update Closes Root Escalation and Cross-Tenant Data Access Flaws
cPanel has fixed three flaws that break tenant isolation, including a root-level privilege escalation and cross-account access to calendars, contacts, and WordPress databases. Hosting providers need both current...
Apache Patches a Dozen Tomcat Flaws Spanning WebSockets, HTTP/2, and TLS Checks
Apache has released Tomcat 11.0.26 to close twelve security holes across WebSocket, HTTP/2, AJP, authentication, and certificate-validation code, including a message-smuggling bug and a header mix-up introduced by...
GitLab’s Email-to-Issue Feature Can Be Hijacked to Commit Code as Any User
Researchers at Aikido Security found that GitLab’s incoming-email work-item feature relies on a long-lived, non-expiring token that, if exposed, lets an attacker submit merge requests and land commits...
Critical Next.js SVG Flaw Opens Server-Side Image Routes to Remote Code Execution
A critical flaw in the Node.js implementation of Next.js ImageResponse can turn attacker-controlled SVG data into server-side code execution. Applications using affected releases should move to Next.js 16.3.6...