Vulnerabilities
The vulnerability impacts multiple Rust tar parsers, allowing attackers to smuggle additional archive entries.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
The Critical Patch Update contains 374 new security patches that resolve many vulnerabilities.
IoT Security
Participants exploited 34 previously unknown vulnerabilities to hack printers, NAS devices, and smart home products.
Vulnerabilities
Leading to code execution, authentication bypass, and privilege escalation, the flaws were added to CISA’s KEV list.
Vulnerabilities
Affecting the Fireware OS iked process, the vulnerability can lead to remote code execution and does not require authentication.
Vulnerabilities
The cybersecurity agency has added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog.
Vulnerabilities
Attackers could exploit vulnerable deployments to intercept and tamper with communications in certain configurations.
Vulnerabilities
On Android, the out-of-bounds write issue can be triggered during the processing of media files without user interaction.
Vulnerabilities
Other noteworthy stories that might have slipped under the radar: Capita fined £14 million, ICTBroadcast vulnerability exploited, Spyware maker NSO acquired.
IoT Security
Set for January 2026 at Automotive World in Tokyo, the contest will have six categories, including Tesla, infotainment systems, EV chargers, and automotive OSes.
Vulnerabilities
CVE-2025-55315 is an HTTP request smuggling bug leading to information leaks, file content tampering, and server crashes.
Vulnerabilities
The unauthenticated local file inclusion bug allows attackers to retrieve the machine key and execute code remotely via a ViewState deserialization issue.
Vulnerabilities
AISLE aims to automate the vulnerability remediation process by detecting, exploiting, and patching software vulnerabilities in real time.
Vulnerabilities
A public PoC existed when Adobe patched the Experience Manager Forms (AEM Forms) bug in early August.
Vulnerabilities
Fortinet and Ivanti have announced their October 2025 Patch Tuesday updates, which patch many vulnerabilities across their products.
Vulnerabilities
Adobe has published a dozen security advisories detailing over 35 vulnerabilities across its product portfolio.
Vulnerabilities
SAP has rolled out additional protections for insecure deserialization bugs resolved in NetWeaver AS Java recently.
Vulnerabilities
It’s unclear if the new Oracle E-Business Suite flaw, which can be exploited remotely without authentication, has been used in the wild.
Vulnerabilities
Patches were rolled out for more than 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
Vulnerabilities
The unpatched vulnerabilities allow attackers to execute arbitrary code remotely and escalate their privileges.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)