MongoDB CVE-2026-118383: Pre-Auth Flaw Hits on FailoverAn unauthenticated attacker can send two requests to a MongoDB Server replica set member that trigger a crash on the database server. The crash happens only if that server is later chosen to take over3 min read·404-founders.com11h ago
GPUStack Authentication Bypass: 101 Days Before Scanners KnewGPUStack authentication bypass CVE-2026-102895: how a loopback header grants admin, who is exposed, detection, and why scanners missed it.15 min read·404-founders.com11h ago
wfx-loot: GitHub Actions Secret Stealer in 1,806 ReposSince 2026-11-10, an attacker has used stolen credentials for 4,837 GitHub accounts to push a credential stealer into repositories those accounts can write to. Aikido Security named the campaign wfx-l4 min read·404-founders.com15h ago
Zoom Workplace for Windows CVE-2026-108186: Critical EoPZoom has released security updates that fix two vulnerabilities in Zoom Workplace for Windows. The more serious one, CVE-2026-108186, is rated critical and could let an unauthenticated attacker escala3 min read·404-founders.com15h ago
GPUStack CVE-2026-102895: Spoofed Header Grants AdminAttackers are sending requests with a spoofed loopback header to reach GPUStack instances, and that header bypasses authentication in all versions before 2.2.0. CISA added the flaw to its Known Exploi3 min read·404-founders.com15h ago
