ScanForge Security Digest 2614-03
This week's threat landscape remains elevated with 77 critical vulnerabilities (CVSS 9.0+) requiring immediate attention, though no newly exploited zero-days were added to CISA's KEV catalog. Notable critical issues include sandbox bypass in PraisonAI, SQL injection in Kestra, and multiple memory safety vulnerabilities across Apple platforms that have already shipped patches. Supply chain threats continue to dominate the news cycle, with coordinated attacks on npm packages targeting database infrastructure and a credential harvesting campaign against maintainer accounts through social engineering. Organizations should prioritize patching Apple devices and updating Kestra deployments while strengthening access controls for open-source package maintainers. The surge in device code phishing (up 37x) and persistent focus on compromising development tools warrant heightened security awareness training across technical teams.
Critical
77High Severity
53+31 more products affected
Security News
10Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plu
Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been e
The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its develop
Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged mor
Hackers stole over 300GB of data from the Commission’s AWS environment, including personal information. The post Europea
Data privacy labels are a great idea for mobile apps, but the current versions just aren't good enough.
A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to s
A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to s