Vulnerabilities
VMware rolls out patch for a high-severity code execution vulnerability in the Fusion hypervisor.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Google has released two Chrome 128 updates to address six high-severity vulnerabilities reported by external researchers.
Vulnerabilities
Redmond's threat intel team said exploitation of CVE-2024-7971 can be attributed to a North Korean APT targeting the cryptocurrency sector for financial gain.
Vulnerabilities
Fortra limits access to FileCatalyst Workflow database after vendor knowledgebase article leaks default credentials.
Vulnerabilities
Censys warns of over 1,200 internet-accessible WhatsUp Gold instances potentially exposed to malicious attacks.
Vulnerabilities
Cisco on Wednesday announced NX-OS software updates that resolve multiple vulnerabilities, including a high-severity DoS bug.
Vulnerabilities
Google has significantly increased the rewards for Chrome browser vulnerabilities, offering up to $250,000 for remote code execution bugs.
Vulnerabilities
CISA is warning organizations that a second Apache OFBiz flaw is being exploited in the wild shortly after the release of PoC exploits.
Vulnerabilities
A critical vulnerability in the WPML WordPress plugin could allow a remote attacker to execute arbitrary code on the server.
Vulnerabilities
Google flags another high-severity vulnerability patched with the latest Chrome 128 release as exploited in the wild.
Vulnerabilities
SonicWall has patched CVE-2024-40766, a critical SonicOS vulnerability that can lead to unauthorized access or a firewall crash.
Vulnerabilities
SolarWinds has issued a second Web Help Desk hotfix to remove hardcoded credentials after patching a critical-severity vulnerability last week.
Nation-State
Hackers gained access to the switch using valid administrator credentials, and then ‘jailbroke’ from the application level into the OS level.
Malware & Threats
More than two years after the Log4j crisis, organizations are still being hit by crypto-currency miners and backdoor scripts.
Vulnerabilities
Atlassian has released patches for nine high-severity vulnerabilities in Bamboo, Confluence, Crowd, and Jira products.
Vulnerabilities
CISA warns that attackers are exploiting two critical-severity authentication bypass vulnerabilities impacting multiple Dahua products.
Vulnerabilities
A high-severity vulnerability in Cisco Unified CM and Unified CM SME could allow attackers to cause a denial-of-service (DoS) condition.
Vulnerabilities
A critical vulnerability in the Litespeed Cache WordPress plugin can allow attackers to hack websites by creating an admin user.
Vulnerabilities
Chrome 128 was released in the stable channel with patches for 38 vulnerabilities, including a V8 JavaScript engine flaw exploited in the wild.
Identity & Access
GitHub patches a trio of security defects in the GitHub Enterprise Server product and recommends urgent patching for corporate users.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)