Tag: flaw
-
Critical Citrix NetScaler auth bypass now leveraged in attacks
Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/
-
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server.The flaw, tracked as CVE-2026-6471 (CVSS score: 7.2), has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. Versions before PostgreSQL 18.6, 17.11, 16.15,…
-
PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers. Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471 (CVSS score of 7.2). Present in releases dating back to 2014, the flaw can be exploited by attackers with low-level replication access to execute code,…
-
Google warns of new Chrome zero-day flaw exploited in attacks
Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/
-
MECCHA CHAMELEON Flaw Lets Malicious Custom Maps Achieve Remote Code Execution
A recently patched vulnerability in MECCHA CHAMELEON allowed attacker-controlled Steam Workshop maps to write files to arbitrary locations on Windows systems, potentially resulting in remote code execution once the victim restarted their device. Security researchers at Aikido Security disclosed a delayed remote code execution (RCE) vulnerability affecting the online hide-and-seek game MECCHA CHAMELEON, which reportedly…
-
MECCHA CHAMELEON Flaw Lets Malicious Custom Maps Achieve Remote Code Execution
A recently patched vulnerability in MECCHA CHAMELEON allowed attacker-controlled Steam Workshop maps to write files to arbitrary locations on Windows systems, potentially resulting in remote code execution once the victim restarted their device. Security researchers at Aikido Security disclosed a delayed remote code execution (RCE) vulnerability affecting the online hide-and-seek game MECCHA CHAMELEON, which reportedly…
-
MECCHA CHAMELEON Flaw Lets Malicious Custom Maps Achieve Remote Code Execution
A recently patched vulnerability in MECCHA CHAMELEON allowed attacker-controlled Steam Workshop maps to write files to arbitrary locations on Windows systems, potentially resulting in remote code execution once the victim restarted their device. Security researchers at Aikido Security disclosed a delayed remote code execution (RCE) vulnerability affecting the online hide-and-seek game MECCHA CHAMELEON, which reportedly…
-
MECCHA CHAMELEON Flaw Lets Malicious Custom Maps Achieve Remote Code Execution
A recently patched vulnerability in MECCHA CHAMELEON allowed attacker-controlled Steam Workshop maps to write files to arbitrary locations on Windows systems, potentially resulting in remote code execution once the victim restarted their device. Security researchers at Aikido Security disclosed a delayed remote code execution (RCE) vulnerability affecting the online hide-and-seek game MECCHA CHAMELEON, which reportedly…
-
Critical Super Forms WordPress Flaw Actively Exploited to Achieve Remote Code Execution
Threat actors are actively exploiting a critical vulnerability in the Super Forms WordPress plugin, allowing them to upload PHP backdoors and gain remote code execution. This flaw, tracked as CVE-2026-14894, affects Super Forms versions 6.3.313 and earlier. Administrators are urged to upgrade to version 6.3.314 immediately. Super Forms WordPress Flaw Wordfence disclosed this unauthenticated arbitrary…
-
Plex Urges Users to Update Media Server as Multiple Security Flaws Are Discovered
Plex has urged users to promptly update their Plex Media Server and Plex Desktop software following the release of fixes for several undisclosed security issues in older versions. The recommended versions are Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The company advises that all server owners and desktop users upgrade to the latest release…
-
Google fixes the sixth actively exploited Chrome zero-day of 2026
Tags: browser, chrome, cve, exploit, flaw, google, remote-code-execution, update, vulnerability, zero-dayGoogle patched 12 Chrome flaws, including an actively exploited V8 zero-day that could enable remote code execution through a crafted webpage. Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046 (CVSS score of 8.8), an actively exploited V8 type confusion flaw. The bug affects Chrome’s JavaScript and WebAssembly engine and could let a…
-
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence.The vulnerabilities in question are – CVE-2026-14894 (CVSS score: 9.8) – A missing file type validation vulnerability in Super Forms Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type,…
-
TP-Link Archer AX55 Flaws Enable Remote Code Execution and Admin Password Theft
Tags: credentials, cve, cyber, flaw, login, network, password, remote-code-execution, router, service, theft, update, vulnerabilityTP-Link has released security updates for two vulnerabilities found in its Archer AX55 v4 wireless router. These vulnerabilities could allow attackers on the local network to crash a key networking service, potentially execute code, or steal administrator credentials from captured login traffic. The vulnerabilities, identified as CVE-2026-18167 and CVE-2026-18330, impact the router’s EasyMesh component and…
-
TP-Link Archer AX55 Flaws Enable Remote Code Execution and Admin Password Theft
Tags: credentials, cve, cyber, flaw, login, network, password, remote-code-execution, router, service, theft, update, vulnerabilityTP-Link has released security updates for two vulnerabilities found in its Archer AX55 v4 wireless router. These vulnerabilities could allow attackers on the local network to crash a key networking service, potentially execute code, or steal administrator credentials from captured login traffic. The vulnerabilities, identified as CVE-2026-18167 and CVE-2026-18330, impact the router’s EasyMesh component and…
-
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws.The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The streaming media service did not elaborate on what those issues are, but said CVE identifiers have been requested for…
-
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws.The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The streaming media service did not elaborate on what those issues are, but said CVE identifiers have been requested for…
-
Google Chrome V8 Flaw Actively Exploited in the Wild, Update Released
Google has released an urgent update for Chrome Stable to address CVE-2026-85046, a high-severity type confusion vulnerability in the V8 JavaScript and WebAssembly engine that is actively being exploited. This flaw can allow remote attackers to execute code within Chrome’s sandbox by convincing a victim to open a specially crafted HTML page. The security update…
-
Hackers Compromise More Than 14,500 Dahua Security Cameras in Massive Campaign
A large-scale campaign dubbed Operation CameraSwarm compromised at least 14,530 Dahua IP cameras and related surveillance devices in just 35 days. Exposing how unpatched flaws, weak credentials, and cloud-connected P2P features can turn video-security infrastructure into a remotely accessible attack surface. Threat intelligence firm Hunt.io reconstructed the operation after discovering an unsecured HTTP directory belonging…
-
OpenAI GPT-6 Astra Discovers Zero-Day Flaws and Builds Working Exploits in Cyber Tests
OpenAI has introduced GPT-6 Astra, a groundbreaking model that has reportedly achieved perfect results on ExploitBench and demonstrated improved controls during cybersecurity testing. This announcement positions Astra as a significant advancement in authorized security research, in which models must analyze unfamiliar software vulnerabilities, generate reliable proof-of-concept code, and operate within the parameters of a controlled…
-
Sangoma Switchvox Flaw Under Attack: 4,000 VoIP Systems Exposed
Hackers are exploiting a critical Sangoma Switchvox flaw that enables unauthenticated remote code execution. Admins should patch and check for compromise. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-sangoma-switchvox-cve-2026-9586-rce/
-
Cisco Fixed Critical RCE in Nexus 9000 Series Switches
Cisco patched a critical Nexus 9000 vulnerability, CVE-2026-20212, allowing unauthenticated remote root code execution. Cisco has released patches for a critical flaw, tracked as tracked as CVE-2026-20212 (CVSS score of 9.8) in 10 Silicon One-based Nexus 9000 switches. The vulnerability could let an unauthenticated remote attacker execute code with root privileges. Cisco’s Technical Assistance Center…
-
Breach Roundup: FBI Probes Sale of 153 Million Driver’s Licenses
Also, Dropbox Accounts Breached, BGP Hijack Compromises Virtualizor Servers. This week: a massive breach of U.S. driver’s licenses, Dropbox accounts breached, a BGP hijack, Artifactory flaw, Russian national indicted, Aesto health breach, a new U.S. Coast Guard cybersecurity policy office, Morocco denied a security breach and a Brazilian illicit marketplace. First seen on govinfosecurity.com Jump…
-
Breach Roundup: FBI Probes Sale of 153 Million Driver’s Licenses
Also, Dropbox Accounts Breached, BGP Hijack Compromises Virtualizor Servers. This week: a massive breach of U.S. driver’s licenses, Dropbox accounts breached, a BGP hijack, Artifactory flaw, Russian national indicted, Aesto health breach, a new U.S. Coast Guard cybersecurity policy office, Morocco denied a security breach and a Brazilian illicit marketplace. First seen on govinfosecurity.com Jump…
-
Breach Roundup: FBI Probes Sale of 153 Million Driver’s Licenses
Also, Dropbox Accounts Breached, BGP Hijack Compromises Virtualizor Servers. This week: a massive breach of U.S. driver’s licenses, Dropbox accounts breached, a BGP hijack, Artifactory flaw, Russian national indicted, Aesto health breach, a new U.S. Coast Guard cybersecurity policy office, Morocco denied a security breach and a Brazilian illicit marketplace. First seen on govinfosecurity.com Jump…
-
Breach Roundup: FBI Probes Sale of 153 Million Driver’s Licenses
Also, Dropbox Accounts Breached, BGP Hijack Compromises Virtualizor Servers. This week: a massive breach of U.S. driver’s licenses, Dropbox accounts breached, a BGP hijack, Artifactory flaw, Russian national indicted, Aesto health breach, a new U.S. Coast Guard cybersecurity policy office, Morocco denied a security breach and a Brazilian illicit marketplace. First seen on govinfosecurity.com Jump…
-
Sangoma Switchvox Flaw Under Attack: 4,000 VoIP Systems Exposed
Hackers are exploiting a critical Sangoma Switchvox flaw that enables unauthenticated remote code execution. Admins should patch and check for compromise. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-sangoma-switchvox-cve-2026-9586-rce/
-
HPE patches critical ArubaOS-CX remote code execution flaw
Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/
-
Cryptohack Roundup: US Seizes Hamas-Linked Crypto
Also: ClickFix Attack Abuses Polygon Blockchain. This week, U.S. seizes Hamas-linked funds, ClickFix attack abuses Polygon blockchain, Bithumb wins lawsuit over bitcoin credit error, software flaw exposes six Cosmos networks, Cronos restarts after Tectonic attack and Moonwell investigates $8.7 million exploit. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cryptohack-roundup-us-seizes-hamas-linked-crypto-a-32734
-
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an IOS XR hardening release bundling 7 umbrella CVEs, 2 of which are rated 9.8, with no workaround for any IOS XR version.The Nexus vulnerability,…
-
SonicWall urges immediate patching of chained vulnerabilities
Just weeks after a wave of ransomware attacks, new flaws in SMA1000 series appliances are being exploited. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/sonicwall-immediate-patching-chained-vulnerabilities/829567/