Posted by Red Nanaki via Fulldisclosure on Jul 02 Whistlelink: Site-access password exposed in web server access logs via GET query string Severity: CRITICAL SUMMARY The Whistlelink reporting portal protects optionally-enabled, password-gated whistleblowing sites with a site-access password. When a

Learn MoreWhistlelink: Site-access password exposed in web server access logs via GET query string

Posted by Apple Product Security via Fulldisclosure on Jul 02 APPLE-SA-06-29-2026-3 Safari 26.5.2 Safari 26.5.2 addresses the following issues. Information about the security content is also available athttps://support.apple.com/en-us/127685. Apple maintains a Security Releases page athttps://support.apple.com/100100 which lists recent software updates

Learn MoreAPPLE-SA-06-29-2026-3 Safari 26.5.2

Posted by Apple Product Security via Fulldisclosure on Jul 02 APPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2 macOS Tahoe 26.5.2 addresses the following issues. Information about the security content is also available athttps://support.apple.com/en-us/127595. Apple maintains a Security Releases page athttps://support.apple.com/100100 which lists recent

Learn MoreAPPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2

Posted by Apple Product Security via Fulldisclosure on Jul 02 APPLE-SA-06-29-2026-1 iOS 26.5.2 and iPadOS 26.5.2 iOS 26.5.2 and iPadOS 26.5.2 addresses the following issues. Information about the security content is also available athttps://support.apple.com/en-us/127594. Apple maintains a Security Releases page

Learn MoreAPPLE-SA-06-29-2026-1 iOS 26.5.2 and iPadOS 26.5.2

Posted by Greg via Fulldisclosure on Jul 02 1. Advisory information ———————– Title: Symlink following and TOCTOU in pwnlift upload handler allow arbitrary file write as root Advisory: https://github.com/GregDurys/security-advisories GHSA: GHSA-2v7v-rhpw-m9w4 CVE: CVE-2026-56815 Class: CWE-59 (Improper Link Resolution Before File

Learn Morepwnlift: symlink following and TOCTOU in privileged upload handler allow arbitrary file write as root

Posted by Egidio Romano on Jul 02 ——————————————————————— Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability ——————————————————————— [-] Software Link: https://control-webpanel.com [-] Affected Versions: Version 0.9.8.1224 and prior versions. [-] Vulnerability Description: User input passed through the “userRes” POST

Learn More

Posted by ㅤevan via Fulldisclosure on Jul 02 this is my first time sending to a mailing list so ive chosen something easy. here goes: Summary: Horde Groupware’s IMP Webmail solution contains a path traversal/local file inclusion vulnerability which could

Learn More[fulldis] CVE-2026-58451 – Horde Groupware IMP path traversal vuln

A flaw in Anthropic’s Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions by simulating user clicks, potentially allowing it to abuse Claude’s access to connected services such as Gmail, Google Docs, Google Calendar,

Learn MoreClaude Chrome extension flaw lets malicious extensions trigger AI actions

A new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data. […]

Traditional security workflows were built for environments that changed at human speed. Token Security explains why AI agents require a new approach: building on a live identity foundation while giving security teams the flexibility to create workflows tailored to their

Learn MoreAI Agents Broke the Security Playbook. Here’s What Replaces It.