serisec

Category: Vulnerability News

  • Critical Spring Vulnerabilities Expose Arbitrary Files and GCP Secrets

    Critical Spring Vulnerabilities Expose Arbitrary Files and GCP Secrets Spring Cloud Config provides crucial server-side and client-side support for externalized configuration in distributed systems. Recently, the Spring development team disclosed four security vulnerabilities impacting the Spring Cloud Config Server. These flaws range from medium to critical severity, exposing environments to unauthorized arbitrary file access, cloud…

  • Dirty Frag Linux Vulnerability Let Attackers Gain Root Privileges – PoC Released

    Dirty Frag Linux Vulnerability Let Attackers Gain Root Privileges – PoC Released Dirty Frag is a newly disclosed, CVE-pending Linux kernel local privilege escalation (LPE) vulnerability that chains two separate page-cache write flaws, the xfrm-ESP Page-Cache Write and the RxRPC Page-Cache Write, to achieve root access on virtually all major Linux distributions, with a public exploit…

  • Multiple Critical Vulnerabilities Patched in Next.js and React Server Components

    Multiple Critical Vulnerabilities Patched in Next.js and React Server Components Vercel has released an extensive set of security advisories for Next.js, addressing more than a dozen vulnerabilities, including denial-of-service, middleware bypass, server-side request forgery, and cross-site scripting. The flaws affect Next.js versions 13.x through 16.x using the App Router, as well as React Server Components…

  • New Ivanti EPMM 0-Day Vulnerability Actively Exploited in Attacks

    New Ivanti EPMM 0-Day Vulnerability Actively Exploited in Attacks Ivanti has issued a critical security advisory for its Endpoint Manager Mobile (EPMM) product, disclosing multiple actively exploited vulnerabilities, including CVE-2026-6973, and urging all on-premises EPMM customers to apply patches immediately. At the time of disclosure, Ivanti confirmed active exploitation of CVE-2026-6973, a vulnerability that requires…

  • Critical Ollama Memory Leak Vulnerability Exposes 300,000 Servers Globally

    Critical Ollama Memory Leak Vulnerability Exposes 300,000 Servers Globally A major security flaw has placed Ollama, one of the most widely used platforms for running local AI models, at risk of a high-profile exposure event. The issue, dubbed “Bleeding Llama,” allows unauthenticated attackers to access the Ollama process and extract sensitive data directly from memory,…

  • Critical Palo Alto Firewalls Vulnerability Exploited in the Wild to Gain Root Access

    Critical Palo Alto Firewalls Vulnerability Exploited in the Wild to Gain Root Access Palo Alto Networks has disclosed a critical buffer overflow vulnerability in PAN-OS software, tracked as CVE-2026-0300, that is already being actively exploited in the wild. The flaw carries a CVSS 4.0 score of 9.3 (CRITICAL) and allows unauthenticated attackers to execute arbitrary…

  • GnuTLS 3.8.13 Released with Fix for 12 Vulnerabilities Affecting Network Communications

    GnuTLS 3.8.13 Released with Fix for 12 Vulnerabilities Affecting Network Communications GnuTLS version 3.8.13 has been officially released to patch a dozen security vulnerabilities, including critical flaws affecting secure network communications. The update is highly recommended for all systems using GnuTLS, as it addresses memory corruption, authentication bypasses, and certificate validation errors. Four vulnerabilities discovered…

  • Critical Android Zero-Click Vulnerability Grants Remote Shell Access

    Critical Android Zero-Click Vulnerability Grants Remote Shell Access Google has published the May 2026 Android Security Bulletin, alerting the ecosystem to a highly severe remote code execution (RCE) flaw. Tracked as CVE-2026-0073, this critical vulnerability resides deep within the core Android System component. It allows an attacker to gain remote shell access without requiring a…

  • Microsoft Edge Stores All Saved Passwords in Cleartext Process Memory at Launch

    Microsoft Edge Stores All Saved Passwords in Cleartext Process Memory at Launch A security researcher has discovered that Microsoft Edge decrypts every stored password into process memory the moment the browser launches and keeps them there as cleartext, regardless of whether the user ever visits those sites. The finding, disclosed on April 29 by PaloAltoNtwks…

  • Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks

    Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks The Apache Software Foundation has released a critical security update for Apache HTTP Server, patching five vulnerabilities, including a dangerous double-free flaw capable of enabling Remote Code Execution (RCE) in version 2.4.67, released on May 4, 2026. All users running version 2.4.66 or…

  • CISA Warns of cPanel & WHM Vulnerability Exploited in Attacks

    CISA Warns of cPanel & WHM Vulnerability Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical security flaw affecting widely used web hosting management platforms. CISA recently added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating that threat actors are actively abusing it…

  • Critical MOVEit Vulnerabilities Enables Authentication Bypass

    Critical MOVEit Vulnerabilities Enables Authentication Bypass Progress Software has issued a critical security bulletin for its MOVEit Automation platform. This April 2026 alert warns of two highly severe vulnerabilities that could allow attackers to bypass security checkpoints and gain full system control. MOVEit Automation is widely used by enterprises to manage and automate secure file…

  • FreeBSD DHCP Client Vulnerability Enables Remote Code Execution as Root

    FreeBSD DHCP Client Vulnerability Enables Remote Code Execution as Root The FreeBSD Project has released a critical security advisory addressing a severe flaw in its default IPv4 DHCP client. Tracked as CVE-2026-42511, this vulnerability allows a local network attacker to execute arbitrary code as root, granting them complete control over the compromised machine. Discovered by Joshua…

  • Multiple Exim Mail Server Vulnerabilities Leads to Crash with Malicious DNS data

    Multiple Exim Mail Server Vulnerabilities Leads to Crash with Malicious DNS data The Exim development team has released version 4.99.2 to address four newly discovered security vulnerabilities affecting their mail server software. These flaws allow attackers to potentially crash servers, corrupt memory, or leak sensitive information. Because Exim is one of the most widely used…

  • cPanelSniper – PoC Exploit Disclosed for cPanel Vulnerability, 44,000 Servers Compromised

    cPanelSniper – PoC Exploit Disclosed for cPanel Vulnerability, 44,000 Servers Compromised A weaponized proof-of-concept (PoC) exploit framework dubbed “cPanelSniper” has been publicly released for CVE-2026-41940, a maximum-severity authentication bypass in cPanel & WHM that has already led to the compromise of tens of thousands of servers worldwide with attack activity traced as far back as…

  • Critical Wireshark Vulnerabilities Let Attackers Execute Arbitrary Code Via Malformed Packets

    Critical Wireshark Vulnerabilities Let Attackers Execute Arbitrary Code Via Malformed Packets Wireshark, the world’s most widely used open-source network protocol analyzer, has released a major security update addressing over 40 vulnerabilities, several of which enable arbitrary code execution through malformed packet injection or malicious capture files. Organizations and individuals relying on Wireshark for network monitoring,…

  • Qinglong Task Scheduler RCE Vulnerabilities Exploited in the Wild

    Qinglong Task Scheduler RCE Vulnerabilities Exploited in the Wild In early 2026, two critical authentication bypass vulnerabilities in the popular open-source Qinglong task scheduler were actively exploited by hackers. According to Snyk security reports, unauthenticated attackers breached publicly accessible panels, achieving remote code execution to install a hidden, resource-draining cryptominer named .fullgc. Qinglong is a self-hosted…

  • cPanel Warns of Critical Authentication Flaw – Emergency Patch Released

    cPanel Warns of Critical Authentication Flaw – Emergency Patch Released Web hosting control panel giant cPanel has issued an emergency security update to address a critical vulnerability affecting its core software. The security flaw directly impacts multiple authentication paths within the cPanel and Web Host Manager (WHM) ecosystem. System administrators and web hosting providers are…

  • Multiple OpenClaw Vulnerabilities Enables Policy Bypass and Host Override

    Multiple OpenClaw Vulnerabilities Enables Policy Bypass and Host Override Cybersecurity researchers have recently disclosed three moderate-severity vulnerabilities in OpenClaw, an AI agent framework previously known as Clawdbot and Moltbot. Distributed as an npm package, these security flaws allow bypasses of policy enforcement, gateway configuration mutations, and host override attacks that could lead to credential exposure.…

  • Attackers Can Backdoor CODESYS Applications by Chaining Vulnerabilities

    Attackers Can Backdoor CODESYS Applications by Chaining Vulnerabilities Multiple vulnerabilities in the CODESYS Control runtime, one of the world’s most widely adopted software-based programmable logic controller (Soft PLC) platforms. According to Nozomi Networks Labs researchers, by chaining these security flaws, an authenticated attacker can replace a legitimate industrial control application with a backdoored version, thereby…

  • Litecoin Zero-Day Vulnerability Exploited in DoS Attack, Disrupts Major Mining Pools

    Litecoin Zero-Day Vulnerability Exploited in DoS Attack, Disrupts Major Mining Pools A critical zero-day vulnerability in the Litecoin network was actively exploited to launch a denial-of-service (DoS) attack, temporarily disrupting operations across major mining pools before developers issued a full patch. Security researchers confirmed the flaw allowed threat actors to inject an invalid MWEB (MimbleWimble…

  • New Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions

    New Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions PhantomRPC, a newly identified architectural vulnerability in Windows Remote Procedure Call (RPC) that enables local privilege escalation to SYSTEM-level access, potentially affecting every version of Windows. The research was presented by Kaspersky application security specialist Haidar Kabibo at Black Hat Asia 2026 on…

  • CISA Warns of Multiple SimpleHelp Vulnerabilities Exploited in Attack

    CISA Warns of Multiple SimpleHelp Vulnerabilities Exploited in Attack The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding two actively exploited vulnerabilities in SimpleHelp remote support software. Remote access tools are highly valued targets for cybercriminals because they provide direct pathways into corporate networks. When compromised, these platforms allow threat actors…

  • Hackers Exploiting Cisco Firepower Devices’ Using n-day Vulnerabilities to Gain Unauthorized Access

    Hackers Exploiting Cisco Firepower Devices’ Using n-day Vulnerabilities to Gain Unauthorized Access State-sponsored threat actors are actively targeting Cisco Firepower devices by chaining known vulnerabilities to deploy a highly customized backdoor. Cisco Talos recently discovered that the espionage-focused threat group UAT-4356 is exploiting two n-day vulnerabilities, tracked as CVE-2025-20333 and CVE-2025-20362, to infiltrate Firepower Extensible…

  • Critical Pack2TheRoot Vulnerability Let Attackers Gain Root Access or Compromise the System

    Critical Pack2TheRoot Vulnerability Let Attackers Gain Root Access or Compromise the System A high-severity privilege escalation vulnerability, dubbed Pack2TheRoot (CVE-2026-41651, CVSS 3.1: 8.8), has been publicly disclosed by Deutsche Telekom’s Red Team, affecting multiple major Linux distributions in their default installations. The flaw allows any local unprivileged user to silently install or remove system packages,…

  • Apple Fixes Notification Privacy Flaw That Allowed FBI to Access Deleted Signal Messages

    Apple Fixes Notification Privacy Flaw That Allowed FBI to Access Deleted Signal Messages Apple released iOS 26.4.2 and iPadOS 26.4.2 on April 22, 2026, to patch a critical notification privacy vulnerability that allowed law enforcement to extract Signal message content from iPhones — even after the app had been deleted. The flaw, tracked as CVE-2026-28950,…

  • Critical Atlassian Bamboo Data Center and Server Flaw Enables Command Injection Attacks

    Critical Atlassian Bamboo Data Center and Server Flaw Enables Command Injection Attacks Atlassian has disclosed two significant security vulnerabilities affecting its Bamboo Data Center and Server product, including a critical OS command injection flaw and a high-severity denial-of-service issue tied to a third-party dependency. Organizations running affected versions are strongly urged to apply patches immediately.…

  • 1,370+ Microsoft SharePoint Servers Vulnerable to Spoofing Attacks Exposed Online

    1,370+ Microsoft SharePoint Servers Vulnerable to Spoofing Attacks Exposed Online A critical spoofing vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-32201, remains unpatched on over 1,370 internet-facing IP addresses worldwide, according to fresh scanning data from the Shadowserver Foundation, even as the flaw sits on CISA’s Known Exploited Vulnerabilities (KEV) catalog with confirmed active exploitation…

  • CrowdStrike LogScale Vulnerability Allows Remote Attackers to Read Arbitrary Files from Server

    CrowdStrike LogScale Vulnerability Allows Remote Attackers to Read Arbitrary Files from Server CrowdStrike has issued an urgent security advisory for a critical unauthenticated path-traversal vulnerability (CVE-2026-40050) affecting its LogScale platform, warning that a remote attacker could exploit the flaw to read arbitrary files directly from the server’s filesystem without authentication. The vulnerability resides in a…

  • Microsoft Emergency .NET 10.0.7 Update to Patch Elevation of Privilege Vulnerability

    Microsoft Emergency .NET 10.0.7 Update to Patch Elevation of Privilege Vulnerability Microsoft has issued an emergency out-of-band (OOB) security update for .NET 10, releasing version 10.0.7 on April 21, 2026, to address a critical elevation of privilege vulnerability discovered in the Microsoft.AspNetCore.DataProtection NuGet package. The out-of-band release was prompted after customers began reporting decryption failures…

  • Claude Code, Gemini CLI, and GitHub Copilot Vulnerable to Prompt Injection via GitHub Comments

    Claude Code, Gemini CLI, and GitHub Copilot Vulnerable to Prompt Injection via GitHub Comments A critical cross-vendor vulnerability class dubbed “Comment and Control” is a new category of prompt injection attacks that weaponizes GitHub pull request titles, issue bodies, and issue comments to hijack AI coding agents and steal API keys and access tokens directly from CI/CD…

  • iTerm2 Flaw Abuses SSH Integration Escape Sequences to Turn Text Into Code Execution

    iTerm2 Flaw Abuses SSH Integration Escape Sequences to Turn Text Into Code Execution Cybersecurity researchers, working in partnership with OpenAI, have uncovered a fascinating and severe vulnerability in iTerm2, a widely used macOS terminal emulator. According to Califio, the flaw abuses the application’s SSH integration feature, allowing attackers to turn seemingly harmless text output into…

  • Critical Vulnerability In Flowise Allows Remote Command Execution Via MCP Adapters

    Critical Vulnerability In Flowise Allows Remote Command Execution Via MCP Adapters A critical vulnerability in Flowise and multiple AI frameworks has been discovered by OX Security, exposing millions of users to remote code execution (RCE). The flaw stems from the Model Context Protocol (MCP), a widely used communication standard for AI agents developed by Anthropic.…

  • PoC Exploit Released for FortiSandbox Vulnerability that Allows Attacker to Execute Commands

    PoC Exploit Released for FortiSandbox Vulnerability that Allows Attacker to Execute Commands A proof-of-concept (PoC) exploit has been publicly released for a critical vulnerability in Fortinet’s FortiSandbox product, tracked as CVE-2026-39808. The flaw allows an unauthenticated attacker to execute arbitrary operating system commands as root, the highest privilege level, without requiring any login credentials. The vulnerability…

  • Windows Snipping Tool Vulnerability Allows Attacker to Perform Spoofing Over a Network

    Windows Snipping Tool Vulnerability Allows Attacker to Perform Spoofing Over a Network Microsoft has addressed a moderate-severity security flaw in the Windows Snipping Tool that could allow malicious actors to steal user credentials. Tracked as CVE-2026-33829, this spoofing vulnerability was officially patched during the April 14, 2026, security updates. Discovered and reported by security researchers…

  • One-Click RCE in Azure Windows Admin Center Allow Attacker to Execute Arbitrary Commands

    One-Click RCE in Azure Windows Admin Center Allow Attacker to Execute Arbitrary Commands Windows Admin Center is a locally deployed, browser-based management tool used by IT administrators to manage Windows servers, clients, and clusters from a centralized graphical interface. This newly discovered critical flaw, identified by Cymulate Research Labs, allows attackers to achieve unauthenticated, one-click…

  • Splunk Enterprise and Cloud Platform Vulnerability Enables Remote Code Execution Attacks

    Splunk Enterprise and Cloud Platform Vulnerability Enables Remote Code Execution Attacks A critical security vulnerability has been officially disclosed, affecting multiple versions of Enterprise and Cloud platforms. Tracked as CVE-2026-20204, this high-severity flaw carries a CVSS score of 7.1 and poses a significant threat to organizational networks. Discovered and reported by Splunk researcher Gabriel Nitu,…

  • Critical Chrome Vulnerabilities Let Attackers Execute Arbitrary Code – Update Now!

    Critical Chrome Vulnerabilities Let Attackers Execute Arbitrary Code – Update Now! Google has rolled out a crucial security update for its Chrome browser, addressing 31 vulnerabilities that could leave systems exposed to severe cyber threats. Released on April 15, 2026, this Stable Channel update requires immediate attention from users worldwide, as the most severe flaws…

  • Windows BitLocker Vulnerability Allows Attacker to Bypass Security Feature

    Windows BitLocker Vulnerability Allows Attacker to Bypass Security Feature Microsoft officially released security updates to address a significant vulnerability in Windows BitLocker. Tracked as CVE-2026-27913, this security feature bypass vulnerability was discovered by security researcher Alon Leviev in collaboration with the Microsoft STORM team. The flaw poses a substantial risk to enterprise device security architectures.…

  • Microsoft Defender 0-Day Vulnerability Enables Privilege Escalation Attack

    Microsoft Defender 0-Day Vulnerability Enables Privilege Escalation Attack Microsoft has released patch Tuesday security updates to address a newly discovered zero-day vulnerability in the Microsoft Defender Antimalware Platform.   Disclosed on April 14, 2026, the flaw is tracked as CVE-2026-33825 and carries an “Important” severity rating. If successfully exploited, this elevation-of-privilege vulnerability allows an attacker…

  • Multiple OpenSSL Vulnerabilities Exposes Sensitive Data in RSA KEM Handling

    Multiple OpenSSL Vulnerabilities Exposes Sensitive Data in RSA KEM Handling OpenSSL has released a broad April 2026 security update that fixes seven vulnerabilities across supported branches, led by CVE-2026-31790, a moderate-severity flaw in RSA KEM RSASVE encapsulation that can expose uninitialized memory to a malicious peer. The advisory directs users of vulnerable 3.x releases to…

  • Claude Finds 13-Year-Old 0-Day RCE Vulnerability in Apache ActiveMQ in 10 Minutes

    Claude Finds 13-Year-Old 0-Day RCE Vulnerability in Apache ActiveMQ in 10 Minutes A critical remote code execution (RCE) vulnerability has been disclosed in Apache ActiveMQ Classic, a flaw that sat undetected for over a decade and was ultimately discovered not by a human researcher manually combing through code, but by Anthropic’s Claude AI model in…

  • CUPS Vulnerability Chain Enables Remote Attacker to Execute Malicious Code as Root User

    CUPS Vulnerability Chain Enables Remote Attacker to Execute Malicious Code as Root User A critical vulnerability chain in the Common Unix Printing System (CUPS) that allows unauthenticated remote attackers to execute arbitrary malicious code with root system privileges. Security researcher Asim Viladi Oglu Manizada and his team discovered two zero-day flaws, officially tracked as CVE-2026-34980…

  • 50,000 WordPress Sites Exposed to Critical Ninja Forms File Upload RCE Vulnerability

    50,000 WordPress Sites Exposed to Critical Ninja Forms File Upload RCE Vulnerability A critical security flaw in the popular WordPress plugin “Ninja Forms – File Upload” has left approximately 50,000 websites vulnerable to complete takeover. Tracked as CVE-2026-0740, this flaw boasts a maximum CVSS severity score of 9.8, making it a severe threat that requires…

  • OpenAI Codex Vulnerability Allows Attackers to Steal GitHub Access Tokens

    OpenAI Codex Vulnerability Allows Attackers to Steal GitHub Access Tokens The integration of AI coding agents has introduced new, high-impact attack surfaces for development teams. Phantom Labs at BeyondTrust recently discovered a critical command-injection vulnerability in OpenAI Codex. This flaw allowed attackers to steal sensitive GitHub User Access Tokens. By exploiting how Codex handles task…

  • Critical Fortinet FortiClient EMS 0-Day Vulnerability Actively Exploited in the Wild

    Critical Fortinet FortiClient EMS 0-Day Vulnerability Actively Exploited in the Wild Fortinet has issued an emergency hotfix after security researchers disclosed a critical zero-day vulnerability in FortiClient EMS that is already being actively exploited by threat actors. Tracked as CVE-2026-35616 and carrying a CVSSv3 score of 9.1 (Critical), the flaw enables unauthenticated attackers to bypass…

  • New Progress ShareFile Bugs Let Attackers Take Over Servers Without Logging In

    New Progress ShareFile Bugs Let Attackers Take Over Servers Without Logging In A dangerous attack chain in Progress ShareFile that can allow attackers to take over exposed on-premises servers without first logging in. The issues affect customer-managed ShareFile Storage Zones Controller 5.x deployments, and Progress says customers should upgrade to version 5.12.4 or move to…

  • 14,000+ F5 BIG-IP APM Devices Exposed Online Amid Active RCE Vulnerability Exploits

    14,000+ F5 BIG-IP APM Devices Exposed Online Amid Active RCE Vulnerability Exploits A critical security flaw in F5’s BIG-IP Access Policy Manager (APM) is currently under active exploitation, leaving thousands of enterprise networks at risk. The vulnerability, officially tracked as CVE-2025-53521, has sparked urgent warnings across the cybersecurity community after its impact was upgraded from…

  • Multiple TP-Link Vulnerabilities Let Attackers Trigger DoS and Crash Routers

    Multiple TP-Link Vulnerabilities Let Attackers Trigger DoS and Crash Routers Multiple high-severity vulnerabilities exist in TP-Link’s Tapo C520WS smart security cameras. If exploited, these vulnerabilities may allow adjacent attackers to trigger Denial-of-Service (DoS) conditions, crash the device, or completely bypass authentication. TP-Link has released urgent firmware updates to address these critical security gaps. When a…

  • Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell Vulnerability

    Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell Vulnerability A massive automated credential theft campaign is actively targeting web applications worldwide. Cybersecurity researchers at Cisco Talos have uncovered an operation by a hacker group tracked as UAT-10608, which has already compromised over 700 servers. The attackers are exploiting a critical security flaw known as React2Shell…

  • Critical Cisco IMC Vulnerability Let Attackers Bypass Authentication

    Critical Cisco IMC Vulnerability Let Attackers Bypass Authentication Cisco has recently disclosed a critical security flaw affecting its Integrated Management Controller (IMC), prompting the release of urgent software updates. The vulnerability, officially tracked as CVE-2026-20093, has been assigned a critical Base CVSS score of 9.8, indicating the highest level of severity. This security weakness is…

  • Symantec DLP Agent Vulnerability Let Attackers Escalate Privileges

    Symantec DLP Agent Vulnerability Let Attackers Escalate Privileges A high-severity security flaw has been identified in the Symantec Data Loss Prevention (DLP) Agent for Windows. Tracked as CVE-2026-3991, this vulnerability allows a low-privileged local attacker to escalate their system privileges to the highest level. Security researcher Manuel Feifel discovered the flaw, and Broadcom has recently…

  • CISA Warns of F5 BIG-IP Vulnerability Actively Exploited in Attacks

    CISA Warns of F5 BIG-IP Vulnerability Actively Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed vulnerability affecting F5 BIG-IP systems to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaw is being actively leveraged in real-world attacks. The vulnerability, tracked as CVE-2025-53521, was officially listed on…

  • CISA Adds Aquasecurity Trivy Scanner Vulnerability to KEV Catalog

    CISA Adds Aquasecurity Trivy Scanner Vulnerability to KEV Catalog CISA has officially added a critical vulnerability affecting Aquasecurity’s Trivy scanner to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-33634, this alarming security flaw poses a severe risk to software development pipelines. By exploiting this vulnerability, threat actors can gain unauthorized access to highly sensitive…

  • ISC Warns of High-Severity Kea DHCP Flaw That Can Crash Services Remotely

    ISC Warns of High-Severity Kea DHCP Flaw That Can Crash Services Remotely The Internet Systems Consortium (ISC) has released a critical security advisory warning network administrators of a high-severity vulnerability affecting the Kea DHCP server. Tracked as CVE-2026-3608, this flaw allows unauthenticated remote attackers to trigger a stack overflow error. When successfully exploited, the vulnerability…

  • Dell Wyse Management Vulnerabilities Enables Complete System Compromise

    Dell Wyse Management Vulnerabilities Enables Complete System Compromise A recent security analysis has revealed how chaining seemingly minor logic flaws in Dell Wyse Management Suite (WMS) On-Premises can result in a complete system compromise. Security researchers demonstrated that combining two distinct vulnerabilities allows an unauthenticated attacker to bypass security controls and achieve remote code execution…

  • Oracle Issues Urgent Security Update for Critical RCE Flaw in Identity Manager and Web Services Manager

    Oracle Issues Urgent Security Update for Critical RCE Flaw in Identity Manager and Web Services Manager Oracle has issued an out-of-band Security Alert addressing a critical remote code execution (RCE) vulnerability, CVE-2026-21992, affecting two widely deployed Fusion Middleware components, Oracle Identity Manager and Oracle Web Services Manager. The vulnerability carries a CVSS 3.1 base score…

  • CISA Warns of Zimbra Collaboration Suite Vulnerability Exploited in Attacks

    CISA Warns of Zimbra Collaboration Suite Vulnerability Exploited in Attacks CISA has added a high-severity vulnerability affecting the Zimbra Collaboration Suite (ZCS) to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-66376, this security flaw is currently facing active exploitation in the wild. Organizations utilizing Zimbra must urgently prioritize remediation to prevent unauthorized access and…

  • CISA Warns of Microsoft SharePoint Vulnerability Exploited in Attacks

    CISA Warns of Microsoft SharePoint Vulnerability Exploited in Attacks A critical security flaw in Microsoft SharePoint has been identified as actively exploited, and on March 18, 2026, the vulnerability was officially added to the Known Exploited Vulnerabilities (KEV) catalog. This addition confirms that threat actors are actively exploiting the flaw in real-world network attacks, prompting…

  • Cisco Firewall 0-day Vulnerability Exploited in the Wild to Deploy Interlock Ransomware

    Cisco Firewall 0-day Vulnerability Exploited in the Wild to Deploy Interlock Ransomware An active campaign by the Interlock ransomware group is exploiting a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability may allow an unauthenticated remote attacker to execute arbitrary Java code with root privileges on an affected device.…

  • ‘RegPwn’ Windows Registry Vulnerability Enables Full System Access to Attackers

    ‘RegPwn’ Windows Registry Vulnerability Enables Full System Access to Attackers A high-severity Windows vulnerability dubbed “RegPwn” (CVE-2026-24291) is an elevation-of-privilege flaw that allows low-privileged users to gain full SYSTEM access. The MDSec red team discovered the vulnerability and successfully used it in internal engagements since January 2025, before it was addressed in a recent Microsoft…

  • Critical FortiClient SQL Injection Vulnerability Enables Arbitrary Database Access

    Critical FortiClient SQL Injection Vulnerability Enables Arbitrary Database Access A critical SQL injection vulnerability in Fortinet’s FortiClient Endpoint Management Server (EMS). Tracked as CVE-2026-21643, this severe flaw carries a CVSS score of 9.1. It allows unauthenticated attackers to execute arbitrary SQL commands and access sensitive database information. The issue specifically affects FortiClient EMS version 7.4.4…

  • Researchers Decrypt and Exploit Encrypted Palo Alto Cortex XDR BIOC Rules

    Researchers Decrypt and Exploit Encrypted Palo Alto Cortex XDR BIOC Rules Cybersecurity researchers have uncovered a critical evasion flaw in Palo Alto Networks’ Cortex XDR agent that allowed attackers to bypass behavioral detections completely. By reverse-engineering these encrypted rules, the InfoGuard Labs team discovered hardcoded global whitelists that enabled threat actors to execute malicious actions…

  • Microsoft to Block Windows 11 and Server 2025 Automated Installation After Critical RCE Vulnerability

    Microsoft to Block Windows 11 and Server 2025 Automated Installation After Critical RCE Vulnerability Microsoft has announced a two-phase plan to disable the hands-free deployment feature in Windows Deployment Services (WDS) following the discovery of a critical remote code execution (RCE) vulnerability tracked as CVE-2026-0386. The flaw, rooted in improper access control, allows an unauthenticated…

  • Microsoft Releases Out-of-Band Patch For Critical RRAS RCE Vulnerabilities in Windows 11

    Microsoft Releases Out-of-Band Patch For Critical RRAS RCE Vulnerabilities in Windows 11 Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2. Tracked as KB5084597 and targeting OS Builds 26200.7982 and 26100.7982, this update patches three actively concerning flaws in the Windows Routing and…

  • Critical LangSmith Account Takeover Vulnerability Puts Users at Risk

    Critical LangSmith Account Takeover Vulnerability Puts Users at Risk Miggo Security researchers have identified a critical vulnerability in LangSmith, tracked as CVE-2026-25750, that exposes users to potential token theft and complete account takeover. As a central hub for debugging and monitoring large language model data, LangSmith processes billions of events daily, making this a high-stakes…

  • Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Complete Root Takeover

    Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Complete Root Takeover Nine critical vulnerabilities have been discovered in AppArmor, which is a widely used mandatory access control framework for Linux. These vulnerabilities, collectively referred to as “CrackArmor,” enable unprivileged local users to escalate their privileges to root, break container isolation, and cause kernel operations…

  • OpenSSH GSSAPI Vulnerability Allow an Attacker to Crash SSH Child Processes

    OpenSSH GSSAPI Vulnerability Allow an Attacker to Crash SSH Child Processes A significant vulnerability in the GSSAPI Key Exchange patch was applied by numerous Linux distributions on top of their OpenSSH packages. The flaw, tracked as CVE-2026-3497, was uncovered by security researcher Jeremy Brown. It allows an attacker to crash SSH child processes reliably and…

  • Critical Microsoft Office Vulnerability Enables Remote Code Execution Attacks

    Critical Microsoft Office Vulnerability Enables Remote Code Execution Attacks On March 10, 2026, Microsoft released security updates to address a critical vulnerability in its widely used Office suite. Tracked as CVE-2026-26110, this security flaw allows an unauthorized attacker to execute malicious code on a victim’s device. With a high severity rating and a CVSS base…

  • GitLab Security Update – Patch for XSS and API DoS Vulnerabilities

    GitLab Security Update – Patch for XSS and API DoS Vulnerabilities GitLab has released urgent security updates for its Community Edition (CE) and Enterprise Edition (EE) to address a wide range of vulnerabilities. The newly released versions 18.9.2, 18.8.6, and 18.7.6 fix a total of 15 security issues, including critical Cross-Site Scripting (XSS) and Denial-of-Service…

  • Gogs Vulnerability Enables Attackers to Silently Overwrite Large File Storage Objects

    Gogs Vulnerability Enables Attackers to Silently Overwrite Large File Storage Objects A critical security flaw has been discovered in a popular open-source, self-hosted Git service, allowing attackers to overwrite Large File Storage (LFS) objects secretly. Tracked as CVE-2026-25921, this maximum-severity vulnerability carries a CVSS 3.1 score of 10.0. It creates a severe risk for software…

  • Microsoft .NET 0-Day Vulnerability Enables Denial-of-Service Attacks

    Microsoft .NET 0-Day Vulnerability Enables Denial-of-Service Attacks An emergency security update has been released to address a newly disclosed .NET Framework vulnerability, tracked as CVE-2026-26127. This security flaw allows unauthenticated, remote attackers to trigger a Denial-of-Service (DoS) condition on the network. With a CVSS score of 7.5, Microsoft has classified the vulnerability as “Important.” It…

  • Microsoft SQL Server Zero-Day Vulnerability Allows Attackers to Escalate Privileges

    Microsoft SQL Server Zero-Day Vulnerability Allows Attackers to Escalate Privileges Microsoft has disclosed a critical zero-day vulnerability in SQL Server that allows authenticated attackers to escalate their privileges to the highest administrative level on affected database systems. Tracked as CVE-2026-21262, the flaw was officially released on March 10, 2026, and has already been publicly disclosed,…

  • Fortinet Security Update – Patch for Multiple Vulnerabilities That Enable Malicious Command Execution

    Fortinet Security Update – Patch for Multiple Vulnerabilities That Enable Malicious Command Execution Fortinet released a sweeping security advisory on March 10, 2026, addressing eleven vulnerabilities across its core enterprise products, including FortiManager, FortiAnalyzer, FortiSwitchAXFixed, and FortiSandbox. The flaws range from authentication bypasses and buffer overflows to OS command injection and SQL injection, several of…

  • Zoom Workplace for Windows Vulnerabilities Allow Privilege Escalation

    Zoom Workplace for Windows Vulnerabilities Allow Privilege Escalation Zoom has released four security bulletins on March 10, 2026, disclosing multiple vulnerabilities across its Windows-based client suite. The flaws, ranging from High to Critical severity, could allow attackers to escalate privileges on affected systems, with one critical flaw exploitable by unauthenticated remote attackers with no prior…

  • Apache ZooKeeper Vulnerability Allow Attackers to Access Sensitive Data

    Apache ZooKeeper Vulnerability Allow Attackers to Access Sensitive Data Two “Important” severity vulnerabilities have been disclosed in Apache ZooKeeper, a widely used service for configuration management and naming in distributed applications, making timely security updates critical. These newly discovered flaws could allow attackers to access sensitive configuration data or bypass hostname verification to impersonate trusted…

  • iPhone Exploit Toolkit Used by Russian Spies Likely Originated from U.S. Contractor

    iPhone Exploit Toolkit Used by Russian Spies Likely Originated from U.S. Contractor A powerful iPhone exploit kit named “Coruna,” initially created for Western intelligence by U.S. contractor L3Harris, has fallen into the hands of Russian spies and Chinese cybercriminals.​ The Coruna toolkit features 23 different hacking components designed to compromise Apple iPhones. Trenchant originally built…

  • Critical ExifTool Flaw Lets Malicious Images Trigger Code Execution on macOS

    Critical ExifTool Flaw Lets Malicious Images Trigger Code Execution on macOS A newly discovered vulnerability is challenging the long-held belief that macOS systems are inherently immune to malware. Security researchers from Kaspersky’s Global Research and Analysis Team (GReAT) have identified a critical flaw that allows threat actors to execute malicious code on Macs simply by…

  • Hikvision Multiple Products Vulnerability Allows Malicious Users to Escalate Privileges

    Hikvision Multiple Products Vulnerability Allows Malicious Users to Escalate Privileges A severe vulnerability affecting multiple Hikvision products was added to the Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026. Tracked globally under CVE-2017-7921, this security flaw poses a significant risk to organizations that rely on these popular surveillance systems. The flaw enables malicious users…

  • CISA Warns of macOS and iOS Vulnerabilities Exploited in Attacks

    CISA Warns of macOS and iOS Vulnerabilities Exploited in Attacks The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding multiple Apple vulnerabilities currently facing active exploitation. On March 5, 2026, CISA added three security flaws affecting macOS, iOS, iPadOS, and other Apple products to its Known Exploited Vulnerabilities (KEV) catalog. This…

  • Critical Zero-Click Command Injection in AVideo Platform Allows Stream Hijacking

    Critical Zero-Click Command Injection in AVideo Platform Allows Stream Hijacking A critical vulnerability in AVideo, a widely used open-source video hosting and streaming platform. Tracked as CVE-2026-29058, this zero-click flaw carries a maximum severity rating, allowing unauthenticated attackers to execute arbitrary operating system commands on the targeted server. Discovered by security researcher Arkmarta, the vulnerability…

  • PoC Exploit Released Cisco SD-WAN 0-Day Vulnerability Exploited in the Wild

    PoC Exploit Released Cisco SD-WAN 0-Day Vulnerability Exploited in the Wild A public proof-of-concept (PoC) exploit has been released for CVE-2026-20127, a maximum-severity zero-day vulnerability in Cisco Catalyst SD-WAN Controller and SD-WAN Manager that has been actively exploited in the wild since at least 2023. Cisco Talos is tracking the threat activity under the cluster UAT-8616, describing…

  • Cisco Secure Firewall Management Vulnerability Allow Attackers to Bypass Authentication

    Cisco Secure Firewall Management Vulnerability Allow Attackers to Bypass Authentication Cisco has released a critical security advisory warning of a severe vulnerability in its Secure Firewall Management Center (FMC) Software. This flaw allows an unauthenticated, remote attacker to bypass authentication and execute script files, thereby gaining full root access to the underlying operating system. The…

  • Cisco Catalyst SD-WAN Vulnerabilities Allow Attackers to Gain Root Access

    Cisco Catalyst SD-WAN Vulnerabilities Allow Attackers to Gain Root Access An urgent security advisory from Cisco warns that multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could allow attackers to bypass authentication, gain root access, and overwrite critical files. Two of these vulnerabilities are already being exploited in the wild by hackers, making immediate remediation critical.​…

  • Mail2Shell Zero-Click Attack lets Hackers Hijack FreeScout Mail Servers

    Mail2Shell Zero-Click Attack lets Hackers Hijack FreeScout Mail Servers Researchers have uncovered a critical zero-click vulnerability in FreeScout, a widely used open-source help desk and shared mailbox application. Dubbed “Mail2Shell,” this flaw allows attackers to hijack mail servers without any user interaction or authentication. The vulnerability, tracked as CVE-2026-28289, bypasses a recently patched Remote Code…

  • CISA Warns of VMware Aria Operations Vulnerability Exploited in Attacks

    CISA Warns of VMware Aria Operations Vulnerability Exploited in Attacks A critical vulnerability affecting VMware Aria Operations has been added to the Known Exploited Vulnerabilities (KEV) catalog. Broadcom recently issued a security advisory detailing a flaw that allows unauthenticated attackers to execute arbitrary commands. Organizations are urged to implement mitigations or discontinue use of the…

  • OpenClaw 0-Click Vulnerability Allows Malicious Websites to Hijack Developer AI Agents

    OpenClaw 0-Click Vulnerability Allows Malicious Websites to Hijack Developer AI Agents A critical zero-interaction vulnerability in OpenClaw, one of the fastest-growing open-source AI agent frameworks in history, has been discovered by Oasis Security researchers, allowing any malicious website to silently seize full control of a developer’s AI agent without requiring plugins, extensions, or any user…

  • Claude Code Hacked to Achieve Full RCE and Hijacked Organization API keys

    Claude Code Hacked to Achieve Full RCE and Hijacked Organization API keys Critical vulnerabilities in Anthropic’s Claude Code, an AI-powered command-line development tool. The flaws could allow attackers to achieve Remote Code Execution (RCE) and exfiltrate Anthropic API keys by exploiting project configuration files. The issues were reported by Check Point Research (CPR), and Anthropic…

  • Google API Keys Expose Private Data Silently Through Gemini

    Google API Keys Expose Private Data Silently Through Gemini A critical privilege escalation vulnerability affecting Google Cloud API keys specifically how legacy public-facing keys now silently grant unauthorized access to Google’s Gemini AI endpoints, exposing private files, cached data, and billable AI usage to attackers. For over a decade, Google explicitly instructed developers to embed…

  • Critical Claude Code Vulnerabilities Enables Remote Code Execution Attacks

    Critical Claude Code Vulnerabilities Enables Remote Code Execution Attacks A critical security flaw in Anthropic’s Claude Code demonstrates how threat actors can exploit repository configuration files to execute malicious code and steal sensitive API keys. The vulnerabilities, tracked as CVE-2025-59536 and CVE-2026-21852, highlight a significant shift in the software supply chain threat landscape as AI…

  • 27 Years old Telnet Vulnerability Enables Attackers to Gain Root Access

    27 Years old Telnet Vulnerability Enables Attackers to Gain Root Access A newly confirmed vulnerability in the telnet daemon (telnetd) in GNU Inetutils has revived a 27-year-old security flaw, allowing attackers to gain root access by exploiting improper sanitization of environment variables, with no authentication required. Tracked as CVE-2026-24061, the flaw exists in GNU Inetutils through…

  • PoC Released for Windows Vulnerability That Allows Attackers to Cause Unrecoverable BSOD Crashes

    PoC Released for Windows Vulnerability That Allows Attackers to Cause Unrecoverable BSOD Crashes A proof-of-concept (PoC) exploit has been publicly released for CVE-2026-2636, a newly documented vulnerability in Windows’ Common Log File System (CLFS) driver that allows any low-privileged, unprivileged user to instantly crash a target system into an unrecoverable Blue Screen of Death (BSoD). The…

  • GitHub Copilot Exploited to Perform Full Repository Takeover via Passive Prompt Injection

    GitHub Copilot Exploited to Perform Full Repository Takeover via Passive Prompt Injection A critical AI-driven vulnerability in GitHub Codespaces, dubbed RoguePilot, that enabled attackers to silently hijack a repository by embedding malicious instructions inside a GitHub Issue. The flaw, uncovered by researchers at the Orca Research Pod, exploits the seamless integration between GitHub Issues and…

  • Critical Jenkins Vulnerability Exposes Build Environments to XSS Attacks

    Critical Jenkins Vulnerability Exposes Build Environments to XSS Attacks Security Advisory has revealed multiple vulnerabilities in Jenkins Core, including a stored Cross-Site Scripting (XSS) flaw that could expose build environments to severe security risks. The issues, identified as CVE-2026-27099 and CVE-2026-27100, were responsibly disclosed under the Jenkins Bug Bounty Program sponsored by the European Commission. The most critical of the…

  • PoC Released for Windows Notepad Vulnerability that Enables Malicious Command Execution

    PoC Released for Windows Notepad Vulnerability that Enables Malicious Command Execution Microsoft has patched a high-severity remote code execution (RCE) vulnerability in the modern Windows Notepad application, tracked as CVE-2026-20841, as part of its February 2026 Patch Tuesday release cycle. The flaw, rooted in command injection, was originally discovered by Cristian Papa and Alasdair Gorniak…

  • CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks

    CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks An urgent warning regarding a newly discovered zero-day vulnerability in Google Chromium, which is reportedly under active exploitation in the wild. The vulnerability, tracked as CVE-2026-2441, affects Chromium’s CSS (Cascading Style Sheets) engine and can enable remote attackers to execute arbitrary code on a victim’s…

  • Microsoft VS Code Extension with 11M Downloads Expose Developers to One-Click XSS Attacks

    Microsoft VS Code Extension with 11M Downloads Expose Developers to One-Click XSS Attacks A critical vulnerability discovered in Microsoft’s popular Visual Studio Code (VS Code) Live Preview extension, downloaded over 11 million times, exposes developers to one-click cross-site scripting (XSS) and local file exfiltration attacks. The flaw, now patched, was discovered by researchers Nir Zadok and Moshe Siman Tov Bustan from OX Security. The issue…

  • Notepad++ v8.9.2 Released with “Double-Lock” Update Mechanism Following Recent Hack

    Notepad++ v8.9.2 Released with “Double-Lock” Update Mechanism Following Recent Hack The widely used open-source text and code editor has released version v8.9.2, introducing a major security enhancement known as the “Double-Lock” update mechanism. This update addresses vulnerabilities that were exploited in a recent state-sponsored attack targeting the application’s update infrastructure. Last month, Notepad++’s official site confirmed that attackers…

  • Critical Windows Admin Center Vulnerability Allows Privilege Escalation

    Critical Windows Admin Center Vulnerability Allows Privilege Escalation A critical security update addressing a high‑severity elevation of privilege vulnerability in Windows Admin Center (WAC), identified as CVE‑2026‑26119. The flaw, rated CVSS 8.8 (Critical), stems from improper authentication (CWE‑287) that could allow an authorized attacker to gain elevated network privileges. According to Microsoft, this vulnerability affects Windows Admin Center version 2.6.4, and…

  • Apache NiFi Vulnerability Enables Authorization Bypass

    Apache NiFi Vulnerability Enables Authorization Bypass A newly disclosed high-severity vulnerability in Apache NiFi exposes systems to an authorization bypass that could allow lower-privileged users to modify restricted components. Tracked as CVE-2026-25903, the flaw impacts Apache NiFi versions 1.1.0 through 2.7.2 and has been fixed in version 2.8.0. According to the Apache NiFi security advisory, the issue arises from missing…