Vulnerabilities
Tracked as CVE-2025-10035 (CVSS score of 10), the critical deserialization vulnerability could be exploited for command injection.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
ICS/OT
Novakon HMIs are affected by remote code execution and information exposure vulnerabilities.
Vulnerabilities
An exploited type confusion in the V8 JavaScript engine tracked as CVE-2025-10585 was found by Google Threat Analysis Group this week.
Endpoint Security
Researchers devise Phoenix, a new Rowhammer attack that achieves root on DDR5 systems in less than two minutes.
Vulnerabilities
Apple has announced major mobile and desktop platform releases and addressed an exploited bug in older platforms.
Vulnerabilities
KioSoft was notified about a serious NFC card vulnerability in 2023 and only recently claimed to have released a patch.
Vulnerabilities
High-severity flaws in IOS XR could lead to ISO image verification bypass and denial-of-service conditions.
Vulnerabilities
Google patched a critical use-after-free vulnerability in Chrome that could potentially lead to code execution.
Vulnerabilities
High-severity vulnerabilities could lead to remote code execution, privilege escalation, information disclosure, and configuration tampering.
Vulnerabilities
Microsoft has released patches for dozens of flaws in Windows and other products, including ones with ‘exploitation more likely’ rating.
Vulnerabilities
Adobe has patched nearly two dozen vulnerabilities across nine of its products with its September 2025 Patch Tuesday updates.
Vulnerabilities
The critical-severity NetWeaver flaws could be exploited for remote code execution and privilege escalation.
Vulnerabilities
A critical SAP S/4HANA code injection flaw tracked as CVE-2025-42957 and allowing full system takeover has been exploited in the wild.
Vulnerabilities
Google has observed ViewState deserialization attacks leveraging a sample machine key exposed in older deployment guides.
Network Security
Flaw allows attackers to reset and hijack TP-Link TL-WA855RE devices; CISA urges users to retire discontinued extenders.
Vulnerabilities
Chrome's latest release addresses a high-severity use-after-free vulnerability in the V8 JavaScript engine that could be exploited for remote code execution.
Vulnerabilities
Tracked as CVE-2025-57819 (CVSS score of 10/10), the bug is described as an insufficient sanitization of user-supplied data.
Vulnerabilities
The vulnerability (CVE-2025-55177) was exploited along an iOS/macOS zero-day in suspected spyware attacks.
Supply Chain Security
With more than 4 million weekly downloads, the Nx build platform became the first known supply chain breach where hackers weaponized AI assistants for...
Network Security
Zero-day exploited in the wild forces Citrix and CISA to push emergency patch deadlines for federal agencies.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)