Tag: vulnerability
-
Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution
Vercel has released an out-of-band security update for Next.js that fixes two critical remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) bug. One of the critical flaws, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), sits in the Image Optimization API and is triggered through SVG processing. Next.js SVG vulnerability According to security disclosures published by Vercel, the update…
-
Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix has released security updates for XenServer 8.4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious privileged guest VM user compromise or crash the underlying host. Cloud Software Group rated the bulletin High severity. Citrix XenServer vulnerabilities According to the advisory published by Citrix on October 13, 2026…
-
Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise
Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw…
-
Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Tags: ai, cve, exploit, flaw, intelligence, open-source, rce, remote-code-execution, threat, vulnerabilityThreat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case…
-
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.In a report published earlier First…
-
SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands
SonicWall has disclosed two vulnerabilities in its on-premises Network Security Manager (NSM) that could let authenticated attackers escalate privileges, intercept other users’ communications and run operating system commands. The company published the advisory, SNWLID-2026-0018, on October 14, 2026. The highest CVSS v3 score is 8.8 (High). SonicWall NSM vulnerabilities According to advisory SNWLID-2026-0018 published by…
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.”A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables…
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.”A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables…
-
Cyberangriffe auf französische Supermärkte zeigen Schwachstellen in der OT-Sicherheit
Cyberangriffe auf französische Supermärkte zeigen kritische OT-Sicherheitslücken. Warum veraltete Kühlanlagen gefährdet sind und Virtual Patching hilft. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cyberangriffe-auf-franzoesische-supermaerkte-zeigen-schwachstellen-in-der-ot-sicherheit/a46760/
-
Mehrere Python-Versionen betroffen – BSI warnt vor Schwachstellen in CPython
First seen on security-insider.de Jump to article: www.security-insider.de/bsi-cpython-schwachstellen-dos-tarfile-extractall-a-d392a47c5bf0337565e1b8b0ef6ed36a/
-
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a…
-
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
Tags: attack, authentication, cve, ivanti, rce, remote-code-execution, threat, update, vulnerability, zero-dayCVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching
-
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a…
-
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a…
-
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance’s operating system, Cisco said in an advisory on Wednesday.The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance…
-
Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities
In its October Patch Tuesday, the tech giant addressed more defects in one month than any annual total on record. Nearly 4 in 5 vulnerabilities affect Windows. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-patch-tuesday-october-2026/
-
Microsoft Patch Tuesday Fixes 1,413 Flaws: Windows Zero-Day Already Under Attack
Microsoft’s October 2026 Patch Tuesday fixes 1,413 vulnerabilities, including an exploited Windows zero-day and critical Outlook security flaws. The post Microsoft Patch Tuesday Fixes 1,413 Flaws: Windows Zero-Day Already Under Attack appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-october-2026-patch-tuesday/
-
The Blind Spots of Agentic Pentesting and How to Close Them
AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-blind-spots-of-agentic-pentesting-and-how-to-close-them/
-
CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records
The sixth exploited Ivanti bug this year drew attention from the feds and researchers, while a severe Microsoft vulnerability was one of more than 1,400 listed for Patch Tuesday. First seen on therecord.media Jump to article: therecord.media/new-ivanti-microsoft-bugs-exploitation
-
Google Pays $250,000 for AI-Assisted Chrome Exploit Enabling Windows Code Execution
Google has awarded XBOW $250,000 for creating an AI-assisted exploit chain that enabled code execution outside the Chrome browser’s renderer sandbox on Windows. This reward marks the first full-chain payout for Chrome under Google’s vulnerability reward program, introduced in April 2026. According to XBOW, all three vulnerabilities involved have since been fixed. Google Pays $250,000…
-
Patchday Oktober 2026: Microsoft und Adobe sprengen alle Rekorde
Microsoft Patchday Oktober 2026: 1.415 CVEs, 174 Adobe-Schwachstellen und eine aktive Zero-Day-Lücke. Die wichtigsten Risiken und Updates. Dustin Childs, Head of Threat Awareness, analysiert die veröffentlichten Security Updates First seen on infopoint-security.de Jump to article: www.infopoint-security.de/patchday-oktober-2026-microsoft-und-adobe-sprengen-alle-rekorde/a46749/
-
Patchday Oktober 2026: Microsoft und Adobe sprengen alle Rekorde
Microsoft Patchday Oktober 2026: 1.415 CVEs, 174 Adobe-Schwachstellen und eine aktive Zero-Day-Lücke. Die wichtigsten Risiken und Updates. Dustin Childs, Head of Threat Awareness, analysiert die veröffentlichten Security Updates First seen on infopoint-security.de Jump to article: www.infopoint-security.de/patchday-oktober-2026-microsoft-und-adobe-sprengen-alle-rekorde/a46749/
-
Patchday Oktober 2026: Microsoft und Adobe sprengen alle Rekorde
Microsoft Patchday Oktober 2026: 1.415 CVEs, 174 Adobe-Schwachstellen und eine aktive Zero-Day-Lücke. Die wichtigsten Risiken und Updates. Dustin Childs, Head of Threat Awareness, analysiert die veröffentlichten Security Updates First seen on infopoint-security.de Jump to article: www.infopoint-security.de/patchday-oktober-2026-microsoft-und-adobe-sprengen-alle-rekorde/a46749/
-
Ivanti Connect Secure CVE-2026-104935 Flaw Enables Unauthenticated Remote Code Execution
Tags: authentication, cve, cyber, exploit, flaw, ivanti, remote-code-execution, software, update, vulnerabilityIvanti released security updates for Ivanti Connect Secure (ICS) to address CVE-2026-104935, a high-severity authentication-bypass vulnerability. This vulnerability allows remote, unauthenticated attackers to execute arbitrary commands. The company disclosed the issue on October 13, 2026. It confirmed that exploitation had affected a limited number of customers at the time of disclosure. Fixed software versions are…
-
Zoom Certificate Validation Vulnerability Allows Attackers to Access Sensitive Information
Zoom has disclosed a high-severity vulnerability in the My Notes feature that affects multiple Zoom Workplace clients. This issue, tracked as CVE-2026-108185, could allow an unauthenticated attacker with network access to disclose sensitive information. On October 13, 2026, Zoom published security bulletin ZSB-26022, which identifies the vulnerable releases across Windows, macOS, Linux, Android, and iOS,…
-
Erneuter Rekord-Patchday mit 1.415 Microsoft-CVEs und 174 AdobeDays
Der Patchday im Oktober 2026 bricht erneut alle Rekorde: Microsoft liefert erstmals Patches für eine vierstellige Zahl an Schwachstellen aus, während Adobe 174 Sicherheitslücken in elf Bulletins schließt. Microsoft Patches für Oktober 2026 Microsoft veröffentlicht im Oktober ein Rekordvolumen: 1.415 neue CVEs erstmals eine vierstellige Zahl und damit mehr als in jedem… First seen on…
-
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation.These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to…
-
Check Point Reports LiteLLM Flaws Enabling Admin Takeover and API Key Theft
Check Point Research found two LiteLLM vulnerabilities that could let low-privilege users execute code, access sensitive files, hijack admin accounts, and steal AI provider API keys. First seen on hackread.com Jump to article: hackread.com/check-point-litellm-flaws-admin-takeover-api-key-theft/
-
Billion-Dollar Companies Twice as Likely to Leave Critical Vulnerabilities Unpatched
New Chainguard research reveals larger companies struggle to patch vulnerabilities due to business priorities and operational disruption First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/companies-leave-critical/