Collecting Cyber-News from over 60 sources

Tag: cvss

Critical Gitea Flaw Lets Unauthenticated Attackers Read Server Files and Execute Code

Aug 4, 2026 12:26 PM

Tags: attack, cve, cvss, cyber, flaw, remote-code-execution, vulnerability

A critical vulnerability in Gitea has been identified, potentially allowing unauthenticated remote attackers to read arbitrary files on vulnerable servers and escalate to remote code execution (RCE). This vulnerability is tracked as CVE-2026-59774 and GHSA-6v53-hr58-556r, affecting Gitea versions from 1.22.11.22.11.22.1 to 1.27.01.27.01.27.0. It has been assigned a critical CVSS score of 3.1, with an attack…
Thermo Fisher DNA Analysis Software Flaw Lets Attackers Secretly Alter Test Data

Aug 4, 2026 8:27 AM

Tags: cve, cvss, cyber, data, flaw, software, update, vulnerability

Thermo Fisher Scientific has released security updates for a high-severity flaw in its Applied Biosystems Human Identification (HID) software. This vulnerability could allow nearly undetectable manipulation of DNA test data files before analysis. The issue, tracked as CVE-2026-17583, carries a CVSS v4 score of 8.2 and affects .fsa and .hid file outputs used in forensic…
TP-Link TL-WR940N Router Flaw Lets Unauthenticated Attackers Execute Code Remotely

Aug 3, 2026 4:26 PM

Tags: control, cve, cvss, cyber, flaw, router, vulnerability

TP-Link has announced a high-severity security vulnerability in its TL-WR940N v6 wireless router that could allow an unauthenticated remote attacker to execute arbitrary code and potentially take full control of the affected device. This vulnerability is tracked as CVE-2026-12935 and has a CVSS v4.0 score of 8.7, categorized as high. TP-Link TL-WR940N Router Flaw According…
Hackers Exploit Critical Arista VeloCloud Flaw to Execute OS Commands

Aug 3, 2026 8:26 AM

Tags: access, cve, cvss, cyber, exploit, flaw, hacker, injection, network, vulnerability

Arista Networks has issued a warning about attackers actively exploiting CVE-2026-16812, a critical unauthenticated OS command injection vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments. This flaw carries a CVSS v3.1 and v4.0 severity score of 10.0, allowing a remote attacker with network access to the VCO web interface to access privileged internal functions and potentially…
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction

Aug 1, 2026 10:26 AM

Tags: adobe, automation, cve, cvss, flaw, update, vulnerability

Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution.The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.It has been described as a case of incorrect authorization that could result in…
Critical SolarWinds Web Help Desk Flaw Lets Attackers Bypass SAML Authentication

Jul 31, 2026 11:26 AM

Tags: access, authentication, cve, cvss, cyber, exploit, flaw, unauthorized, vulnerability

SolarWinds has released Web Help Desk (WHD) version 2026.2.1 to address a critical authentication bypass vulnerability. This flaw could allow attackers to gain unauthorized access to affected systems by exploiting weaknesses in SAML-based single sign-on (SSO) implementations. Tracked as CVE-2026-28323 and assigned a CVSS score of 9.8, the vulnerability impacts deployments where SAML 2.0 authentication…
Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

Jul 28, 2026 4:10 PM

Tags: advisory, cve, cvss, flaw, github, network, service

OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default.The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt’s GitHub advisory, lets an unauthenticated attacker able to reach the DHCPv6 server overwrite a stack buffer…
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Jul 25, 2026 4:10 PM

Tags: attack, authentication, cve, cvss, flaw, malicious, rce, remote-code-execution, vulnerability

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba’s JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires…
Critical FreePBX Flaws Let Unauthenticated Attackers Execute Code and Take Over Administrator Accounts

Jul 23, 2026 2:10 PM

Tags: cvss, cyber, flaw, github, remote-code-execution, risk, vulnerability

Critical security vulnerabilities in FreePBX have been disclosed, exposing organizations to risks of unauthenticated remote code execution and the takeover of administrator accounts. These flaws, tracked under GitHub advisories GHSA-37j8-fhxx-9vhp and GHSA-g27h-xf3q-h3rm, affect FreePBX versions 16 and 17, carrying a CVSS v4 base score of 9.3, which highlights their severity. Security researchers warn that these…
Critical Check Point SmartConsole Flaw Exploited in the Wild to Bypass Authentication

Jul 23, 2026 1:10 PM

Tags: access, authentication, cve, cvss, cyber, exploit, flaw, unauthorized, vulnerability

A critical authentication bypass vulnerability affecting Check Point SmartConsole has been actively exploited in the wild, allowing attackers to gain unauthorized access to security management systems under specific configurations. The flaw, tracked as CVE-2026-16232, carries a CVSS score of 9.3 and impacts Check Point Security Management and Multi-Domain Management deployments, particularly when management interfaces are…
SolarWinds Serv-U Update Fixes 15 Critical Vulnerabilities Enabling Remote Code Execution as Root

Jul 22, 2026 11:09 AM

Tags: cvss, cyber, remote-code-execution, update, vulnerability, windows

SolarWinds has released Serv-U 2026.3, which includes fixes for a cluster of 9.1 CVSS critical vulnerabilities that allow remote code execution (RCE) and privilege escalation up to root on Unix-like systems. This update significantly strengthens the managed file transfer (MFT) and FTP server platform against potential takeovers. While Windows instances are rated as having a…
Critical Zoom Workplace Flaw Lets Unauthenticated Attackers Take Over Accounts Remotely

Jul 16, 2026 1:31 PM

Tags: cve, cvss, cyber, flaw, software, vulnerability, windows

Zoom has disclosed a critical vulnerability in its Windows desktop software that could allow unauthenticated attackers to take over user accounts remotely. This issue, tracked as CVE-2026-53412 and addressed in bulletin ZSB-26014, arises from improper input validation in Zoom Workplace for Windows and the Zoom Workplace VDI Client for Windows. The vulnerability has a CVSS…
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

Jul 14, 2026 10:43 PM

Tags: cve, cvss, data, flaw, sap, update, vulnerability

SAP has rolled out updates to address multiple vulnerabilities as part of its July 2026 security updates, including a critical flaw in SAP NetWeaver Application Server ABAP.The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leverage logical errors in memory management to cause a memory…
SAP July 2026 Patch Day Fixes Critical NetWeaver, Approuter, and Commerce Cloud Vulnerabilities

Jul 14, 2026 10:36 AM

Tags: cloud, cve, cvss, cyber, sap, update, vulnerability

SAP’s July 2026 Security Patch Day addresses multiple high-impact vulnerabilities across its enterprise products, including a severe memory corruption issue in the SAP NetWeaver Application Server ABAP. The most critical vulnerability, tracked as CVE-2026-44747, has a CVSS score of 9.9 and affects several SAP kernel releases used by NetWeaver AS ABAP. SAP has categorized this…
CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities

Jul 13, 2026 11:33 AM

Tags: attack, cisa, cvss, cybersecurity, exploit, flaw, infrastructure, kev, malicious, vulnerability, zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities (KEV) catalog after reports confirmed active zero-day attacks targeting the iCagenda and Balbooa extensions for Joomla. Both flaws carry the maximum CVSS severity score of 10.0 and can allow attackers to upload malicious files that ultimately lead to remote code execution. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisa-cve-2026-48939-cve-2026-56291/
Critical WordPress OAuth SSO Plugin Flaw Allows Unauthenticated Attackers to Gain Admin Access

Jul 13, 2026 11:33 AM

Tags: access, authentication, cve, cvss, cyber, flaw, vulnerability, wordpress

A critical authentication bypass vulnerability has been disclosed in the widely used miniOrange OAuth Single Sign-On (SSO) WordPress plugin, carrying a near-maximum CVSS score of 9.8. This flaw, tracked as CVE-2026-57807, affects all plugin versions up to and including version 38.5.8. As of now, it remains unpatched, with no official fix available from the vendor.…
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

Jul 13, 2026 9:33 AM

Tags: cve, cvss, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability, zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild.The vulnerabilities, both rated 10.0 on the CVSS scoring system, are below – CVE-2026-48939 – A vulnerability in the First…
Kritische Adobe-Sicherheitslücke aktiv ausgenutzt

Jul 9, 2026 3:17 PM

Tags: adobe, bug, cvss

Eine kritische Sicherheitslücke in Adobe ColdFusion mit dem maximalen CVSS-Wert 10 wird aktiv ausgenutzt. Angreifer reagierten innerhalb von zwei Stunden. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/adobe-sicherheitsluecke-ausgenutzt
HP Linux Imaging and Printing Software Flaw Enables Privilege Escalation Attacks

Jul 9, 2026 2:16 PM

Tags: attack, cve, cvss, cyber, exploit, flaw, linux, network, remote-code-execution, software, vulnerability

A critical vulnerability has been discovered in HP Linux Imaging and Printing Software (HPLIP), which exposes Linux systems to potential privilege escalation and remote code execution attacks. This vulnerability, tracked as CVE-2026-14544, has a CVSS v3 score of 9.8, indicating maximum severity due to its potential for network exploitation, low attack complexity, and lack of…
Sechs CVSS 10.0 Schwachstellen im Juni – Adobe reagiert auf KI-entdeckte Schwachstellen mit zweitem Patchday

Jul 9, 2026 8:16 AM

Tags: adobe, ai, cvss, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/adobe-coldfusion-updates-zwei-wochen-zyklus-a-14d269a8881b5925842c520d440ce36d/
Hackers Exploit Maximum Severity Adobe ColdFusion Flaw

Jul 7, 2026 11:16 AM

Tags: adobe, cvss, exploit, flaw, hacker, threat, vulnerability

Threat actors are exploiting an Adobe ColdFusion vulnerability which has a CVSS score of 10.0 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/exploit-maximum-severity-adobe/
Critical BeyondTrust Authentication Flaws Expose Remote Support Appliances to Attacks

Jul 7, 2026 8:18 AM

Tags: access, advisory, attack, authentication, cvss, cyber, data, flaw, risk, service, unauthorized, vulnerability

BeyondTrust has disclosed multiple critical and high-severity vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) appliances. These flaws expose organizations to risks such as authentication bypass, denial-of-service attacks, and unauthorized data access. Tracked under advisory BT26-03, these vulnerabilities have a maximum CVSS v4 score of 9.2 and were identified through the company’s…
Critical Cursor IDE Flaws Let Attackers Execute Code via Zero-Click Prompt Injection

Jul 2, 2026 8:18 AM

Tags: attack, cve, cvss, cyber, flaw, injection, remote-code-execution, vulnerability

Two significant remote code execution (RCE) vulnerabilities in the widely used Cursor ID expose developers to zero-click attacks driven by prompt injection. These vulnerabilities, tracked as CVE-2026-50548 and CVE-2026-50549, collectively known as >>DuneSlide,<< carry a CVSS score of 9.8. They demonstrate how development environments powered by large language models (LLMs) can unintentionally increase the attack…
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

Jul 1, 2026 6:17 PM

Tags: adobe, cvss, flaw, update, vulnerability

Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic.The ColdFusion updates “resolves critical and important vulnerabilities”¯that could lead to”¯arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass,” Adobe said in an alert released Tuesday.The vulnerabilities are listed First seen on thehackernews.com Jump to article:…
Adobe ColdFusion Critical Vulnerabilities Let Attackers Execute Arbitrary Code

Jul 1, 2026 10:16 AM

Tags: adobe, cvss, cyber, vulnerability

Adobe has released an emergency security bulletin, APSB26-68, addressing 11 vulnerabilities in Adobe ColdFusion 2025 and ColdFusion 2023, with multiple vulnerabilities receiving the maximum CVSS base score of 10.0. Published on June 30, 2026, this bulletin carries Adobe’s highest Priority Rating of 1, indicating that these vulnerabilities are either actively targeted or pose an extremely…
Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth

Jun 30, 2026 12:16 PM

Tags: advisory, api, cve, cvss, flaw, update, vulnerability

A critical vulnerability in Progress Kemp LoadMaster can let an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API.The flaw, tracked as CVE-2026-8037, carries a CVSS score of 9.8 according to ZDI. A patch is available. If you run LoadMaster with the API enabled, update now.Progress…
Splunk Secure Gateway RCE Vulnerability Lets Low-Privileged Attackers Execute Arbitrary Code

Jun 29, 2026 3:16 PM

Tags: attack, cve, cvss, cyber, data, rce, remote-code-execution, vulnerability

A newly disclosed high-severity vulnerability in Splunk Secure Gateway (SSG) allows low-privileged authenticated users to achieve remote code execution (RCE) on affected systems, significantly increasing the attack surface for enterprise Splunk deployments. This vulnerability, tracked as CVE-2026-20251, has been assigned a CVSS score of 8.8. It arises from the unsafe deserialization of user-controlled data using…
Critical Google Gemini CLI Flaw Lets Attackers Execute Code on Headless CI Platforms

Jun 29, 2026 11:16 AM

Tags: advisory, cve, cvss, cyber, flaw, github, google, vulnerability

A critical vulnerability has been identified in Google’s Gemini CLI and the associated run-gemini-cli GitHub Action. This flaw exposes headless continuous integration (CI) platforms to potential host-level code execution when processing untrusted workspaces. It is tracked as CVE-2026-12537, with the advisory identifying it as GHSA-wpqr-6v78-jr5g. Rated at the maximum severity under CVSS v4, the issue…
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw

Jun 29, 2026 11:16 AM

Tags: credentials, cve, cvss, flaw, malicious

A public proof-of-concept is now out for CVE-2026-55200, a critical flaw in libssh2 that lets a malicious or compromised SSH server trigger memory corruption on a connecting client, with possible code execution. No credentials, no user interaction. The bug affects every release up to and including 1.11.1 and carries a CVSS 4.0 score of 9.2.libssh2…
Kritische Angriffskette in UniFi OS – Drei aktiv ausgenutzte CVSS-10.0-Schwachstellen in Ubiquiti UniFi OS

Jun 29, 2026 8:16 AM

Tags: cvss, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/ubiquiti-unifi-os-cve-2026-34908-34909-34910-angriffskette-a-13601a0b4f32b5e61a8e1b51dfba372a/