Vulnerabilities
CISA urges federal agencies to immediately patch an exploited arbitrary file write vulnerability in Git that leads to remote code execution.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
MITRE has updated the list of Most Important Hardware Weaknesses to align it with evolving hardware security challenges.
Data Protection
A researcher has tested nearly a dozen password managers and found that they were all vulnerable to clickjacking attacks.
Vulnerabilities
Apple has rolled out iOS and macOS updates that resolve a zero-day vulnerability exploited in highly targeted attacks.
Vulnerabilities
Elastic has found no evidence of a vulnerability leading to RCE after details and PoC of a Defend EDR bypass were published online.
Vulnerabilities
CERT/CC has disclosed the details of information exposure vulnerabilities in a Workhorse Software application after patches were released.
Vulnerabilities
Google and Mozilla have released patches for multiple high-severity vulnerabilities affecting Chrome and Firefox.
Vulnerabilities
A researcher said he found vulnerable internal services that exposed the information of 270,000 Intel employees.
Vulnerabilities
A new public exploit chains two critical flaws in SAP NetWeaver, exposing unpatched instances to code execution attacks.
Vulnerabilities
More than 870 N-able N-central instances have not been patched against CVE-2025-8875 and CVE-2025-8876, two exploited vulnerabilities.
Application Security
CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained.
Vulnerabilities
Cisco has released over 20 advisories as part of its August 2025 bundled publication for ASA, FMC and FTD products.
Vulnerabilities
Path traversal and XXE injection flaws allowing unauthenticated remote code execution have been patched in Xerox FreeFlow Core.
Vulnerabilities
CISA reported becoming aware of attacks exploiting CVE-2025-8875 and CVE-2025-8876 in N-able N-central on the day they were patched.
Vulnerabilities
The new DDoS attack vector, which involves HTTP/2 implementation flaws, has been compared to Rapid Reset.
Vulnerabilities
Intel, AMD and Nvidia have published security advisories describing vulnerabilities found recently in their products.
Vulnerabilities
Fortinet and Ivanti have published new security advisories for their August 2025 Patch Tuesday updates.
Vulnerabilities
Adobe’s security updates fix vulnerabilities in Commerce, Substance, InDesign, FrameMaker, Dimension and other products.
Vulnerabilities
Microsoft’s August 2025 Patch Tuesday updates address critical vulnerabilities in Windows, Office, and Hyper-V.
Application Security
Taking place August 12-13, CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured,...
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)