It takes one file. A single chatflow import, the kind Flowise users share routinely, can give an attacker full command execution on the server running the application. The vulnerability, tracked as ...

PandasAI, an open source project by SinaptikAI, has been found vulnerable to Prompt Injection attacks. An attacker with access to the chat prompt can craft malicious input that is interpreted as code, ...

Over 660,000 exposed Rsync servers are potentially vulnerable to six new vulnerabilities, including a critical-severity heap-buffer overflow flaw that allows remote code execution on servers. Rsync is ...

Three independent research teams found the same systemic flaw in Amazon Q, Claude Code, and Windsurf — AI coding assistants ...

A vulnerability in UNISOC modem firmware can allow arbitrary code execution with kernel privileges from the modem context, ...

WordPress has patched CVE-2026-65640, a high-severity vulnerability that allows authenticated attackers to execute arbitrary code.

Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.

SAP has patched a CVSS 10.0 vulnerability in Commerce Cloud that could allow an unauthenticated attacker to execute arbitrary code. The flaw, tracked as CVE-2026-58231, affects the Data Hub Adapter ...

Apple urges users to update after patching CVE-2026-20700, a zero-day flaw exploited in sophisticated targeted attacks across multiple devices. If you can only read one tech story a day, this is it.