Tag: vulnerability
-
SAP Patches Critical NetWeaver and S/4HANA Security Flaws Affecting Enterprise Systems
SAP’s Security Patch Day on October 13, 2026, addresses critical vulnerabilities found in enterprise applications, integration platforms, and developer libraries. The October bulletin details the release, which includes 16 new security notes, four GitHub security advisories, and two updates to previously published notes, covering a total of 22 CVEs. Four vulnerabilities are rated as Critical.…
-
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access next.With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point…
-
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access next.With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers
Researchers have identified 253 verified security vulnerabilities affecting 343 AI agent tools across 118 Model Context Protocol (MCP) servers. These vulnerabilities expose weaknesses in how software processes arguments generated by large language models (LLMs). The findings are based on an evaluation of 273 open-source MCP servers containing 3,405 tools, using a new fuzzing framework called…
-
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.The chain was tested on two TV models,…
-
Critical Ghostscript Vulnerability Lets Malicious PDFs Trigger Remote Code Execution
A critical vulnerability in Ghostscript could allow attackers to execute code on vulnerable servers by uploading a specially crafted PDF containing a malicious JPEG 2000 image. Tracked as CVE-2026-39919, the vulnerability is a heap-based buffer overflow rated 9.8 out of 10 under CVSS v3.1 and 9.3 under CVSS v4.0, reflecting a worst-case unauthenticated, network-reachable remote…
-
Amazon Fire TV Cube Security Flaws Allow Bootloader Unlocking and Permanent Root Access
A recently released exploit package lets the third-generation Amazon Fire TV Cube gain an unlocked bootloader and persistent root access on firmware version PS7717 or earlier. Developed by XDA developer Pro-me3us, the project targets devices codenamed “gazelle”. It combines temporary privilege escalation with a separate bootloader vulnerability to enable lasting system modifications. This release includes…
-
Amazon Fire TV Cube Rooted Using Four-Year-Old Arm Mali Vulnerability
Tags: vulnerabilityA four-year-old Arm Mali GPU vulnerability can be used to root the third-generation Amazon Fire TV Cube, but… First seen on hackread.com Jump to article: hackread.com/amazon-fire-tv-cube-rooted-arm-mali-vulnerability/
-
Amazon Fire TV Cube Rooted Using Four-Year-Old Arm Mali Vulnerability
Tags: vulnerabilityA four-year-old Arm Mali GPU vulnerability can be used to root the third-generation Amazon Fire TV Cube, but… First seen on hackread.com Jump to article: hackread.com/amazon-fire-tv-cube-rooted-arm-mali-vulnerability/
-
Amazon Fire TV Cube Rooted Using Four-Year-Old Arm Mali Vulnerability
Tags: vulnerabilityA four-year-old Arm Mali GPU vulnerability can be used to root the third-generation Amazon Fire TV Cube, but… First seen on hackread.com Jump to article: hackread.com/amazon-fire-tv-cube-rooted-arm-mali-vulnerability/
-
GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/
-
Critical Progress MarkLogic Server Vulnerabilities Could Enable Code Execution and Privilege Escalation
Progress has disclosed 31 vulnerabilities in MarkLogic Server that could lead to privilege escalation, server-side code execution, authentication bypass, credential exposure, and data compromise. In its security bulletin dated October 12, 2026, the company urges customers to install updates, warning that affected instances may operate normally without any prior signs of exploitation. The bulletin covers…
-
Warnung des BSI: Hacker nehmen Firewall von Sonicwall ins Visier
Die Schwachstelle ist besonders schwerwiegend, weil sie Zugriffe aus der Ferne erlaubt – ohne Authentifizierung. First seen on golem.de Jump to article: www.golem.de/news/warnung-des-bsi-hacker-nehmen-firewall-von-sonicwall-ins-visier-2610-214040.html
-
Critical GitLab Vulnerability Allows Unauthenticated Attackers to Execute Remote Code
GitLab has released emergency security updates to address a critical vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. This vulnerability, tracked as CVE-2026-97229, has been assigned the highest CVSS score of 10.0 and impacts both GitLab Community Edition and Enterprise Edition. On October 12, 2026, the company released versions 19.4.2,…
-
Flock can now issue CVEs for its own products. Should we trust it?
Flock joined the CVE Program as a CNA, giving the company authority to assign IDs to vulnerabilities in its own surveillance cameras and license plate readers. First seen on cyberscoop.com Jump to article: cyberscoop.com/flock-cve-numbering-authority-cna/
-
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/max-severity-ssrf-flaw-sonicwall-sma-devices-under-attack
-
XRP Ledger Patches Flaw That Could Have Created Unlimited XRP
The XRP Ledger (XRPL) has deployed an emergency patch for one of the most serious XRP vulnerabilities in its history, a flaw that could have allowed unlimited XRP to be created. By skipping the standard two-week validator vote, the fix has reignited debate over how decentralized the network really is, though developers and validators maintain…
-
GitLab fixes critical vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/gitlab-vulnerability-remote-code-execution/832736/
-
CISA calls on Citrix NetScaler customers to patch as new flaws disclosed
A newly discovered critical vulnerability is adding to the workload of customers mitigating other recent flaws. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-citrix-netscaler-customers-patch-new-flaws-disclosed/832741/
-
GitLab fixes serious vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/gitlab-vulnerability-remote-code-execution/832736/
-
SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure. Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked asCVE-2026-102255(CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login.…
-
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code. It is tracked as CVE-2026-85097 and has a CVSS score of 10.0, affecting versions up to 3.1.8.9. Administrators are advised to upgrade to version 3.1.8.10 or later. Patchstack disclosed…
-
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code. It is tracked as CVE-2026-85097 and has a CVSS score of 10.0, affecting versions up to 3.1.8.9. Administrators are advised to upgrade to version 3.1.8.10 or later. Patchstack disclosed…
-
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
-
Critical Google DevSite Flaw Allowed Attackers to Execute Remote Code Without Authentication
A critical security vulnerability in Google’s shared DevSite platform could have let unauthenticated attackers execute arbitrary code on Google-hosted services by forging Flask session cookies with malicious Python pickle payloads. Security researcher Simon Köck discovered the issue while analyzing the OAuth authorization workflow used by Google’s developer documentation properties. The vulnerability affected the shared infrastructure…
-
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Security researchers have revealed a critical vulnerability in Discourse, tracked as CVE-2026-55420. This flaw could let a low-privileged user read and write files on the underlying server by exploiting the platform’s ImageMagick-based upload pipeline. The issue was fixed for hosted customers in June 2026 and was publicly disclosed on June 30, 2026. The vulnerability affects…