Vulnerabilities
QNAP has released patches for multiple high-severity QTS and QuTS Hero vulnerabilities disclosed at the Pwn2Own Ireland 2024 hacking contest.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
SonicWall has released patches for multiple high-severity flaws in the SMA100 SSL-VPN secure access gateway.
Vulnerabilities
WatchTowr has published proof-of-concept (PoC) code for an unpatched vulnerability in the Mitel MiCollab enterprise collaboration platform.
Vulnerabilities
A critical directory traversal vulnerability in the SailPoint IdentityIQ IAM platform exposes restricted files to attackers.
Malware & Threats
Japanese device maker confirms zero-day router exploitation and warn that full patches won’t be available for a few weeks.
Vulnerabilities
More than 100 Cisco products are affected by an NX-OS vulnerability that allows attackers to bypass image signature verification.
Cloud Security
Veeam releases patches for two vulnerabilities in Service Provider Console, including a critical-severity remote code execution bug.
Vulnerabilities
A second vulnerability in Zyxel firewalls has been exploited in Helldown ransomware attacks over the past weeks.
Vulnerabilities
Cisco has updated an advisory for CVE-2014-2120 to warn customers that the vulnerability has been exploited in the wild.
Malware & Threats
The 'Bootkitty' prototype UEFI bootkit contains an exploit for LogoFAIL and was created in a South Korea university program.
Vulnerabilities
A critical-severity vulnerability in open source enterprise network monitoring tool Zabbix could lead to full system compromise.
Vulnerabilities
Microsoft informed customers that vulnerabilities affecting cloud, AI and other services have been patched, including an exploited flaw.
Supply Chain Security
ESET warns of a new reality: “UEFI bootkits are no longer confined to Windows systems alone.”
Vulnerabilities
VulnCheck warns of widespread exploitation of a year-and-a-half-old ProjectSend vulnerability for which multiple public exploits exist.
Vulnerabilities
Palo Alto Networks and SonicWall VPNs affected by vulnerabilities allowing remote code execution and privilege escalation.
Malware & Threats
The company warns that malicious hackers can craft exploits to elevate privileges or launch cross-site scripting attacks.
Vulnerabilities
IBM has released patches for two high-severity remote code execution vulnerabilities in Data Virtualization Manager and Security SOAR.
Vulnerabilities
CISA warns about attacks exploiting CVE-2023-28461, a critical vulnerability in Array Networks AG and vxAG secure access gateways.
Vulnerabilities
Two vulnerabilities in the Anti-Spam by CleanTalk WordPress plugin allowed attackers to execute arbitrary code remotely.
Vulnerabilities
VulnCheck finds hundreds of thousands of internet-accessible hosts potentially vulnerable to 2023’s top frequently exploited flaws.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)