Vulnerabilities
CISA says it has evidence that a recent critical-severity vulnerability in GeoServer is exploited in the wild.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
A second remote code execution vulnerability, tracked as CVE-2024-6409, was found in OpenSSH during an analysis of the regreSSHion flaw.
Email Security
Successful exploitation could allow attackers to deliver executable attachments to inboxes.
Supply Chain Security
GitLab issues an advisory for a critical-severity vulnerability that allows an attacker to trigger a pipeline as another user.
Network Security
Palo Alto Networks patched a critical vulnerability in its Expedition tool and addressed the impact of the recently disclosed BlastRADIUS vulnerability.
Data Protection
VMware warns that authenticated malicious users could enter specially crafted SQL queries and perform unauthorized read/write operations in the database.
Cloud Security
Citrix rolls out patches for multiple security vulnerabilities, including critical and high-severity issues in the NetScaler product line.
Incident Response
Patch Tuesday: Microsoft patches more than 140 security vulnerabilities in the Windows ecosystem, including a pair of exploited zero-days.
Malware & Threats
Adobe documents at least seven code execution bugs affecting Adobe Premiere Pro, Adobe InDesign and Adobe Bridge on Windows and macOS.
Identity & Access
Security vendor InkBridge Networks calls urgent attention to the discovery of a decades-old design flaw (CVE-2024-3596) in the popular RADIUS protocol.
Application Security
Patch Tuesday: Enterprise software vendor SAP releases patches for high-severity vulnerabilities in multiple products and tools.
Vulnerabilities
Vulnerability in Ghostscript (CVE-2024-29510) allows attackers to bypass sandbox for remote code execution.
Vulnerabilities
Noteworthy stories that might have slipped under the radar: Microsoft details Rockwell HMI vulnerabilities, smart grills hacked, Predator spyware activity drops.
Vulnerabilities
The critical OpenSSH vulnerability tracked as regreSSHion and CVE-2024-6387 may already be targeted by attackers, but mass exploitation is unlikely.
Mobile & Wireless
Google ships an Android security update with fixes for 15 vulnerabilities, including a critical-severity flaw in Framework.
Vulnerabilities
Splunk has patched multiple vulnerabilities in Splunk Enterprise, including high-severity remote code execution bugs.
Application Security
EVA Information Security has shared details on three CocoaPods vulnerabilities impacting millions of macOS and iOS applications.
Vulnerabilities
Google has announced a new KVM bug bounty program named kvmCTF with rewards of up to $250,000 for a full VM escape.
Vulnerabilities
Millions of OpenSSH servers could be vulnerable to unauthenticated remote code execution due to a vulnerability tracked as regreSSHion and CVE-2024-6387.
Vulnerabilities
Juniper Networks warns of a critical authentication bypass flaw impacting Session Smart routers and conductors.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)