Tag: vulnerability
-
Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection
Security researchers have revealed a vulnerability chain known as “SalesBleed,” associated with Salesforce’s Agentforce. This vulnerability could allow attackers to extract sensitive CRM data through an indirect prompt injection embedded in a public Web-to-Lead form. The attack does not require a Salesforce login or a click from the victim and could leak data via DNS…
-
Sudo Vulnerability Lets Attackers Bypass Time-Based Authorization Controls
A recently disclosed high-severity vulnerability in Sudo could allow local, unprivileged Linux users to manipulate time-based authorization restrictions in sudoers policies. Tracked as CVE-2026-96512, this vulnerability arises from how Sudo handles the attacker-controlled TZ environment variable when evaluating NOTBEFORE and NOTAFTER constraints. Red Hat is monitoring this flaw under Bug 2539327, which is currently categorized…
-
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
Tags: adobe, api, attack, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-5430 (CVS score: 9.8) – A path traversal vulnerability in WSO2 API Control Plane, First…
-
Cloudflare Containers Flaw Could Expose Data From Other Customers’ Workloads
Cloudflare has addressed a cross-tenant data exposure vulnerability in its Containers platform that could have allowed one customer’s workload to recover residual data belonging to other customers on the same infrastructure. This flaw also affected Cloudflare Sandboxes and the Browser Run service within Browser Rendering, both of which utilize the same underlying disk implementation. Cloudflare…
-
Schreibzugriffe und Denial of Service – Synology schließt acht Schwachstellen im DiskStation Manager
First seen on security-insider.de Jump to article: www.security-insider.de/synology-dsm-kritische-sicherheitsluecken-dateizugriff-dos-a-aba1cf19bc13ef5ac19f1a1dd3760b26/
-
Wiz uses AI to find vulnerabilities in critical infrastructure
The Google subsidiary, which helped a railroad and two hospitals, invited others to apply for its free scanning service. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/wiz-ai-critical-infrastructure-scan-for-good/831255/
-
Trust and the enticing consultancy offer
In this week’s newsletter Martin muses over a very suspicious elicitation over social media and the true value of trust within the cyber ecosystem. Hubris might be the real vulnerability that the cyber industry must worry about. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/trust-and-the-enticing-consultancy-offer/
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…
-
Wiz uses AI to find vulnerabilities in railroads, hospitals and other critical infrastructure
The Google subsidiary invited all infrastructure operators to apply for its free scanning service. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/wiz-ai-critical-infrastructure-scan-for-good/831255/
-
Wiz uses AI to find vulnerabilities in railroads, hospitals and other critical infrastructure
The Google subsidiary invited all infrastructure operators to apply for its free scanning service. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/wiz-ai-critical-infrastructure-scan-for-good/831255/
-
Wiz uses AI to find vulnerabilities in railroads, hospitals and other critical infrastructure
The Google subsidiary invited all infrastructure operators to apply for its free scanning service. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/wiz-ai-critical-infrastructure-scan-for-good/831255/
-
FedRAMP VDR & VER: Daily Scans Are Only the Beginning
FedRAMP’s new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a broader shift toward continuous, automated compliance validation. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fedramp-vdr-and-ver-daily-scans-are-only-the-beginning/
-
FedRAMP VDR & VER: Daily Scans Are Only the Beginning
FedRAMP’s new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a broader shift toward continuous, automated compliance validation. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fedramp-vdr-and-ver-daily-scans-are-only-the-beginning/
-
Hackers now exploit critical Roundcube flaw in code injection attacks
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/
-
CISA Charts New Quality Era for Global CVE Program
CISA has set out a new framework to improve CVE data quality as vulnerability volumes rise First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-quality-era-global-cve-program/
-
Ransomware gangs now exploiting critical TeamCity flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/
-
Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks
Tags: attack, authentication, cve, cvss, cyber, exploit, flaw, hacker, rce, remote-code-execution, update, vpn, vulnerability, zero-dayCheck Point has warned customers about the active exploitation of two critical vulnerabilities in its VPN gateway and Security Management products: CVE-2026-85102 and the newly disclosed CVE-2026-93616. Both vulnerabilities have a CVSS score of 9.8 and allow for pre-authentication attacks, making immediate patching and reducing exposure essential. Check Point Flaws CVE-2026-85102 is an improper certificate-validation…
-
OpenAI hacked Australian Medicare govt site, probed data providers
OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/openai-hacked-australian-medicare-govt-site-probed-data-providers/
-
Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication
A highly severe vulnerability in Roundcube Webmail is being actively exploited, posing risks to unpatched email servers through unauthenticated SQL injection attacks. This vulnerability, tracked as CVE-2026-48842, affects Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. On September 21, the Canadian Center for Cyber Security updated advisory AV26-503, warning that reports from the…
-
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).”An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file First seen on…
-
cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data
cPanel has released patches for CVE-2026-68490, a vulnerability related to incorrect permissions in its CalDAV/CardDAV implementation. This flaw could allow a local user on a shared server to access calendar events and contacts from other hosting accounts. The issue affects cPanel/WHM version 120 and later, highlighting the risks associated with tenant isolation in shared-hosting environments.…
-
Microsoft Upgrades SharePoint Flaw From Spoofing to 8.8 RCE
A SharePoint Server vulnerability tracked as CVE-2026-65660 turned out to be far more serious than Microsoft first indicated. The company originally described it as a spoofing issue with a CVSS score of 6.5. In reality, it is an authenticated RCE flaw rated 8.8. That gap matters, because security teams that trusted the first label may…
-
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 has been released with fixes for 12 security vulnerabilities, including a significant flaw that could allow attackers to bypass security constraints protecting WebSocket endpoints. This release also addresses several denial-of-service (DoS) issues affecting WebSocket, AJP, HTTP/2, and HTTP/1.0 request handling. Dated September 15, 2026, the release addresses flaws that were publicly disclosed…
-
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/
-
Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The security firm bug is already being exploited. Attackers can abuse the flaw without logging in to…
-
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
The ShinyHunters extortion gang claims it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data on employees and job applicants. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/
-
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request.The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication…
-
Check Point warns of Management Server zero-day exploited in attacks
Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/