Malware & Threats
VMware warns that a malicious user with network access may be able to use specially crafted SQL queries to gain database access.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
SonicWall has confirmed that an SMA 1000 zero-day tracked as CVE-2025-23006 has been exploited in the wild.
Mobile & Wireless
Apple has released fixes for dozens of vulnerabilities in its mobile and desktop products, including an iOS zero-day exploited in attacks.
Vulnerabilities
Vulnerabilities in Git’s credential retrieval protocol could have allowed attackers to compromise user credentials.
Vulnerabilities
CISA has added the JQuery flaw CVE-2020-11023, previously linked to APT1, to its Known Exploited Vulnerabilities (KEV) catalog.
Vulnerabilities
Pwn2Own Automotive 2025 has come to an end and participants have earned a total of $886,000 for exploits targeting EV chargers and infotainment systems.
Vulnerabilities
Cisco has released patches for three vulnerabilities, including a critical privilege escalation bug and a DoS flaw for which exploit code exists.
Vulnerabilities
SonicWall has credited Microsoft for reporting CVE-2025-23006, a critical remote command execution vulnerability possibly exploited in the wild.
Vulnerabilities
$380,000 paid out on the first day of Pwn2Own Automotive 2025 for exploits targeting car infotainment units, operating systems, and chargers.
Vulnerabilities
Oracle has released 318 new security patches to address roughly 200 unique CVEs as part of its January 2025 Critical Patch Update.
IoT Security
Kaspersky has disclosed the details of over a dozen vulnerabilities discovered in a Mercedes-Benz MBUX infotainment system.
Vulnerabilities
Three vulnerabilities in SimpleHelp could allow attackers to compromise the remote access software’s server and the client machine.
Network Security
New research shows that over 4 million systems on the internet, including VPN servers and home routers, are vulnerable to attacks due to tunneling...
Email Security
A vulnerability in Google’s OAuth implementation allows takeover of old employee accounts when domain ownership changes.
Vulnerabilities
Google has released Chrome 132 with fixes for 16 vulnerabilities, including multiple high-severity security defects.
Vulnerabilities
Nvidia, Zoom, and Zyxel have released patches for multiple high-severity vulnerabilities across their products.
Vulnerabilities
Ivanti has released patches for multiple vulnerabilities in Endpoint Manager (EPM), including four critical-severity flaws.
Vulnerabilities
Fortinet patches critical vulnerabilities, including a zero-day that has been exploited in the wild since at least November 2024.
Malware & Threats
Patch Tuesday: Adobe ships patches for more than a dozen security defects in a wide range of software products.
Malware & Threats
Patch Tuesday: Microsoft's January Patch Tuesday rollout includes fixes for 160 security defects, the largest number of CVEs addressed in any single month since...
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)