Collecting Cyber-News from over 60 sources

Tag: flaw

CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed

Oct 3, 2026 1:43 PM

Tags: access, ai, cve, flaw, gitlab, vulnerability

GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to…
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed

Oct 3, 2026 1:43 PM

Tags: access, ai, cve, flaw, gitlab, vulnerability

GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to…
Critical GitLab AI Gateway Flaw Lets Attackers Execute Arbitrary Commands

Oct 3, 2026 8:43 AM

Tags: ai, cve, cvss, cyber, flaw, gitlab, update, vulnerability

GitLab has issued emergency security updates for a critical vulnerability in its Self-Hosted AI Gateway that could allow authenticated attackers to execute arbitrary commands on vulnerable AI Gateway deployments. The flaw, tracked as CVE-2026-90970, carries a CVSS severity score of 9.9 out of 10. The company released GitLab AI Gateway versions 19.2.4, 19.3.2, and 19.4.1…
AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal Credentials

Oct 3, 2026 8:43 AM

Tags: access, ai, authentication, cloud, credentials, cyber, flaw, open-source, service, vulnerability

AWS has released security fixes for four vulnerabilities affecting its open-source Loom AI agent orchestration platform and Amazon SageMaker Unified Studio. The flaws could allow attackers to bypass authentication, steal OAuth2 tokens and temporary cloud credentials, access internal services, and execute arbitrary code in another user’s SageMaker environment. AWS disclosed the issues in security bulletins…
U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

Oct 3, 2026 1:43 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, remote-code-execution, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw, CVE-2026-102489, is a session hijacking vulnerability in Zammad that can lead to remote code execution as the…
U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

Oct 3, 2026 1:43 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, remote-code-execution, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw, CVE-2026-102489, is a session hijacking vulnerability in Zammad that can lead to remote code execution as the…
U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

Oct 3, 2026 1:43 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, remote-code-execution, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw, CVE-2026-102489, is a session hijacking vulnerability in Zammad that can lead to remote code execution as the…
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

Oct 2, 2026 7:43 PM

Tags: access, ai, flaw, gitlab, service

A critical flaw in GitLab’s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory.The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw…
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes

Oct 2, 2026 7:43 PM

Tags: access, authentication, container, cve, exploit, flaw, kubernetes, update, vulnerability

Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems.The vulnerabilities are listed below – CVE-2026-63688 (CVSS score: 10.0) – A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an First seen…
Fortinet warns that critical flaw in FortiMail is facing exploitation

Oct 2, 2026 6:44 PM

Tags: access, credentials, exploit, flaw, fortinet, mail

Security researchers warn that attackers can gain access to credentials, stored mail and other connected systems. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fortinet-critical-flaw-fortimail-exploitation/832017/
Dell asks admins to patch max severity CSM flaws as soon as possible

Oct 2, 2026 3:43 PM

Tags: container, flaw, kubernetes, update, vulnerability

Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-max-severity-dell-csm-flaws-give-hackers-admin-privileges/
Multiple cPanel WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

Oct 2, 2026 1:43 PM

Tags: cyber, flaw, update, vulnerability

cPanel has released security updates to address three vulnerabilities in cPanel & WHM that could allow attackers to hijack WHM administrator sessions or execute commands as the root user. Organizations using affected deployments should prioritize upgrades, as these flaws affect all supported versions of cPanel & WHM before the newly released fixed versions. cPanel &…
Multiple cPanel WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

Oct 2, 2026 1:43 PM

Tags: cyber, flaw, update, vulnerability

cPanel has released security updates to address three vulnerabilities in cPanel & WHM that could allow attackers to hijack WHM administrator sessions or execute commands as the root user. Organizations using affected deployments should prioritize upgrades, as these flaws affect all supported versions of cPanel & WHM before the newly released fixed versions. cPanel &…
Capacitor Vulnerability Lets Remote Content Run With Full App Origin Trust

Oct 2, 2026 1:43 PM

Tags: android, cve, cvss, cyber, data, flaw, vulnerability

A critical vulnerability in Capacitor, identified as CVE-2026-103922, could allow attacker-controlled remote content to execute within vulnerable Android and iOS applications, posing as the application’s own trusted origin. This flaw, assigned a CVSS score of 9.3, affects WebView navigation handling in Capacitor and can expose same-origin data, cookies, local storage, and native functionality available through…
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware

Oct 2, 2026 1:43 PM

Tags: attack, credentials, cyber, flaw, github, hacker, malicious, malware, open-source, software, supply-chain, update

A growing wave of supply-chain attacks is proving the opposite: attackers are compromising legitimate open-source packages and using trusted update channels to deploy credential-stealing malware directly into developer and enterprise environments. Malicious Nx releases, published after attackers stole an npm publishing token through a GitHub Actions workflow flaw, ran post-install scripts that searched systems for…
A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data

Oct 2, 2026 12:43 PM

Tags: ai, chatgpt, data, flaw, hacker, hacking, software, vulnerability

While the focus has been on AI agents’ hacking capabilities, a recently patched vulnerability in a ChatGPT app shows that AI software is itself an inviting”, and vulnerable”, target. First seen on wired.com Jump to article: www.wired.com/story/a-flaw-in-chatgpts-mac-app-could-have-let-hackers-grab-sensitive-data/
Authentication Bypass Successfully Impersonated 95 Users Without Passwords or MFA

Oct 2, 2026 12:43 PM

Tags: authentication, cyber, flaw, mfa, microsoft, password

A critical authentication bypass that enabled the impersonation of 95 employee accounts, including privileged users, without passwords, multi-factor authentication (MFA), or valid Microsoft Entra ID tokens. The issue stemmed from two flaws in the application’s custom session-cookie implementation: a predictable hard-coded signing secret and the use of public database identifiers as authenticated session payloads. Although…
Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)

Oct 2, 2026 11:43 AM

Tags: email, exploit, flaw, fortinet, vulnerability, zero-day

Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway. Fortinet says the flaw has … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/
U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog

Oct 2, 2026 8:43 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, fortinet, infrastructure, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiMail flaw, tracked as CVE-2026-104286 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a path traversal vulnerability that can be triggered through…
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

Oct 2, 2026 8:43 AM

Tags: attack, cve, cybersecurity, exploit, flaw, fortinet, infrastructure, kev, vulnerability, zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.”An improper First seen on thehackernews.com Jump to…
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

Oct 2, 2026 8:43 AM

Tags: attack, cve, cybersecurity, exploit, flaw, fortinet, infrastructure, kev, vulnerability, zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.”An improper First seen on thehackernews.com Jump to…
U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog

Oct 2, 2026 8:43 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, fortinet, infrastructure, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiMail flaw, tracked as CVE-2026-104286 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a path traversal vulnerability that can be triggered through…
Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers

Oct 2, 2026 7:43 AM

Tags: cve, cvss, cyber, email, exploit, flaw, fortinet, vulnerability

Fortinet has disclosed a critical vulnerability in FortiMail that attackers are actively exploiting to compromise vulnerable email security appliances. This flaw, tracked as CVE-2026-104286, has a CVSS v3.1 score of 9.8. It enables unauthenticated attackers to write arbitrary files to the underlying system via specially crafted HTTP or HTTPS requests. Fortinet FortiMail Path Traversal Flaw…
Apache HTTP Server Flaws Enable Remote Code Execution and DenialService Attacks

Oct 2, 2026 7:43 AM

Tags: apache, attack, cyber, flaw, remote-code-execution, service, update, vulnerability

Apache HTTP Server administrators are urged to apply security updates following the disclosure of multiple vulnerabilities affecting Apache HTTP Server 2.4. These vulnerabilities include flaws that could allow for remote code execution (RCE), server crashes, memory exhaustion, and other denial-of-service (DoS) conditions. They impact various components of this widely used web server, particularly configurations that…
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Oct 2, 2026 1:43 AM

Tags: attack, cve, exploit, flaw, fortinet, unauthorized, vulnerability, zero-day

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Oct 2, 2026 1:43 AM

Tags: attack, cve, exploit, flaw, fortinet, unauthorized, vulnerability, zero-day

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Oct 2, 2026 1:43 AM

Tags: attack, cve, exploit, flaw, fortinet, unauthorized, vulnerability, zero-day

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Oct 2, 2026 1:43 AM

Tags: attack, cve, exploit, flaw, fortinet, unauthorized, vulnerability, zero-day

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/
Breach Roundup: Cisco SD-WAN Flaw Under Attack

Oct 1, 2026 11:43 PM

Tags: ai, attack, breach, china, cisco, flaw, hacker, network, openai, ransomware, russia

OpenAI Agents Target Canada, ShinyHunters Suspect Arrested. This week: Cisco SD-WAN, OpenAI agents target Canada, ShinyHunters suspect arrested in Amsterdam, Japanese railway ransomware, AI labs investigated, an accused Chinese hacker misses his cellphone. Russian hackers, an ATM jackpotting network sanctioned and former airmen sentenced for BEC. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-cisco-sd-wan-flaw-under-attack-a-33001
Kiteworks patches max severity code injection vulnerability

Oct 1, 2026 4:43 PM

Tags: email, flaw, injection, software, update, vulnerability

Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/kiteworks-patches-max-severity-email-protection-gateway-code-injection-vulnerability/