Vulnerabilities
XSS vulnerability allowed a threat actor to redirect users to arbitrary domains.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Cisco has patched command injection and DoS vulnerabilities affecting some of its Nexus switches, including a high-severity flaw.
Vulnerabilities
CISA has added CVE-2024-20953, an Oracle Agile PLM vulnerability patched in January 2024, to its KEV catalog.
Nation-State
Cisco Talos observed Chinese hackers pivoting from a compromised device operated by one telecom to target a device in another telecom.
Vulnerabilities
OPSWAT details two critical vulnerabilities in the Mongoose ODM library for MongoDB leading to remote code execution on the Node.js server.
Vulnerabilities
CISA has added a Craft CMS flaw tracked as CVE-2025-23209 to its Known Exploited Vulnerabilities (KEV) catalog.
Vulnerabilities
Palo Alto Networks is warning customers that a second vulnerability patched in February is being exploited in attacks.
Vulnerabilities
Atlassian has released patches for 12 critical- and high-severity vulnerabilities in Bamboo, Bitbucket, Confluence, Crowd, and Jira.
Vulnerabilities
Proof-of-concept (PoC) code and technical details on four critical-severity Ivanti EPM vulnerabilities are now available.
Vulnerabilities
Microsoft has patched CVE-2025-24989, a Power Pages privilege escalation vulnerability that has been exploited in attacks.
Vulnerabilities
The latest OpenSSH update patches two vulnerabilities, including one that enabled MitM attacks with no user interaction.
Vulnerabilities
Google and Mozilla resolve high-severity memory safety vulnerabilities with the latest Chrome and Firefox security updates.
Vulnerabilities
A critical vulnerability tracked as CVE-2025-21589 has been patched in Juniper Networks’ Session Smart Router.
Vulnerabilities
Palo Alto Networks has confirmed that a recently patched firewall vulnerability tracked as CVE-2025-0108 is being actively exploited.
Endpoint Security
Xerox released security updates to resolve pass-back attack vulnerabilities in Versalink multifunction printers.
Vulnerabilities
Meta received close to 10,000 vulnerability reports and paid out over $2.3 million in bug bounty rewards in 2024.
Vulnerabilities
The exploitation of a recent SonicWall vulnerability has started shortly after proof-of-concept (PoC) code was published.
Vulnerabilities
ClearSky Cyber Security says it has seen a new Windows zero-day being exploited by a Chinese APT named Mustang Panda.
Vulnerabilities
Attempts to exploit CVE-2024-0108, an authentication bypass vulnerability in Palo Alto firewalls, started one day after disclosure.
Nation-State
Rapid7 finds a new zero-day vulnerability in PostgreSQL and links it to chain of attacks against a BeyondTrust Remote Support product.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)