» Tag
vulnerability-research
5 postsPre-Auth SQL Injection in WordPress Core via Batch API Desync
Array desync in WordPress's REST batch API enables pre-auth SQL injection (CVE-2026-63030/60137); details plus a fast bitmask extraction technique.
CosmosEscape: How a Bug Exposed Every Azure Cosmos DB Account
A Gremlin API sandbox escape in Azure Cosmos DB exposed a master key capable of compromising any database on the service, Wiz Research found.
Sabba: A Security Tool That Proves Bugs by Actually Running Them
Sabba is an MCP security tool that verifies every bug finding by actually compiling and running the exploit, not just guessing with an LLM.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comStudy: 80% of Qubes OS Security Bulletins Trace to Xen, CPU
Analysis of 109 Qubes Security Bulletins shows 79.8% trace to Xen or CPU issues, not Qubes code, with disclosure rates plateauing since 2018.
Flaw in Google's Agent Dev Kit enables first AI agent-on-agent attack
Pillar Security found a flaw in Google's ADK Python repo letting one AI agent hijack another, the first known agent-to-agent supply chain exploit.