Tag: flaw
-
Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection
Security researchers have revealed a vulnerability chain known as “SalesBleed,” associated with Salesforce’s Agentforce. This vulnerability could allow attackers to extract sensitive CRM data through an indirect prompt injection embedded in a public Web-to-Lead form. The attack does not require a Salesforce login or a click from the victim and could leak data via DNS…
-
Sudo Vulnerability Lets Attackers Bypass Time-Based Authorization Controls
A recently disclosed high-severity vulnerability in Sudo could allow local, unprivileged Linux users to manipulate time-based authorization restrictions in sudoers policies. Tracked as CVE-2026-96512, this vulnerability arises from how Sudo handles the attacker-controlled TZ environment variable when evaluating NOTBEFORE and NOTAFTER constraints. Red Hat is monitoring this flaw under Bug 2539327, which is currently categorized…
-
Cloudflare Containers Flaw Could Expose Data From Other Customers’ Workloads
Cloudflare has addressed a cross-tenant data exposure vulnerability in its Containers platform that could have allowed one customer’s workload to recover residual data belonging to other customers on the same infrastructure. This flaw also affected Cloudflare Sandboxes and the Browser Run service within Browser Rendering, both of which utilize the same underlying disk implementation. Cloudflare…
-
Cloudflare Fixes Flaw That Let One Container Read Another Customer’s Leftover Disk Data
A flaw in Cloudflare Containers let a paying customer read data that other customers’ containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday.The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not…
-
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
Tags: adobe, api, attack, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-5430 (CVS score: 9.8) – A path traversal vulnerability in WSO2 API Control Plane, First…
-
Breach Roundup: Thousands of AI Relays Hide China Users
Tags: ai, breach, china, cisa, cve, cybercrime, data, data-breach, flaw, google, jobs, north-korea, russia, scam, vpnAlso, CISA Ends Weekly CVE Bulletin After 22 Years, Check Point VPN Flaw Exploited. This week: AI relay servers connect to China, CISA ends weekly CVE bulletin, cybercriminal guilty pleas and sentences, drug dealers hijack Google Maps, Russian Burger King customers’ data leaked, North Korean fake job scams, SectopRAT, a Check Point VPN flaw and…
-
Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus’s own software to gain root access, the highest level of control over an Android phone.OnePlus told him the same flaws affect many…
-
AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS
MikroTrick chains two RouterOS flaws to bypass authentication and gain admin access. AI helped researchers uncover the attack chain within days. MikroTik pushed out patches on September 3, 2026 for several RouterOS issues at once, calling it an important security update without saying what it actually fixed. That silence was deliberate, and it didn’t last…
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…
-
Hackers now exploit critical Roundcube flaw in code injection attacks
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/
-
Ransomware gangs now exploiting critical TeamCity flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/
-
Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication
A highly severe vulnerability in Roundcube Webmail is being actively exploited, posing risks to unpatched email servers through unauthenticated SQL injection attacks. This vulnerability, tracked as CVE-2026-48842, affects Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. On September 21, the Canadian Center for Cyber Security updated advisory AV26-503, warning that reports from the…
-
Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks
Tags: attack, authentication, cve, cvss, cyber, exploit, flaw, hacker, rce, remote-code-execution, update, vpn, vulnerability, zero-dayCheck Point has warned customers about the active exploitation of two critical vulnerabilities in its VPN gateway and Security Management products: CVE-2026-85102 and the newly disclosed CVE-2026-93616. Both vulnerabilities have a CVSS score of 9.8 and allow for pre-authentication attacks, making immediate patching and reducing exposure essential. Check Point Flaws CVE-2026-85102 is an improper certificate-validation…
-
Apache Tomcat Update: 12 Security Flaws Fixed in Tomcat 11.0.26
The Apache Software Foundation has released Tomcat 11.0.26, an Apache Tomcat Update that resolves 12 security vulnerabilities. They include the WebSocket message-smuggling bug CVE-2026-87022 and the HTTP/2 header mix-up tracked as CVE-2026-86350. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/apache-tomcat-update-cve-2026-87022/
-
Apache Tomcat Update: 12 Security Flaws Fixed in Tomcat 11.0.26
The Apache Software Foundation has released Tomcat 11.0.26, an Apache Tomcat Update that resolves 12 security vulnerabilities. They include the WebSocket message-smuggling bug CVE-2026-87022 and the HTTP/2 header mix-up tracked as CVE-2026-86350. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/apache-tomcat-update-cve-2026-87022/
-
GNOME 50.5 security fixes patch a gvfs CVE and Epiphany code injection
GNOME 50.5, which the GNOME Release Team shipped on September 24, patches a CVE in the gvfs file system layer, a JavaScript injection flaw in the Epiphany web browser and a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/24/gnome-50-5-security-fixes/
-
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).”An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file First seen on…
-
cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data
cPanel has released patches for CVE-2026-68490, a vulnerability related to incorrect permissions in its CalDAV/CardDAV implementation. This flaw could allow a local user on a shared server to access calendar events and contacts from other hosting accounts. The issue affects cPanel/WHM version 120 and later, highlighting the risks associated with tenant isolation in shared-hosting environments.…
-
Microsoft Upgrades SharePoint Flaw From Spoofing to 8.8 RCE
A SharePoint Server vulnerability tracked as CVE-2026-65660 turned out to be far more serious than Microsoft first indicated. The company originally described it as a spoofing issue with a CVSS score of 6.5. In reality, it is an authenticated RCE flaw rated 8.8. That gap matters, because security teams that trusted the first label may…
-
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 has been released with fixes for 12 security vulnerabilities, including a significant flaw that could allow attackers to bypass security constraints protecting WebSocket endpoints. This release also addresses several denial-of-service (DoS) issues affecting WebSocket, AJP, HTTP/2, and HTTP/1.0 request handling. Dated September 15, 2026, the release addresses flaws that were publicly disclosed…
-
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/
-
Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The security firm bug is already being exploited. Attackers can abuse the flaw without logging in to…
-
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Attackers exploited a previously unknown flaw in Check Point’s Security Management Server in a handful of targeted attacks on July 23, the company said.The flaw, CVE-2026-93616, allows an attacker who can access the server’s web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server…
-
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders.On some servers, that can go further, allowing the attacker to run their own code. The fix shipped on September 22 in WordPress 7.1.2, with fixes for…
-
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request.The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication…
-
Critical Linux KVM Flaw Enables GuestHost Escape on ARM64 Systems
A critical vulnerability in the Linux Kernel-based Virtual Machine (KVM) for ARM64 systems could let attackers escape a virtual machine and gain read and write access to host kernel memory. This flaw, tracked as CVE-2026-89775, specifically affects ARM64 hosts with nested virtualization enabled and has been addressed in the mainline Linux kernel. Security researcher Hyunwoo…
-
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22.The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate…
-
New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
A new flaw in the Linux kernel’s KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled.The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it…