Resources [Blog ](/blog)[Events ](/events)[Breaches ](/breaches)[Resources ](/resources)[News](/news) # Risks and Vulnerabilities These articles focus on specific risk findings and vulnerabilities. Learn how to resolve and mitigate common issues facing your organization. Categories * [View all](/blog) * [Attack Surface Management](/category/attack-surface-management) * [Company news](/category/company-news) * [Compliance and Regulations](/category/compliance-and-regulations) * [Cyber Risk Posture Management](/category/cyber-risk-posture-management) * [Cybersecurity](/category/cybersecurity) * [Data Breaches](/category/data-breaches) * [DevOps](/category/devops) * [Human Cyber Risk](/category/human-cyber-risk) * [Risk Automations](/category/risk-automations) * [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) * [Third-Party Risk Management](/category/third-party-risk-management) * [Trust Exchange](/category/trust-exchange) * [Vendor Risk Management](/category/vendor-risk-management) ## Featured post * Risks and Vulnerabilities ## [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. Nicholas Sollitto May 28, 2026 ## Risks and Vulnerabilities * * Risks and Vulnerabilities ### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. UpGuard Team October 26, 2026 * * Risks and Vulnerabilities * Attack Surface Management ### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. Greg Pollock September 25, 2026 * * Risks and Vulnerabilities ### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. Greg Pollock July 22, 2026 * * Risks and Vulnerabilities ### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. Greg Pollock October 13, 2026 * * Risks and Vulnerabilities ### [Understanding and Mitigating CVE-2025-55182 (React2Shell)](/blog/understanding-and-mitigating-cve-2025-55182-react2shell) CVE-2025-55182 is a critical unauthenticated RCE in React Server Components (CVSS 10.0). Check if your Next.js or React 19 app is vulnerable and patch now. Edward Kost December 14, 2025 * * Risks and Vulnerabilities ### [Downstream Data: Investigating AI Data Leaks in Flowise](/blog/downstream-data-investigating-ai-data-leaks-in-flowise) A thousand Flowise instances are exposed to the internet, many of them leaking confidential business data, passwords, and more. Greg Pollock October 26, 2026 * * Risks and Vulnerabilities ### [Beware the Sandworm: The Shai-Hulud Attack Explained](/blog/the-shai-hulud-attack-explained) Learn about the Shai-Hulud worm, a self-replicating malware targeting the NPM ecosystem that steals developer credentials and exposes them. Edward Kost September 21, 2025 * * Risks and Vulnerabilities ### [CVE-2016-10033: Detection and Response Guide for 2025](/blog/cve-2016-10033-detection-and-response-guide) CVE-2016-10045 is still rearing its ugly head in 2025. Learn how to detect and shut down this risk. Edward Kost July 10, 2025 * * Risks and Vulnerabilities ### [Data Leakage and Other Risks of Insecure LlamaIndex Apps](/blog/data-leakage-and-other-risks-of-insecure-llamaindex-apps) UpGuard Research surveyed accessible LlamaIndex chatbots to understand the real-world risks–including one instance leaking PII. Greg Pollock October 13, 2026 * * Risks and Vulnerabilities ### [Detecting Generative AI Data Leaks from ComfyUI](/blog/detecting-generative-ai-data-leaks-from-comfyui) Generative AI servers are leaking images, workflows, and prompts. Are they creating risk in your AI supply chain? Greg Pollock June 22, 2025 * * Risks and Vulnerabilities ### [Analyzing llama.cpp Servers for Prompt Leaks](/blog/llama-cpp-prompt-leak) How are generative AI technologies leaking data? In this report we analyse prompt leaks from llama.cpp servers. Greg Pollock July 25, 2025 * * Risks and Vulnerabilities ### [Critical Middleware Vulnerability in Next.js (CVE-2025-29927)](/blog/critical-middleware-bypass-vulnerability-in-next-js-cve-2025-29927) Learn how to detect CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to easily bypass middleware authorization measures. Greg Pollock July 25, 2025 * * Risks and Vulnerabilities ### [Understanding and Securing Exposed Ollama Instances](/blog/understanding-and-securing-exposed-ollama-instances) Explore how attackers are exploiting Ollama instances and learn what you can do to secure them across your infrastructure. UpGuard Team March 19, 2025 * * Risks and Vulnerabilities ### [Using Exposed Ollama APIs to Find DeepSeek Models](/blog/deepseek-adoption) Misconfigured AI APIs can expose sensitive data and security risks. See what our research uncovered. Greg Pollock July 25, 2025 * * Risks and Vulnerabilities ### [Mitel MiCollab Vulnerabilities: CVE-2024-35286 and CVE-2024-41713](/blog/mitel-micollab-vulnerabilities) Learn how to detect SQL injection and path traversal vulnerabilities across your infrastructure. UpGuard Team July 10, 2025 * * Risks and Vulnerabilities ### [Understanding CVE-2024-47176: Mitigating CUPS Vulnerabilities](/blog/understanding-cve-2024-47176) Learn how to detect and mitigate CUPS vulnerabilities, including CVE-2024-47176. UpGuard Team January 16, 2025 1 / 4 [Next](/category/risks-and-vulnerabilities?page=2) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](https://www.upguard.com/instant-security-score?)