Every story tagged Vulnerability Patch, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
3 stories · open in the command center
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.
A critical Android VPN bypass vulnerability that leaks users' real IP addresses even with VPN protections enabled was left unfixed by Google but patched by GrapheneOS within a week, highlighting a significant security gap in stock Android that affects enterprise mobile security posture. Google's refusal to classify the flaw as a security bulletin means millions of Android users remain vulnerable to IP address leakage through a simple API exploitation requiring only standard permissions. IT leaders must evaluate their organization's mobile security strategy, particularly around BYOD policies and VPN enforcement, while considering hardened alternatives like GrapheneOS for high-risk users or confidential work.
A critical Linux privilege escalation vulnerability (CVE-2026-31431, named CopyFail) has been publicly exploited with reliable code that works across all major distributions, allowing any unprivileged user to gain root access and compromise multi-tenant systems, containers, and CI/CD pipelines. With patches unavailable from most major distributions at the time of disclosure, organizations face immediate risk of data center breaches, container escapes, and supply chain attacks through compromised CI/CD workflows. IT organizations must treat this as a critical incident requiring emergency patching of Linux kernel versions across all infrastructure while implementing compensating controls for vulnerable systems.