Vulnerabilities
Palo Alto Networks has published 10 new security advisories, including one for a high-severity firewall authentication bypass vulnerability.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Threat actors are increasingly exploiting two old vulnerabilities in ThinkPHP and OwnCloud in their attacks.
Vulnerabilities
Google has released a Chrome 133 update to address four high-severity vulnerabilities reported by external researchers.
Vulnerabilities
Ivanti and Fortinet on Tuesday released patches for multiple critical- and high-severity vulnerabilities in their products.
Vulnerabilities
Chipmakers Intel, AMD and Nvidia on Tuesday published new security advisories to inform customers about vulnerabilities found in their products.
Malware & Threats
The Microsoft Patch Tuesday machine hummed loudly this month with urgent fixes for a pair of already-exploited Windows zero-days.
Malware & Threats
Patch Tuesday: Adobe patches 45 vulnerabilities across multiple products and warns of remote code execution exploitation risks.
Vulnerabilities
OpenSSL has patched CVE-2024-12797, a high-severity vulnerability found by Apple that can allow man-in-the-middle attacks.
Vulnerabilities
SAP has released 19 new and two updated security notes on its February 2025 patch day, including six notes for high-severity vulnerabilities.
Vulnerabilities
Intel says roughly 100 of the 374 vulnerabilities it patched last year were firmware and hardware security defects.
Artificial Intelligence
Microsoft has added more Copilot consumer products to its bug bounty program and is offering higher rewards for medium-severity vulnerabilities.
Vulnerabilities
Critical vulnerabilities in Cisco Identity Services Engine could lead to elevation of privileges and system configuration modifications.
Vulnerabilities
Chrome 133 and Firefox 135 were released with patches for multiple high-severity memory safety vulnerabilities.
Vulnerabilities
CISA has added CVE-2024-29059, a flaw affecting Microsoft .NET, to its Known Exploited Vulnerabilities catalog.
Vulnerabilities
Multiple Zyxel legacy DSL CPE products are affected by exploited zero-day vulnerabilities that will not be patched.
Vulnerabilities
The number of vulnerabilities first reported as exploited surged last year amid a decrease in zero-day reports.
Malware & Threats
VMware calls attention to patches for multiple 'high-risk' security defects in its Aria Operations and Aria Operations for Logs products.
Vulnerabilities
TeamViewer has released patches for a high-severity elevation of privilege vulnerability in its client and host applications for Windows.
Malware & Threats
GreyNoise reports active exploitation of a newly discovered zero-day vulnerability in Zyxel CPE devices. There are no patches available.
Identity & Access
Threat actors have been exploiting SimpleHelp remote access software shortly after the disclosure of three vulnerabilities.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)