Databases serve as the foundation of the digital world, organizing and storing critical information: from financial transactions and medical records to website content. However, like any complex software product, they are not immune to flaws, and discovered vulnerabilities can turn this repository into a prime target for attacks. This applies […]

Enable JavaScript and cookies to continue

**security-research** Public # Swagger-Parser race condition leads to Cross-Thread Data Contamination ## Package ## Affected versions ## Patched versions ## Description ### Summary The swagger-parser library is not thread safe for OpenAPI 3.1 specifications. When parsing on multiple threads concurrently it is possible for the parsing results for specs on […]

For the last few months, we’ve been using the GitHub Security Lab Taskflow Agent along with a new set of auditing taskflows that specialize in finding web security vulnerabilities. They also turn out to be very successful at finding high-impact vulnerabilities in open source projects. As security researchers, we’re used […]

As shared in my previous blogpost, I reverse-engineered the TP-Link Tapo C260 webcam for the SPIRITCYBER IoT hardware hacking contest. Despite being one of the latest Tapo webcams, I was able to discover some pretty interesting vulnerabilities – local file disclosure (CVE-2026-0651), guest-privilege Remote Code Execution (CVE-2026-0652), and privilege escalation […]

# The MCP AuthN/Z Nightmare 05 Mar 2026 – Posted by Francesco Lacerenza This article shares our perspective on the current state of authentication and authorization in enterprise-ready, remote MCP server deployments. Before diving into that discussion, we’ll first outline the most common attack vectors. Understanding these threats is essential […]

When a phone starts “taking action” on its own, it’s no longer just answering questions like how to get a cheaper takeout—it can actually open apps, compare prices, and place orders. Control shifts from the user’s fingers to an intelligent agent capable of seeing the screen, planning, and executing tasks. […]

## Key Findings – During the ongoing conflict, we identified intensified targeting of IP cameras from two manufacturers starting on February 28, originating from infrastructure we attribute to Iranian threat actors. – The targeting extends across Israel, Qatar, Bahrain, Kuwait, the UAE, and Cyprus – countries that have also experienced […]

In recent months, Check Point Research (CPR) has been tracking a sophisticated, Chinese-aligned threat group whose activity demonstrates operational correlation with campaigns previously associated with APT41. We have designated this activity cluster as Silver Dragon. This group actively targets organizations in Southeast Asia and Europe, with a particular focus on […]

# Sometimes, You Can Just Feel The Security In The Design (Junos OS Evolved CVE-2026-21902 RCE) On today’s ‘good news disguised as other things’ segment, we’re turning our gaze to CVE-2026-21902 – a recently disclosed “Incorrect Permission Assignment for Critical Resource” vulnerability affecting Juniper’s Junos OS Evolved platform. This vulnerability […]