Vulnerabilities
A critical directory traversal vulnerability in Fortra FileCatalyst Workflow could lead to remote code execution.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Thousands of WordPress sites are at risk of takeover due to a critical privilege escalation vulnerability in two closed MiniOrange plugins.
Vulnerabilities
Cisco releases patches for high-severity denial-of-service and elevation of privilege vulnerabilities in IOS RX software.
Cloud Security
A high-severity Kubernetes vulnerability tracked as CVE-2023-5528 can be exploited to execute arbitrary code on Windows endpoints.
Vulnerabilities
Fortinet has released patches for critical code execution vulnerabilities in FortiOS, FortiProxy, and FortiClientEMS.
Security Architecture
Microsoft ships patches for at least 60 security vulnerabilities in the Windows ecosystem and warned of remote code execution risks.
Application Security
Enterprise software maker SAP documents multiple critical-severity issues and warns of risk of command injection attacks.
Risk Management
Patch Tuesday: Adobe ships a hefty batch of security updates to fix critical-severity vulnerabilities in multiple enterprise-facing products.
Vulnerabilities
Google paid out $10 million via its bug bounty programs in 2023, bringing the total to nearly $60 million since 2010.
Vulnerabilities
A high-severity XSS vulnerability in the Ultimate Member plugin allows attackers to inject scripts into WordPress sites.
Vulnerabilities
Critical-severity vulnerability could allow network attackers to access QNAP NAS devices without authentication.
Vulnerabilities
150,000 systems possibly impacted by the recent Fortinet vulnerability CVE-2024-21762, but there is still no evidence of widespread exploitation.
Vulnerabilities
Noteworthy stories that might have slipped under the radar: Google AI bug bounties, font vulnerabilities, IBM opens new training facility.
Vulnerabilities
High-severity flaws in Cisco Secure Client could lead to code execution and unauthorized remote access VPN sessions.
Vulnerabilities
CISA adds Pixel Android phone (CVE-2023-21237) and Sunhillo SureLine (CVE-2021-36380) flaws to its known exploited vulnerabilities catalog.
Mobile & Wireless
Apple rolls out urgent patches to fix multiple security flaws in its flagship iOS platform and warned about zero-day exploits in the wild.
Malware & Threats
The most serious flaws allow hackers with local admin rights to execute code as the virtual machine's VMX process running on the host.
Vulnerabilities
A critical authentication bypass in TeamCity allows remote attackers to take full control of vulnerable servers.
IoT Security
A high-severity vulnerability in HikCentral Professional could lead to unauthorized access to certain URLs.
Vulnerabilities
CISA says a high-severity elevation of privilege vulnerability in Microsoft Streaming Service is actively exploited in the wild.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)