Government
NIST is receiving support to get the NVD and CVE processing back on track within the next few months.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Vulnerabilities in the real-time IoT operating system Eclipse ThreadX before version 6.4 could lead to denial-of-service and code execution.
Vulnerabilities
Netflix has paid out more than $1 million for vulnerabilities found in its products since the launch of its bug bounty program in 2016.
ICS/OT
Backdoored JAVS courtroom recording and management software installer puts thousands at risk of complete takeover.
Vulnerabilities
Exploited in the wild, Chrome vulnerability CVE-2024-5274 is a high-severity flaw described as a type confusion in the V8 JavaScript and WebAssembly engine.
Supply Chain Security
Attackers are getting more sophisticated, better armed, and faster. Nothing in Rapid7's 2024 Attack Intelligence Report suggests that this will change.
Vulnerabilities
Veeam Backup Enterprise Manager update resolves multiple vulnerabilities, including a critical authentication bypass.
Vulnerabilities
Critical vulnerability in GitHub Enterprise Server allows unauthenticated attackers to obtain administrative privileges.
Vulnerabilities
Ivanti has released product updates to resolve multiple vulnerabilities, including critical code execution flaws in Endpoint Manager.
Vulnerabilities
Google released a Chrome 125 update to resolve four high-severity vulnerabilities reported by external researchers.
Network Security
QNAP rolls out patches for multiple vulnerabilities after proof-of-concept exploit published for a remote code execution vulnerability.
Government
CISA has added CVE-2023-43208, an unauthenticated remote code execution vulnerability, to its KEV catalog.
Cloud Security
Linguistic Lumberjack (CVE-2024-4323) is a critical vulnerability in the Fluent Bit logging utility that can allow DoS, information disclosure and possibly RCE.
Vulnerabilities
CISA has added two vulnerabilities in discontinued D-Link products to its KEV catalog, including a decade-old flaw.
Vulnerabilities
Google releases Chrome 125 to the stable channel with patches for nine vulnerabilities, including a zero-day.
Vulnerabilities
Intel has published 41 new May 2024 Patch Tuesday advisories covering a total of more than 90 vulnerabilities.
Malware & Threats
Patch Tuesday: Microsoft documents 60 security flaws in multiple software products and flags an actively exploited Windows zero-day for urgent attention.
Malware & Threats
Adobe documents multiple code execution flaws in a wide range of products, including the widely deployed Adobe Acrobat and Reader software.
Vulnerabilities
SAP has released 14 new and three updated security notes on its May 2024 Security Patch Day.
Vulnerabilities
VMware has patched three vulnerabilities exploited earlier this year at the Pwn2Own hacking competition.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)