Archive snapshot

Fri, Apr 10 · 12:00 PM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Fri, Apr 10 · 12:00 PM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

8

Worth skimming

0

Tracked videos

0

NVD vulnerabilities

25

Top stories

Fri, Apr 10 · 12:00 PM CDT

Google Chrome Rolls Out Protection Against Infostealers Targeting Session Cookies

9.4/10 · Must read/watch

Infosecurity Magazinemalwareai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Apr 10 · 12:00 PM CDT

Just Three Ransomware Gangs Accounted for 40% of Attacks Last Month

9.2/10 · Must read/watch

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Apr 10 · 10:00 AM CDT

Supply chain nightmare: How Rust will be attacked and what we can do to mitigate

9.2/10 · Must read/watch

Hacker Newssupply-chainai

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 2 hours ago.

Open article ↗

Fri, 10 Apr 2026 14:44:53 +0000

In Other News: Cyberattack Stings Stryker, Windows Zero-Day, China Supercomputer Hack

9.1/10 · Must read/watch

SecurityWeekvulnmalwareai

Summary
Other noteworthy stories that might have slipped under the radar: Jones Day hacked, Internet Bug Bounty program paused due to AI, new Mac stealer malware. The post In Other News: Cyberattack Stings Stryker, Windows Zero-Day, China Supercomputer Hack appeared f

Open article ↗

Fri, 10 Apr 2026 13:44:17 +0000

Juniper Networks Patches Dozens of Junos OS Vulnerabilities

8.2/10 · Worth your time

SecurityWeekvulnidentity

Summary
A critical-severity flaw could be exploited remotely, without authentication, to take over a vulnerable device. The post Juniper Networks Patches Dozens of Junos OS Vulnerabilities appeared first on SecurityWeek .

Open article ↗

Fri, 10 Apr 2026 18:53:00 +0530

GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

8.2/10 · Worth your time

The Hacker Newsai

Summary
Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that's designed to stealthily infect all integrated development environments (IDEs) on a developer's machine. The techniqu

Open article ↗

Fri, 10 Apr 2026 12:41:08 +0000

Industry Reactions to Iran Hacking ICS in Critical Infrastructure: Feedback Friday

8.1/10 · Worth your time

SecurityWeekpolicy

Summary
The US government has warned that Iran-linked hackers are manipulating PLCs and SCADA systems to cause disruption. The post Industry Reactions to Iran Hacking ICS in Critical Infrastructure: Feedback Friday appeared first on SecurityWeek .

Open article ↗

Fri, 10 Apr 2026 11:53:45 +0000

Orthanc DICOM Vulnerabilities Lead to Crashes, RCE

8.1/10 · Worth your time

SecurityWeekvuln

Summary
Attackers could exploit these vulnerabilities in denial-of-service, information disclosure, and arbitrary code execution attacks. The post Orthanc DICOM Vulnerabilities Lead to Crashes, RCE appeared first on SecurityWeek .

Open article ↗

Worth skimming

Nothing surfaced yet.

Videos worth watching

Nothing surfaced yet.

NVD vulnerabilities

Fri, Dec 19 · 09:15 PM CST

CVE-2023-53959

9.8/10 · Must read/watch

NVDvuln

Summary
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the applicatio

CVECVE-2023-53959

SeverityCRITICAL

TypeUPDATED

PublishedFri, Dec 19 · 09:15 PM CST

ModifiedThu, Apr 09 · 09:19 PM CDT

Open article ↗

Thu, Jan 29 · 10:15 PM CST

CVE-2026-1340

9.8/10 · Must read/watch

NVDvuln

Summary
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

CVECVE-2026-1340

SeverityCRITICAL

TypeUPDATED

PublishedThu, Jan 29 · 10:15 PM CST

ModifiedThu, Apr 09 · 02:03 PM CDT

Open article ↗

Tue, Mar 03 · 10:16 AM CST

CVE-2026-22886

9.8/10 · Must read/watch

NVDvuln

Summary
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default

CVECVE-2026-22886

SeverityCRITICAL

TypeUPDATED

PublishedTue, Mar 03 · 10:16 AM CST

ModifiedThu, Apr 09 · 07:47 PM CDT

Open article ↗

Fri, Apr 03 · 10:16 PM CDT

CVE-2026-27634

9.8/10 · Must read/watch

NVDvuln

Summary
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This coul

CVECVE-2026-27634

SeverityCRITICAL

TypeUPDATED

PublishedFri, Apr 03 · 10:16 PM CDT

ModifiedThu, Apr 09 · 09:14 PM CDT

Open article ↗

Tue, Mar 31 · 10:16 PM CDT

CVE-2026-34400

9.8/10 · Must read/watch

NVDvuln

Summary
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

CVECVE-2026-34400

SeverityCRITICAL

TypeUPDATED

PublishedTue, Mar 31 · 10:16 PM CDT

ModifiedFri, Apr 10 · 01:41 AM CDT

Open article ↗

Thu, Jan 08 · 02:15 PM CST

CVE-2026-21876

9.3/10 · Must read/watch

NVDvuln

Summary
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTI

CVECVE-2026-21876

SeverityCRITICAL

TypeUPDATED

PublishedThu, Jan 08 · 02:15 PM CST

ModifiedThu, Apr 09 · 04:16 PM CDT

Open article ↗

Tue, Sep 09 · 02:15 PM CDT

CVE-2025-54236

9.1/10 · Must read/watch

NVDvuln

Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe

CVECVE-2025-54236

SeverityCRITICAL

TypeUPDATED

PublishedTue, Sep 09 · 02:15 PM CDT

ModifiedThu, Apr 09 · 01:00 AM CDT

Open article ↗

Fri, Apr 03 · 11:17 PM CDT

CVE-2026-34952

9.1/10 · Must read/watch

NVDvuln

Summary
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issu

CVECVE-2026-34952

SeverityCRITICAL

TypeUPDATED

PublishedFri, Apr 03 · 11:17 PM CDT

ModifiedThu, Apr 09 · 04:55 PM CDT

Open article ↗

Fri, Apr 03 · 11:17 PM CDT

CVE-2026-34953

9.1/10 · Must read/watch

NVDvuln

Summary
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered too

CVECVE-2026-34953

SeverityCRITICAL

TypeUPDATED

PublishedFri, Apr 03 · 11:17 PM CDT

ModifiedThu, Apr 09 · 04:52 PM CDT

Open article ↗

Sun, Apr 05 · 09:16 PM CDT

CVE-2019-25685

8.8/10 · Worth your time

NVDvuln

Summary
phpBB contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by exploiting the plupload functionality and phar:// stream wrapper. Attackers can upload a crafted zip file containing serialized PHP objects that execute arbitrary code when deserialized through the ima

CVECVE-2019-25685

SeverityHIGH

TypeUPDATED

PublishedSun, Apr 05 · 09:16 PM CDT

ModifiedThu, Apr 09 · 07:07 PM CDT

Open article ↗

Fri, Apr 03 · 03:16 PM CDT

CVE-2025-59710

8.8/10 · Worth your time

NVDvuln

Summary
An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution on the server.

CVECVE-2025-59710

SeverityHIGH

TypeUPDATED

PublishedFri, Apr 03 · 03:16 PM CDT

ModifiedThu, Apr 09 · 09:16 PM CDT

Open article ↗

Wed, Apr 01 · 10:16 AM CDT

CVE-2026-21630

8.8/10 · Worth your time

NVDvuln

Summary
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

CVECVE-2026-21630

SeverityHIGH

TypeUPDATED

PublishedWed, Apr 01 · 10:16 AM CDT

ModifiedThu, Apr 09 · 07:59 PM CDT

Open article ↗

Tue, Mar 10 · 06:18 PM CDT

CVE-2026-22627

8.8/10 · Worth your time

NVDvuln

Summary
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet.

CVECVE-2026-22627

SeverityHIGH

TypeUPDATED

PublishedTue, Mar 10 · 06:18 PM CDT

ModifiedThu, Apr 09 · 08:54 PM CDT

Open article ↗

Wed, Apr 01 · 10:16 AM CDT

CVE-2026-23899

8.8/10 · Worth your time

NVDvuln

Summary
An improper access check allows unauthorized access to webservice endpoints.

CVECVE-2026-23899

SeverityHIGH

TypeUPDATED

PublishedWed, Apr 01 · 10:16 AM CDT

ModifiedThu, Apr 09 · 07:59 PM CDT

Open article ↗

Mon, Dec 02 · 07:15 PM CST

CVE-2012-5562

8.6/10 · Worth your time

NVDvuln

Summary
A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to information disclosure, where sensitive authentication details are exposed to unauthorized parties.

CVECVE-2012-5562

SeverityHIGH

TypeUPDATED

PublishedMon, Dec 02 · 07:15 PM CST

ModifiedThu, Apr 09 · 06:16 PM CDT

Open article ↗

Tue, Feb 03 · 06:16 PM CST

CVE-2025-62599

8.6/10 · Worth your time

NVDvuln

Summary
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condi

CVECVE-2025-62599

SeverityHIGH

TypeUPDATED

PublishedTue, Feb 03 · 06:16 PM CST

ModifiedThu, Apr 09 · 06:16 PM CDT

Open article ↗

Tue, Feb 03 · 07:16 PM CST

CVE-2025-62600

8.6/10 · Worth your time

NVDvuln

Summary
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condi

CVECVE-2025-62600

SeverityHIGH

TypeUPDATED

PublishedTue, Feb 03 · 07:16 PM CST

ModifiedThu, Apr 09 · 06:16 PM CDT

Open article ↗

Wed, Mar 25 · 09:16 PM CDT

CVE-2026-30976

8.6/10 · Worth your time

NVDvuln

Summary
Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and an

CVECVE-2026-30976

SeverityHIGH

TypeUPDATED

PublishedWed, Mar 25 · 09:16 PM CDT

ModifiedThu, Apr 09 · 07:44 PM CDT

Open article ↗

Fri, Apr 03 · 11:17 PM CDT

CVE-2026-34954

8.6/10 · Worth your time

NVDvuln

Summary
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible

CVECVE-2026-34954

SeverityHIGH

TypeUPDATED

PublishedFri, Apr 03 · 11:17 PM CDT

ModifiedThu, Apr 09 · 04:51 PM CDT

Open article ↗

Sun, Apr 05 · 09:16 PM CDT

CVE-2019-25681

8.4/10 · Worth your time

NVDvuln

Summary
Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual server configuration

CVECVE-2019-25681

SeverityHIGH

TypeUPDATED

PublishedSun, Apr 05 · 09:16 PM CDT

ModifiedThu, Apr 09 · 07:33 PM CDT

Open article ↗

Tue, Mar 10 · 09:16 PM CDT

CVE-2025-70798

8.4/10 · Worth your time

NVDvuln

Summary
Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

CVECVE-2025-70798

SeverityHIGH

TypeUPDATED

PublishedTue, Mar 10 · 09:16 PM CDT

ModifiedThu, Apr 09 · 08:27 PM CDT

Open article ↗

Tue, Mar 10 · 09:16 PM CDT

CVE-2025-70802

8.4/10 · Worth your time

NVDvuln

Summary
Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

CVECVE-2025-70802

SeverityHIGH

TypeUPDATED

PublishedTue, Mar 10 · 09:16 PM CDT

ModifiedThu, Apr 09 · 08:27 PM CDT

Open article ↗

Sun, Apr 05 · 09:16 PM CDT

CVE-2019-25669

8.2/10 · Worth your time

NVDvuln

Summary
qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors and extract databas

CVECVE-2019-25669

SeverityHIGH

TypeUPDATED

PublishedSun, Apr 05 · 09:16 PM CDT

ModifiedThu, Apr 09 · 07:38 PM CDT

Open article ↗

Sun, Apr 05 · 09:16 PM CDT

CVE-2019-25672

8.2/10 · Worth your time

NVDvuln

Summary
PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'send' parameter. Attackers can submit POST requests to the comment submission endpoint with RLIKE-based boolean SQL injection payloads to extract sensitive datab

CVECVE-2019-25672

SeverityHIGH

TypeUPDATED

PublishedSun, Apr 05 · 09:16 PM CDT

ModifiedThu, Apr 09 · 07:37 PM CDT

Open article ↗

Sun, Apr 05 · 09:16 PM CDT

CVE-2019-25674

8.2/10 · Worth your time

NVDvuln

Summary
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL

CVECVE-2019-25674

SeverityHIGH

TypeUPDATED

PublishedSun, Apr 05 · 09:16 PM CDT

ModifiedThu, Apr 09 · 07:36 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.