Tag: vulnerability
-
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker “to direct the appliance to issue requests on…
-
Dringendes Update: Citrix warnt vor kritischer Lücke in Netscaler
Die Schwachstelle erlaubt eine Remotecodeausführung. Netscaler ADP und Netscaler Gateway sind auch anfällig für Denial-of-Service. First seen on golem.de Jump to article: www.golem.de/news/dringendes-update-citrix-warnt-vor-kritischer-luecke-in-netscaler-2610-213995.html
-
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Security researchers have revealed a critical vulnerability in Discourse, tracked as CVE-2026-55420. This flaw could let a low-privileged user read and write files on the underlying server by exploiting the platform’s ImageMagick-based upload pipeline. The issue was fixed for hosted customers in June 2026 and was publicly disclosed on June 30, 2026. The vulnerability affects…
-
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The First seen on…
-
Update behebt Schwachstellen – Rclone schließt Lücken in S3 und WebDAV
First seen on security-insider.de Jump to article: www.security-insider.de/rclone-schliesst-luecken-in-s3-und-webdav-a-4a1c00d645a61a8bef9db8708ab28b7f/
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/
-
AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges
Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2, named AnyPwn. This vulnerability allows remote command execution before the user approves desktop control. Because the AnyDesk service typically runs with root privileges, successful exploitation lets attackers gain root access to the system. We identified the issue using V12, and AnyDesk…
-
AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges
Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2, named AnyPwn. This vulnerability allows remote command execution before the user approves desktop control. Because the AnyDesk service typically runs with root privileges, successful exploitation lets attackers gain root access to the system. We identified the issue using V12, and AnyDesk…
-
AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges
Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2, named AnyPwn. This vulnerability allows remote command execution before the user approves desktop control. Because the AnyDesk service typically runs with root privileges, successful exploitation lets attackers gain root access to the system. We identified the issue using V12, and AnyDesk…
-
AI vulnerability patching has a grading problem
Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/12/ai-vulnerability-patching-grading-problem/
-
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 3
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At…
-
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The five vulnerabilities have been added to a broader list of flaws linked to cyber…
-
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
-
Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning
Anthropic launches free OSS Scanner, using AI to find open-source vulnerabilities and help maintainers fix bugs before attackers exploit them. Anthropic is launching OSS Scanner, a vulnerability scanner for open-source code that costs nothing for projects to join. It grew directly out of lessons learned running Claude against real-world targets during Project Glasswing. The backdrop…
-
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI).”It’s an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing,” Anthropic said. “Projects that join will receive thorough, periodic security scans by our strongest models at no cost.” First…
-
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners.Details of the flaws are below – CVE-2026-105133 (CVSS v4 score: 5.5) – An improper authentication vulnerability in the checkSysPwd() function in the “com/ahsay/obs/api/ApiStructsAction.java” First seen on…
-
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
-
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
Tags: access, china, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, threat, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.The vulnerabilities in question are listed below – CVE-2015-3306 (CVSS score: 10.0) – An improper access control vulnerability in ProFTPD that could allow…
-
High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring
Hundreds of internet-exposed graphics processing unit (GPU) servers were open to a high-severity flaw in NVIDIA’s DCGM Exporter (CVE-2026-47483) that lets unauthenticated … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/nvidia-dcgm-exporter-vulnerability-cve-2026-47483/
-
React Server Components Vulnerability Lets Attackers Freeze Next.js Servers With a Single Request
A security vulnerability has been identified in React Server Components deployments using specific vulnerable releases of React 19. An attacker can exploit this flaw to create a denial-of-service condition through specially crafted HTTP POST requests, as detailed in CVE-2026-23870. React Server Components Vulnerability Tracked as CVE-2026-23870 and GHSA-rv78-f8rc-xrxh, this high-severity vulnerability affects React Server Components…
-
Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners
Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS, the management console for Ahsay’s cloud backup software, to take over servers and quietly run cryptocurrency miners, according to researchers at Huntress. AhsayCBS (Cloud Backup Server) is mainly used by managed service providers (MSPs) and system integrators to create users and manage backup policies for their…
-
CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability
Citrix patched CVE-2026-107406, a critical NetScaler ADC and Gateway flaw that could allow remote code execution or denial-of-service attacks. Citrix has released security updates to fix CVE-2026-107406 (CVSS score of 9.5), a critical flaw affecting NetScaler ADC and NetScaler Gateway that could allow remote code execution or denial-of-service (DoS) under certain conditions. The vulnerability is…
-
Anthropic offers free AI security scans to open-source maintainers
Anthropic’s OSS Scanner is a new, free service that uses the company’s strongest AI models to find security vulnerabilities in open-source software. Maintainers who opt in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/anthropic-oss-scanner-ai-security-scans/
-
Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments
Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.”CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions,” Citrix said.The vulnerability First seen on thehackernews.com Jump…
-
Splunk Patches 22 Vulnerabilities, Including Critical Flaw With CVSS 9.8
Splunk has patched a large set of Splunk vulnerabilities in Splunk Enterprise, the most severe of which carries a CVSSv3.1 score of 9.8. The fixes are described in two advisories, SVD-2026-1001 and SVD-2026-1002, both published on October 7, 2026, and together they cover 22 CVE identifiers, CVE-2026-76264 through CVE-2026-76285. First seen on thecyberexpress.com Jump to…
-
Citrix warns admins to patch new NetScaler RCE flaw immediately
Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/
-
Critical Citrix NetScaler Vulnerability Allows Remote Code Execution Attacks CVSS 9.5
Citrix has disclosed a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that could enable remote code execution or denial of service under specific configuration conditions. This vulnerability, tracked as CVE-2026-107406, carries a CVSS v4.0 base score of 9.5, prompting an urgent upgrade advisory for affected customer-managed deployments. The security bulletin, CTX697191, identifies…