Vulnerabilities
Tracked as CVE-2025-37164, the critical flaw could allow unauthenticated, remote attackers to execute arbitrary code.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The security defect is described as an SQL injection that could allow attackers to achieve remote code execution.
Vulnerabilities
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.
Vulnerabilities
Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files.
Vulnerabilities
The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance.
Vulnerabilities
Tracked as CVE-2025-59374, the issue is a software backdoor implanted in Asus Live Update in a supply chain attack.
Vulnerabilities
The medium-severity flaw has been exploited in combination with a critical bug for remote code execution.
Malware & Threats
The critical zero-day is tracked as CVE-2025-20393 and it impacts Secure Email Gateway and Secure Email and Web Manager appliances.
Artificial Intelligence
The startup takes an agentic approach to preventing vulnerability exploitation by uncovering exposure across assets.
Supply Chain Security
From open source libraries to AI-powered coding assistants, speed-driven development is introducing new third-party risks that threat actors are increasingly exploiting.
Vulnerabilities
The issue allows attackers to write arbitrary data to any file, or delete arbitrary files to obtain System privileges.
Vulnerabilities
Threat actors are exploiting the two critical authentication bypass vulnerabilities against FortiGate appliances.
Vulnerabilities
Atlassian has released software updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira.
Vulnerabilities
Apple has released macOS and iOS updates to patch two WebKit zero-days exploited in an “extremely sophisticated” attack.
Vulnerabilities
Threat actors have hacked at least nine organizations by exploiting the recently patched Gladinet CentreStack flaw.
Vulnerabilities
Because user input is not sufficiently sanitized, attackers could exploit the flaw to define external entities within an XML request.
Application Security
XSS remains the top software weakness, followed by SQL injection and CSRF. Buffer overflow issues and improper access control make it to top 25.
Vulnerabilities
All critical vulnerabilities in Microsoft, third-party, and open source code are eligible for rewards if they impact Microsoft services.
Cloud Security
Participants earned rewards at the hacking competition for Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL vulnerabilities.
Vulnerabilities
The exploited flaw allows attackers to overwrite files outside the repository, leading to remote code execution.
Vulnerabilities
Most of the 100 vulnerabilities resolved this week, including critical flaws, were in third-party dependencies.
Vulnerabilities
The Chrome zero-day does not have a CVE and it's unclear who reported it and which browser component it affects.
Vulnerabilities
The two security defects impact FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO login authentication enabled.
Vulnerabilities
The XSS vulnerability could allow remote attackers to execute arbitrary JavaScript code with administrator privileges.
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)