Vulnerabilities
The two browser updates resolve 26 security defects, including bugs that could be exploited for code execution.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Two vulnerabilities patched this month by Microsoft were disclosed publicly before fixes were released.
Vulnerabilities
Adobe has released patches for 25 vulnerabilities across its products, including a critical Apache Tika flaw in ColdFusion.
Vulnerabilities
SAP has released 17 security notes, including four that address critical SQL injection, RCE, and code injection vulnerabilities.
Vulnerabilities
Tenable has released PoC code and technical details after the vendor announced the availability of patches for three vulnerabilities.
Vulnerabilities
The Emergency Directives were retired because they achieved objectives or targeted vulnerabilities included in the KEV catalog.
Vulnerabilities
Fresh attacks targeted three VMware ESXi vulnerabilities that were disclosed in March 2025 as zero-days.
Vulnerabilities
The bug can allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials.
Vulnerabilities
Tracked as CVE-2026-21858 (CVSS score 10), the bug enables remote code execution without authentication.
Vulnerabilities
The maximum-severity code injection flaw can be exploited without authentication for remote code execution.
Vulnerabilities
An error in the firmware-upload handler leads to devices starting an unauthenticated root-level Telnet service.
Vulnerabilities
Four vulnerabilities have been fixed in the latest release of Veeam Backup & Replication.
Malware & Threats
The critical-severity vulnerability allows unauthenticated, remote attackers to execute arbitrary shell commands.
Vulnerabilities
The flaw is tracked as CVE-2025-54957 and its existence came to light in October 2025 after it was discovered by Google researchers.
Vulnerabilities
With 24 new vulnerabilities known to be exploited by ransomware groups, the list now includes 1,484 software and hardware flaws.
Privacy
WhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day.
Vulnerabilities
GreyNoise has observed thousands of requests targeting a dozen vulnerabilities in Adobe ColdFusion during the Christmas 2025 holiday.
Vulnerabilities
Tracked as CVE-2020-12812, the exploited FortiOS flaw allows threat actors to bypass two-factor authentication.
Vulnerabilities
Dubbed MongoBleed, the high-severity flaw allows unauthenticated, remote attackers to leak sensitive information from MongoDB servers.
Vulnerabilities
The critical-severity bug in the Fireware OS’s iked process leads to unauthenticated remote code execution.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)