Collecting Cyber-News from over 60 sources

Tag: flaw

New Ubuntu Flaw Enables Local Attackers to Gain Root Access

Mar 18, 2026 5:10 PM

Tags: access, cve, exploit, flaw

CVE-2026-3888 Ubuntu snap flaw lets local users escalate to root via timing-based exploit First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ubuntu-flaw-enables-root-access/
New Ubuntu Flaw Enables Local Attackers to Gain Root Access

Mar 18, 2026 5:10 PM

Tags: access, cve, exploit, flaw

CVE-2026-3888 Ubuntu snap flaw lets local users escalate to root via timing-based exploit First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ubuntu-flaw-enables-root-access/
New Ubuntu Flaw Enables Local Attackers to Gain Root Access

Mar 18, 2026 5:10 PM

Tags: access, cve, exploit, flaw

CVE-2026-3888 Ubuntu snap flaw lets local users escalate to root via timing-based exploit First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ubuntu-flaw-enables-root-access/
Apple WebKit Security Flaw Exposes iOS and macOS Users to Content-Based Bypass Attacks

Mar 18, 2026 2:10 PM

Tags: apple, attack, cyber, flaw, iphone, macOS, update, vulnerability

Apple has released emergency security updates to address a critical WebKit vulnerability that currently exposes iPhone, iPad, and Mac users to sophisticated content-based bypass attacks. Delivered seamlessly via the Background Security Improvements mechanism on March 17, 2026, this targeted patch secures Apple devices against potential Same Origin Policy violations without requiring a full operating system…
Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE

Mar 18, 2026 2:10 PM

Tags: cve, cvss, cybersecurity, exploit, flaw, rce, remote-code-execution, vulnerability

Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges.The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in…
9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors

Mar 18, 2026 2:10 PM

Tags: access, control, cybersecurity, flaw, Internet, risk, vulnerability

Cybersecurity researchers have warned about the risks posed by low-cost IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices, which can grant attackers extensive control over compromised hosts.The nine vulnerabilities, discovered by Eclypsium, span four different products from GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. The most severe of them allow First…
CVE-2026-3888: Ubuntu Desktop 24.04+ vulnerable to Root exploit

Mar 18, 2026 1:09 PM

Tags: control, cve, exploit, flaw, vulnerability

Ubuntu flaw CVE-2026-3888 lets attackers gain root via a systemd timing exploit, affecting Desktop 24.04+ with high severity. Qualys researchers found a high-severity flaw, tracked as CVE-2026-3888 (CVSS score of 7.8), in Ubuntu Desktop 24.04+, which allows attackers to exploit a systemd cleanup timing issue to escalate privileges to root and potentially take full control…
Critical Telnetd Vulnerability Enables Remote Code Execution Attacks

Mar 18, 2026 1:09 PM

Tags: attack, cve, cvss, cyber, exploit, flaw, network, remote-code-execution, vulnerability

A critical buffer overflow vulnerability has been discovered in the GNU InetUtils telnetd daemon. Tracked as CVE-2026-32746, the flaw carries a maximum CVSS 3.1 score of 9.8 and allows unauthenticated attackers to execute arbitrary code with root privileges. There is no confirmed active exploitation, and the severity of the flaw demands immediate attention from network…
Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

Mar 18, 2026 11:11 AM

Tags: access, control, cve, exploit, flaw

A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level.Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system.”This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root…
Ubuntu Desktop Vulnerability Lets Attackers Escalate Privileges to Full Root Access

Mar 18, 2026 11:11 AM

Tags: access, cve, cvss, cyber, flaw, threat, vulnerability

The Qualys Threat Research Unit (TRU) has disclosed a critical Local Privilege Escalation (LPE) vulnerability affecting default installations of Ubuntu Desktop version 24.04 and later. Tracked as CVE-2026-3888, this high-severity flaw carries a CVSS v3.1 score of 7.8 and allows unprivileged local attackers to completely compromise the host system by escalating their privileges to full…
Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

Mar 18, 2026 11:11 AM

Tags: access, control, cve, exploit, flaw

A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level.Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system.”This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root…
New Kubernetes NFS CSI Vulnerability Enables Unauthorized Directory Deletion and Changes

Mar 18, 2026 9:10 AM

Tags: container, cve, cvss, cyber, flaw, kubernetes, network, unauthorized, vulnerability

A newly disclosed security flaw in the Kubernetes Container Storage Interface (CSI) Driver for Network File System (NFS) exposes storage servers to unauthorized directory modification and deletion. Tracked as CVE-2026-3864 with a medium-severity CVSS v3.1 score of 6.5, this vulnerability was discovered by SentinelOne researcher Shaul Ben Hai. The flaw impacts all versions of the…
Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS

Mar 18, 2026 9:10 AM

Tags: api, apple, cve, exploit, flaw, macOS, vulnerability

Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS.The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit’s Navigation API that could be exploited to bypass the same-origin policy when processing maliciously crafted…
Researchers Disclose ‘RegPwn,’ a Windows Registry Weakness Allowing SYSTEM Access

Mar 18, 2026 8:09 AM

Tags: access, cve, cyber, exploit, flaw, microsoft, vulnerability, windows

Researchers at MDSec have disclosed a newly patched Elevation of Privilege vulnerability in Microsoft Windows, known as >>RegPwn<<. Tracked as CVE-2026-24291, this flaw allows a low-privileged user to gain full SYSTEM access by exploiting how Windows handles registry configurations for its built-in Accessibility features."‹ Windows Accessibility features, such as the On-Screen Keyboard and Narrator, run…
FortiClient Hit by Severe SQL Injection Vulnerability Enabling Database Intrusion

Mar 18, 2026 8:09 AM

Tags: authentication, control, cve, cvss, cyber, cybersecurity, flaw, fortinet, injection, sql, vulnerability

Cybersecurity researchers have a detailed a critical security flaw in Fortinet’s FortiClient Enterprise Management Server (EMS). Tracked as CVE-2026-21643, this severe pre-authentication SQL injection vulnerability carries a near-maximum CVSS severity score of 9.1. It allows unauthenticated attackers to execute arbitrary SQL commands and gain total control over the underlying database. The flaw specifically targets multi-tenant…
Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE via Port 23

Mar 18, 2026 7:10 AM

Tags: cve, cvss, cybersecurity, exploit, flaw, rce, remote-code-execution, vulnerability

Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges.The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Apple pushes first Background Security Improvements update to fix WebKit flaw

Mar 18, 2026 5:10 AM

Tags: apple, cve, flaw, iphone, update

Apple has released its first Background Security Improvements update to fix a WebKit flaw tracked as CVE-2026-20643 on iPhones, iPads, and Macs without requiring a full operating system upgrade. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apple-pushes-first-background-security-improvements-update-to-fix-webkit-flaw/
Cheap and Dangerous: IP KVMs Carry Flaws

Mar 17, 2026 9:10 PM

Tags: access, control, firmware, flaw, Internet, tool

Internet-Connected Remote Access Tools Operate at UEFI Level. A flood of lost-cost devices for remote IP control of servers or human-machine interfaces has roused a concomitant wave of security warnings about their security defects. Firmware security company Eclypsium probed devices made by four KVM vendors, discovering nine vulnerabilities. First seen on govinfosecurity.com Jump to article:…
AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

Mar 17, 2026 7:10 PM

Tags: ai, cybersecurity, data, dns, exploit, flaw, intelligence, rce, remote-code-execution

Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries.In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter’s sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells First seen…
RondoDox botnet expands arsenal targeting 174 flaws, and hits 15,000 daily exploit attempts

Mar 17, 2026 5:10 PM

Tags: attack, botnet, exploit, flaw, vulnerability

RondoDox botnet targets 174 flaws, reaching 15,000 daily exploit attempts in a more focused and strategic campaign. RondoDox botnet is ramping up attacks, targeting 174 vulnerabilities with up to 15,000 daily exploitation attempts in a more focused and strategic campaign, Bitsight reported. >>We gathered all these exploit attempts (identifiable by indicators like the User-Agent and…
Angular XSS Vulnerability Threatens Thousands of Web Applications

Mar 17, 2026 12:11 PM

Tags: cve, cyber, exploit, flaw, malicious, threat, vulnerability, xss

A high-severity Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-32635, has been discovered in Angular, one of the world’s most widely used web application frameworks. This flaw resides in the Angular runtime and compiler and affects internationalisation (i18n) attribute bindings. If exploited, it allows threat actors to bypass built-in sanitisation mechanisms and cleanly inject malicious scripts…
CISA Issues Alert on Wing FTP Server Vulnerability Used in Attacks

Mar 17, 2026 11:10 AM

Tags: attack, cisa, cyber, cybercrime, cybersecurity, exploit, flaw, infrastructure, kev, network, vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent security alert regarding a critical vulnerability in the Wing FTP Server. On March 16, 2026, the agency officially added this security flaw to its Known Exploited Vulnerabilities (KEV) catalog. This addition serves as a clear warning to network defenders that cybercriminals are actively exploiting…
WebFiling Flaw at UK Companies House Exposed Director Data for Months

Mar 17, 2026 10:09 AM

Tags: cyber, data, data-breach, flaw, service, update, vulnerability

The UK Companies House recently disclosed a significant security vulnerability in its WebFiling service that exposed sensitive director information for several months. Chief Executive Andy King confirmed that the flaw was initially introduced during a system update in October 2025. This vulnerability allowed authenticated users to potentially view and alter the private details of other…
CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths

Mar 17, 2026 8:10 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, leak, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions First seen on thehackernews.com…
CISA Alerts Users to Exploited Chrome 0-Day Flaws

Mar 17, 2026 7:10 AM

Tags: browser, chrome, cisa, cyber, cybersecurity, exploit, flaw, google, infrastructure, kev, malicious, vulnerability, zero-day

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding two highly critical zero-day vulnerabilities. These flaws, which primarily affect Google Chrome and its underlying technologies, are currently being exploited in the wild by malicious actors. As a result, CISA has added both security issues to its Known Exploited Vulnerabilities (KEV) catalog,…
Researchers Find Data Leak Risk in AWS Bedrock AI Code Interpreter

Mar 17, 2026 1:11 AM

Tags: ai, cloud, data, dns, flaw, leak, risk, tool

AWS Bedrock AI tool flaw allows data leaks via DNS queries in AgentCore Code Interpreter sandbox, exposing sensitive cloud data, researchers warn. First seen on hackread.com Jump to article: hackread.com/data-leak-risk-in-aws-bedrock-ai-code-interpreter/