Everything CloudSec Press has reported about Web Security: 5 stories, newest first. Part of our Vulnerabilities coverage.
A critical cross-site scripting flaw in TanStack Router allows unauthenticated attackers to inject scripts. Patches are available for affected npm packages.
HTTP headers enforce browser behavior rather than server security, meaning many misconfigurations fail silently while attackers exploit the underlying protocol gaps.
Insecure direct object references expose data because servers trust client inputs without verifying ownership, turning public IDs into private keys.
Server-side request forgery exploits the application’s trusted network position to access internal resources that firewalls normally shield from external users.
Small firms face disproportionate formjacking risks because attackers exploit weak validation logic rather than complex server vulnerabilities.