Tag: vulnerability
-
Salesforce Marketing Cloud Vulnerability Exposes Email Data Risk
Salesforce Marketing Cloud (SFMC) recently patched a cluster of high”‘impact vulnerabilities that could have allowed attackers to read and enumerate marketing emails and subscriber data across tenants, including Fortune 500 organizations. Modern enterprises rely on centralised marketing clouds to deliver branded, trackable campaigns at massive scale. SFMC (formerly ExactTarget) is one of the dominant platforms, powering dynamic…
-
Palo Alto Networks PAN-OS flaw exploited for remote code execution
Palo Alto Networks warns of a critical PAN-OS flaw (CVE-2026-0300) that is under active attack, allowing unauthenticated remote code execution. Palo Alto Networks has warned that a critical PAN-OS vulnerability, tracked as CVE-2026-0300 (CVSS score of 9.3), is actively exploited in the wild. The flaw is a buffer overflow that allows unauthenticated remote code execution,…
-
Palo Alto Networks warns of firewall RCE zero-day exploited in attacks
Tags: attack, authentication, exploit, firewall, network, rce, remote-code-execution, vulnerability, zero-dayPalo Alto Networks warned customers today that a critical-severity unpatched vulnerability in the PAN-OS User-ID Authentication Portal is being exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-actively-exploited-firewall-zero-day/
-
Argo CD ServerSideDiff Flaw Allows Attackers to Extract Kubernetes Secrets
A critical vulnerability has been identified in Argo CD that could allow attackers with minimal privileges to extract highly sensitive Kubernetes Secrets directly from etcd clusters. Tracked as CVE-2026-42880 and rated 9.6, this severe security flaw exposes a missing authorisation and data-masking gap within the platform. According to the disclosure, this exposure primarily affects environments…
-
Zero-Auth Vulnerability Enables Cross-Tenant Access at DoD Contractor
A severe authorization vulnerability was recently discovered in Schemata, an AI-powered virtual training platform serving the United States Department of Defense. Security researcher Alex Schapiro, utilizing the open-source AI hacking agent Strix, identified a critical lack of API authorization. Backed by Andreessen Horowitz, Schemata holds active government contracts to provide immersive 3D simulations for various…
-
Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution
Tags: access, advisory, authentication, cve, cvss, exploit, flaw, Internet, network, remote-code-execution, software, vulnerabilityPalo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the wild.The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution. It carries a CVSS score of 9.3 if the User-ID Authentication Portal is configured to enable…
-
Critical Palo Alto Firewall Vulnerability Enables Attackers to Gain Root Privileges
Palo Alto Networks has issued an urgent security advisory concerning a critical vulnerability affecting its PAN-OS software. Tracked as CVE-2026-0300, this high-severity security flaw carries a CVSS 4.0 base score of 9.3 and is currently experiencing limited active exploitation in the wild. The vulnerability allows unauthenticated, remote attackers to execute arbitrary code with full root…
-
Aktive Ausnutzung – Schwachstellen in Samsung MagicINFO bedürfen Patches
Tags: vulnerabilityFirst seen on security-insider.de Jump to article: www.security-insider.de/samsung-magicinfo-9-server-cisa-aktive-sicherheitsluecke-patches-a-78a9619deb5eacfa8744171f993d89c1/
-
CISA mulls new three-day remediation deadline for critical flaws
Tags: api, ceo, cisa, exploit, flaw, government, kev, msp, penetration-testing, technology, update, vulnerability, vulnerability-managementTight window: A CISA spokesperson declined to comment on the Reuters report, but security experts were more forthcoming, with most believing the idea is simply an acknowledgement that modern vulnerability management is evolving.One source of anxiety was that a three-day timeline would leave little time for meaningful testing, normally a time-consuming and complex undertaking that…
-
CISA mulls new three-day remediation deadline for critical flaws
Tags: api, ceo, cisa, exploit, flaw, government, kev, msp, penetration-testing, technology, update, vulnerability, vulnerability-managementTight window: A CISA spokesperson declined to comment on the Reuters report, but security experts were more forthcoming, with most believing the idea is simply an acknowledgement that modern vulnerability management is evolving.One source of anxiety was that a three-day timeline would leave little time for meaningful testing, normally a time-consuming and complex undertaking that…
-
The EOL Blind Spot in Your CVE Feed: What SCA Tools Miss
Critical vulnerabilities can exist in open source software your scanners don’t check. HeroDevs reveals how EOL software creates blind spots in CVE feeds and SCA tools, and how you can receive a free end-of-life scan for your projects. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-eol-blind-spot-in-your-cve-feed-what-sca-tools-miss/
-
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
The Apache Software Foundation (ASF) has released security updates to address several security vulnerabilities in the HTTP Server, including a severe vulnerability that could potentially lead to remote code execution (RCE).The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a case of “double free and possible RCE” in the HTTP/2 protocol handling.…
-
GPT-5.4-Cyber & Mythos: Wie KI die Schwachstellenerkennung radikal beschleunigt
Der Wettbewerbsvorteil verschiebt sich: Nicht wer Schwachstellen zuerst entdeckt, gewinnt sondern wer ihre Behebung lückenlos nachweisen kann. Angriffe operieren in Maschinen-Geschwindigkeit. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/gpt-5-4-cyber-mythos-wie-ki-die-schwachstellenerkennung-radikal-beschleunigt/a44991/
-
Critical Android vulnerability CVE-2026-0073 fixed by Google
Google patched a critical Android flaw (CVE”‘2026″‘0073) that lets attackers run code remotely without user action. Google released a security update for Android to address a critical remote code execution flaw, tracked as CVE”‘2026″‘0073, in the System component. The bug allowed attackers to run code as the shell user without needing extra permissions, or any…
-
Unpatched flaws turn Ollama’s auto-updater into a persistent RCE vector, researchers say
Researchers at Striga have disclosed two vulnerabilities (CVE-2026-42248, CVE-2026-42249) in Ollama’s Windows auto-updater that, when chained together, may allow an … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/05/ollama-windows-vulnerabilities-cve-2026-42248-cve-2026-42249/
-
Google to pay up to $1.5 million for zero-click Pixel Titan M exploits
Google has revised its Android and Chrome Vulnerability Reward Programs (VRPs), which pay security researchers to report vulnerabilities in Android, Google hardware, and the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/05/google-vulnerability-reward-program-android-chrome-pixel/
-
Android Zero-Click RCE Vulnerability Enables Remote Shell Access
A patched Android RCE flaw allows nearby attackers to gain zero-click remote shell access. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/android-zero-click-rce-vulnerability-enables-remote-shell-access/
-
The EOL Blind Spot in Your CVE Feed: What SCA Tools Don’t Check.
Critical vulnerabilities can exist in open source software your scanners don’t check. HeroDevs reveals how EOL software creates blind spots in CVE feeds and SCA tools, and how you can receive a free end-of-life scan for your projects. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-eol-blind-spot-in-your-cve-feed-what-sca-tools-dont-check/
-
Critical Weaver E-cology RCE Exploit Raises Alarm for Enterprise Systems
Tags: automation, cve, cvss, cyber, exploit, flaw, office, rce, remote-code-execution, vulnerabilityA critical unauthenticated remote code execution vulnerability in Weaver (Fanwei) E-cology is being actively exploited in the wild, with real-world intrusion activity traced back to mid-March 2026, weeks before public awareness. Tracked as CVE-2026-22679 with a CVSS score of 9.8, this flaw exposes enterprise office automation systems to full OS-level compromise without requiring any authentication. Vulnerability Overview CVE-2026-22679…
-
MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks
Tags: attack, cve, exploit, flaw, injection, open-source, remote-code-execution, threat, vulnerabilityThreat actors are actively exploiting a critical security flaw impacting an open-source content management system (CMS) known as MetInfo, according to new findings from VulnCheck.The vulnerability in question is CVE-2026-29014 (CVSS score: 9.8), a code injection flaw that could result in arbitrary code execution.”MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code…
-
AI finds 20-year-old bugs in PostgreSQL and MariaDB
Tags: ai, breach, credentials, cve, exploit, flaw, github, injection, nist, rce, remote-code-execution, sql, vulnerabilityInadequate JSON parsing allowed RCE on the MariaDB server: In MariaDB, a buffer overflow bug, tracked as CVE-2026-32710, was found in the JSON_SCHEMA_VALID() function using Xint Code. The vulnerability allows an authenticated user to trigger a crash, which, under controlled conditions, could be escalated into remote code execution.Compared to the PostgreSQL flaws, exploitation here is…
-
Google now offers up to $1.5 million for some Android exploits
Google overhauls its Android and Chrome vulnerability rewards programs, offering bounties of up to $1.5 million for the most difficult exploits while scaling back payouts for flaws that artificial intelligence (AI) has made easier to find. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-now-offers-up-to-15-million-for-some-android-exploits/
-
WhatsApp Security Flaw Enables Malicious URL Execution Through Instagram Reels
WhatsApp has recently patched two notable security vulnerabilities that could have allowed attackers to execute malicious links and disguise dangerous files. The most alarming discovery involves a flaw in how WhatsApp processes Instagram Reels. This vulnerability allows remote threat actors to trigger arbitrary URLs on a victim’s device by exploiting unvalidated message elements. Meta’s latest…
-
Education Sector Hit by Espionage, Phishing, and Supply Chain Attacks
Educational institutions are now facing a coordinated mix of state espionage, spear”‘phishing, and supply chain intrusions, even as classic ransomware and vulnerability volumes show signs of easing. Every attributed campaign was linked to state actors, with no financially motivated groups observed. China-aligned clusters led by MISSION2074 dominate, with additional activity from Stone Panda, Hafnium, Lotus…
-
Weniger Microsoft-Schwachstellen, aber mehr kritische Sicherheitslücken
Die diesjährigen Zahlen des neuesten Microsoft Vulnerabilities Reports zeigen eine deutliche Verlagerung bei den ermittelten Sicherheitsrisiken: Einerseits hat sich die Gesamtzahl identifizierter Schwachstellen stabilisiert, aber andererseits haben die kritischen Anfälligkeiten stark zugenommen, wodurch Schweregrad und Auswirkungen der Sicherheitslücken rapide steigen [1]. Insgesamt gibt es 2025 ein verändertes Risikoprofil, das durch KI-beschleunigte Schwachstellenerkennung, eine wachsende Cloud-Akzeptanz……
-
Qualcomm Chipset Vulnerabilities Raise Alarm Over Remote Code Execution Risk
Tags: cyber, exploit, Internet, open-source, remote-code-execution, risk, software, threat, vulnerabilityQualcomm Technologies has released its May 2026 security bulletin, addressing a sweeping array of vulnerabilities across its proprietary and open-source software ecosystems. Threat actors could exploit these security gaps to compromise smartphones, automotive systems, and industrial Internet of Things devices without requiring user interaction. The semiconductor giant is strongly urging original equipment manufacturers to deploy…
-
Critical Android Zero-Click Vulnerability Enables Remote Shell Access
Google has released the Android Security Bulletin for May 2026, addressing a highly critical vulnerability that allows attackers to execute code remotely without any user interaction. Published on May 4, 2026, the latest security update focuses heavily on a severe flaw located within the Android System component. Threat actors can exploit this vulnerability to gain…
-
Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API
A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild.The vulnerability (CVE-2026-22679, CVSS score: 9.8) relates to a case of unauthenticated remote code execution affecting Weaver E-cology 10.0 versions prior to 20260312. The issue resides in the “/papi/esearch/data/devops/ First seen on…
-
Unsichtbare Gefahr im BootROM: Warum Ihr Smartphone einen Neustart vortäuschen könnte
Durch die neu entdeckte Qualcomm-Schwachstelle CVE-2026-25262 können Hacker den Secure Boot umgehen und Smartphone-Kameras unbemerkt aktivieren. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/smartphone-vortaeuschen
-
Can your coding style predict whether your code is vulnerable?
Developers leave fingerprints in the code they write. Naming choices, indentation patterns, preferred APIs, and the way someone structures a loop or handles a pointer all … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/05/research-code-stylometry-vulnerability-detection/