Latest cybersecurity reporting from selected sources.

Ox Security claims as many as 200,000 servers are exposed by newly discovered MCP vulnerability

Two critical security flaws in n8n have exposed sandboxing vulnerabilities, enabling remote code execution for attackers

Critical flaw ForcedLeak in Salesforce's AgentForce allows CRM data theft via prompt injection

Experts have revealed an Azure AD vulnerability exposing ClientId and ClientSecret in a publicly accessible appsettings.json file

A vulnerability in Kigen eUICC cards has exposed billions of IoT devices via flawed eSIM profile management

Some 36% of Grafana instances are vulnerable to account takeover bug, putting DevOps teams at risk

Two NHS England trusts could see highly sensitive patient records exposed

Cyber reports exposed major security flaws in DeepSeek’s R1 LLM

A Morphisec researcher showed how an attacker could manipulate FIRST’s Exploit Prediction Scoring System (EPSS) using AI

The group has been observed exploiting vulnerabilities through SQL injection attacks since 2022

The flaws include CVE-2023-47610, a security weaknesses within the modem’s SUPL message handlers

Unauthorized actors breached health data, including details related to dental procedures and claims

With over 20,000 active installations, the plugin is used for user-generated content submissions

A new report from Bitsight has highlighted how thousands of physical critical infrastructure organizations are vulnerable to cyber-attacks

SAML flaw in enabled rogue customers to access others’ SaaS data

Aqua Nautilus exposed naming policy, ownership verification and module exposure vulnerabilities

Those selling goods and classified ads are particularly exposed

VulnCheck exposed the flaws, following a Palo Alto Networks’ Unit 42 publication

The vulnerability affects versions 7.4.0 and below of the WordPress plugin

Rezilion's report exposed the most dangerous vulnerabilities found in the first half of 2023