Vulnerabilities
The critical-severity flaw leaks application memory and can be exploited to obtain authenticated administrative session IDs.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Initially disclosed as a high-severity denial-of-service (DoS), the bug was reclassified as a critical RCE issue.
Artificial Intelligence
Through the new program, OpenAI will reward reports covering design or implementation issues leading to material harm.
Vulnerabilities
The security defects could be used to bypass authentication, execute arbitrary commands, and decrypt configuration files.
Incident Response
Police in Germany physically warned organizations about the critical PTC Windchill vulnerability tracked as CVE-2026-4681.
Vulnerabilities
Specially crafted domains could be used to cause out-of-memory conditions, leading to memory leaks in the BIND resolvers.
Vulnerabilities
The high- and medium-severity flaws could lead to denial-of-service, secure boot bypass, information disclosure, and privilege escalation.
Endpoint Security
Apple released security fixes for older devices as well, in iOS 18.7.7, iPadOS 18.7.7, macOS Sequoia 15.7.5, and macOS Sonoma 14.8.5.
Vulnerabilities
The software refresh fixes eight memory safety bugs affecting seven Chrome components.
Vulnerabilities
An out-of-bounds read vulnerability can be exploited remotely without authentication to read sensitive information from memory.
Vulnerabilities
The flaws could allow attackers to access sensitive information, execute code, or cause unexpected behavior.
Vulnerabilities
CVE-2026-21992 can be used without authentication for remote code execution and it may have been exploited in the wild.
Vulnerabilities
The vulnerability is tracked as CVE-2025-32975 and it may have been exploited in attacks against the education sector.
Artificial Intelligence
Because attacker-supplied flow data is used in public flows, the bug leads to unauthenticated remote code execution.
Vulnerabilities
Latest ScreenConnect version adds encrypted storage and management to prevent unauthorized access to machine keys.
Malware & Threats
Insufficient sanitization of CSS content within HTML emails leads to inline script execution when the message is opened in a browser.
Vulnerabilities
The SharePoint remote code execution vulnerability CVE-2026-20963, which Microsoft patched in January, has been exploited in the wild.
Ransomware
Amazon found evidence that the FMC software vulnerability has been exploited since late January, and found links to Russia.
Artificial Intelligence
With exploitation of vulnerabilities taking just days, preemptive security must be the new model for defenders.
Mobile & Wireless
Targeting six iOS vulnerabilities and leading to full device compromise, the exploit chain is meant for surveillance.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)