Risks and Vulnerabilities

Risks and Vulnerabilities

• • Risks and Vulnerabilities

  PHP2Shell: A Clear Explanation and Response Framework

  PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond.

  

  UpGuard Team October 26, 2026
• • Risks and Vulnerabilities
  • Attack Surface Management

  Everything Everywhere: Systemic Data Exposure in Supabase Apps

  Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking.

  

  Greg Pollock September 25, 2026
• • Risks and Vulnerabilities

  Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.

  Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new.

  

  Greg Pollock July 22, 2026
• • Risks and Vulnerabilities

  Data leakage risks with DBHub MCP servers

  UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk.

  

  Greg Pollock October 13, 2026
• • Risks and Vulnerabilities

  Understanding and Mitigating CVE-2025-55182 (React2Shell)

  CVE-2025-55182 is a critical unauthenticated RCE in React Server Components (CVSS 10.0). Check if your Next.js or React 19 app is vulnerable and patch now.

  

  Edward Kost December 14, 2025
• • Risks and Vulnerabilities

  Downstream Data: Investigating AI Data Leaks in Flowise

  A thousand Flowise instances are exposed to the internet, many of them leaking confidential business data, passwords, and more.

  

  Greg Pollock October 26, 2026
• • Risks and Vulnerabilities

  Beware the Sandworm: The Shai-Hulud Attack Explained

  Learn about the Shai-Hulud worm, a self-replicating malware targeting the NPM ecosystem that steals developer credentials and exposes them.

  

  Edward Kost September 21, 2025
• • Risks and Vulnerabilities

  CVE-2016-10033: Detection and Response Guide for 2025

  CVE-2016-10045 is still rearing its ugly head in 2025. Learn how to detect and shut down this risk.

  

  Edward Kost July 10, 2025
• • Risks and Vulnerabilities

  Data Leakage and Other Risks of Insecure LlamaIndex Apps

  UpGuard Research surveyed accessible LlamaIndex chatbots to understand the real-world risks–including one instance leaking PII.

  

  Greg Pollock October 13, 2026
• • Risks and Vulnerabilities

  Detecting Generative AI Data Leaks from ComfyUI

  Generative AI servers are leaking images, workflows, and prompts. Are they creating risk in your AI supply chain?

  

  Greg Pollock June 22, 2025
• • Risks and Vulnerabilities

  Analyzing llama.cpp Servers for Prompt Leaks

  How are generative AI technologies leaking data? In this report we analyse prompt leaks from llama.cpp servers.

  

  Greg Pollock July 25, 2025
• • Risks and Vulnerabilities

  Critical Middleware Vulnerability in Next.js (CVE-2025-29927)

  Learn how to detect CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to easily bypass middleware authorization measures.

  

  Greg Pollock July 25, 2025
• • Risks and Vulnerabilities

  Understanding and Securing Exposed Ollama Instances

  Explore how attackers are exploiting Ollama instances and learn what you can do to secure them across your infrastructure.

  

  UpGuard Team March 19, 2025
• • Risks and Vulnerabilities

  Using Exposed Ollama APIs to Find DeepSeek Models

  Misconfigured AI APIs can expose sensitive data and security risks. See what our research uncovered.

  

  Greg Pollock July 25, 2025
• • Risks and Vulnerabilities

  Mitel MiCollab Vulnerabilities: CVE-2024-35286 and CVE-2024-41713

  Learn how to detect SQL injection and path traversal vulnerabilities across your infrastructure.

  

  UpGuard Team July 10, 2025
• • Risks and Vulnerabilities

  Understanding CVE-2024-47176: Mitigating CUPS Vulnerabilities

  Learn how to detect and mitigate CUPS vulnerabilities, including CVE-2024-47176.

  

  UpGuard Team January 16, 2025