Vulnerabilities
Cisco has released patches for seven high-severity vulnerabilities affecting products running IOS and IOS XE software.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
ZDI offers over $1 million in cash and prizes at the next Pwn2Own Automotive hacking contest, set for January 2025 in Tokyo.
Vulnerabilities
CVE-2024-7593 is the third Ivanti product vulnerability patched in recent months that has been exploited in the wild.
Vulnerabilities
Microchip Advanced Software Framework (ASF) 3 is affected by a critical vulnerability that could lead to remote code execution.
Vulnerabilities
ESET has released patches for two local privilege escalation vulnerabilities in security products for Windows and macOS.
Vulnerabilities
Versa Networks has released patches for a Versa Director vulnerability for which proof-of-concept (PoC) code exists.
Vulnerabilities
In addition to the Ivanti CSA flaw CVE-2024-8190, another vulnerability affecting the same product, tracked as CVE-2024-8963, has been exploited.
Vulnerabilities
Atlassian’s September 2024 monthly security bulletin details multiple high-severity vulnerabilities in four products.
Vulnerabilities
GitLab has patched a critical-severity SAML authentication bypass affecting both Community Edition (CE) and Enterprise Edition (EE) instances.
Government
CISA and the FBI have released an alert on XSS vulnerabilities, urging organizations to adopt a secure by design approach and eliminate them.
Vulnerabilities
Google has released Chrome 129 with patches for nine vulnerabilities, including a high-severity bug in the V8 engine.
Vulnerabilities
VMware warned that an attacker with network access could send a specially crafted packet to execute remote code. CVSS severity score 9.8/10.
Vulnerabilities
D-Link has released patches for critical vulnerabilities that could allow attackers to execute arbitrary code and commands on routers.
Vulnerabilities
Two recently patched Progress Software WhatsUp Gold vulnerabilities may have been exploited in the wild, possibly in ransomware attacks.
Vulnerabilities
Apple warns that attackers can use Siri to access sensitive user data, control nearby devices, or view recent photos without authentication.
Vulnerabilities
Microsoft warns that a recently patched Windows vulnerability was exploited in the wild as a zero-day prior to July 2024.
Vulnerabilities
SolarWinds has announced patches for a critical-severity remote code execution vulnerability in Access Rights Manager.
Vulnerabilities
The Ivanti Cloud Service Appliance vulnerability CVE-2024-8190 has been exploited in the wild, with attacks starting just days after disclosure.
Nation-State
Apple said there's “too significant a risk” of exposing the anti-exploit work needed to fend off the very adversaries involved in the case.
Vulnerabilities
Noteworthy stories that might have slipped under the radar: a possible Adobe Reader zero-day, researchers mistakenly hijack .mobi TLD, and an exploited WhatsApp View Once...
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)