Vulnerability (CVE)
Noma Security disclosed a critical Salesforce Agentforce flaw codenamed ForcedLeak (CVSS 9.4), reported July 28, 2025, that uses indirect prompt injection through the Web-to-Lead form's Description field to exfiltrate CRM data to an expired...
Apple disclosed that CVE-2025-43200, a zero-click flaw in its Messages app, was actively exploited in the wild and patched in February across iOS 18.3.1, iPadOS 18.3.1, macOS Sequoia 15.3.1 and related releases. The Citizen Lab said it found forensic...
Researchers at Varonis Threat Labs chained three bugs into a one-click exfiltration path called SearchLeak that could pull emails, calendar details, and indexed files out of Microsoft 365 Copilot Enterprise Search, assigned CVE-2026-42824 and rated...