Tag: vulnerability
-
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals.The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31.GeoNetwork originated at the United Nations Food and…
-
Critical SonicWall SMA 1000 Vulnerabilities Actively Exploited in the Wild
SonicWall has issued an urgent security advisory regarding two vulnerabilities affecting its SMA 1000 Series secure access appliances. The company warns that there have been cases indicating active exploitation in the wild. The vulnerabilities are tracked as CVE-2026-83548 and CVE-2026-83549 and impact SonicWall SMA 1000 models 6210, 7210, and 8200v that are running vulnerable platform…
-
Critical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged User
Hewlett Packard Enterprise (HPE) has released security updates addressing 52 vulnerabilities in HPE Networking Fabric Composer, including two critical flaws that could allow unauthenticated remote attackers to gain administrative control or execute commands as a privileged operating-system user. These issues affect Fabric Composer versions 7.3.3 and earlier. HPE Fabric Composer Flaw The most severe vulnerability,…
-
Google Patches 26 Chrome Vulnerabilities, Including Critical WebGL and Shared Tab Groups Flaws
Google has released a new update for the Chrome Stable Channel on desktop platforms, addressing 26 security vulnerabilities. This includes two critical use-after-free flaws affecting WebGL and Shared Tab Groups. The update upgrades Chrome to version 152.0.7977.75 on Windows and macOS, while Linux users receive version 152.0.7977.76. Google stated that the update will be rolled…
-
Hackers Chain Two New SonicWall Zero-Day Vulnerabilities
SonicWall has urged customers to patch two new zero-day vulnerabilities being exploited in the wild First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hackers-chain-sonicwall-zeroday/
-
Hugging Face Transformers Flaw Writes Malicious Python Code to Disk Before User Consent
A newly disclosed vulnerability in the Hugging Face Transformers library could allow attacker-controlled Python files to be written to a victim’s system before the user approves the execution of remote code. This vulnerability is tracked as CVE-2026-80047 and affects Transformers versions 4.49.0 through 5.8.1. According to the CERT Coordination Center Vulnerability Note VU#456290, the flaw…
-
Hackers Target Langflow in CVE-2026-0768 Attacks
Hackers are exploiting a critical Langflow flaw that lets unauthenticated attackers remotely execute Python code on vulnerable systems. Hackers have started exploiting a critical vulnerability, tracked as CVE-2026-0768 (CVSS score of 9.8), in the AI-focused low-code platform Langflow. The flaw affects the code validator in Langflow’s custom component editor, it impacts all Langflow versions up…
-
Palo Alto: Security Debt Exposes Firms to AI-Powered Attacks
CEO Nikesh Arora Says Years of Deferred Upgrades Could Enable Major Breaches. Palo Alto Networks CEO Nikesh Arora warned that roughly $1 trillion in accumulated cybersecurity technical debt could leave enterprises vulnerable to AI-enabled threats as model proliferation expands attack surfaces faster than companies can modernize defenses. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/palo-alto-security-debt-exposes-firms-to-ai-powered-attacks-a-32719
-
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution.The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as First seen…
-
SonicWall warns of actively exploited SMA1000 zero-day flaws
SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/
-
SonicWall warns of actively exploited SMA1000 zero-day flaws
SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/
-
SonicWall warns of actively exploited SMA1000 zero-day flaws
SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/
-
SonicWall warns of actively exploited SMA1000 zero-day flaws
SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/
-
National Life Group CISO expects more vulnerabilities in six months than in thirty years
In this Help Net Security interview, Becky Palmer is VP and CISO at National Life Group, answers five questions about defending against AI-driven attacks. The discussion … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/02/becky-palmer-national-life-group-ai-driven-cyber-threats/
-
OWASP Launches OASIS to Use AI and AppSec Experts to Fix Open-Source Vulnerabilities
OWASP has launched the Open Automated Security Initiative for Software (OASIS), a new community project aimed at accelerating the remediation of vulnerabilities in open-source software through AI-generated patches and human application-security validation. Announced on August 26, 2026, OWASP OASIS seeks to address a longstanding security gap: organizations and researchers can identify vulnerabilities faster than maintainers…
-
Bright Security Expands its AI SDLC security Platform Launches an AI PT Module
San Rafael, United States, September 1st, 2026, CyberNewswire Bright Security Expands AI SDLC Security Platform, Launches AI PT: AI-Powered Penetration Testing That Cuts Weeks Down to Hours As AI compresses the gap between vulnerability disclosure and exploitation to nearly zero, the new AI Pentesting Module gives security teams continuous, AI-driven penetration testing built on Bright’s…
-
Suspected Chinese actor targets Philippine nuclear and naval entities using known vulnerabilities
First seen on scworld.com Jump to article: www.scworld.com/brief/suspected-chinese-actor-targets-philippine-nuclear-and-naval-entities-using-known-vulnerabilities
-
AI Helps Drive Number of Linux Kernel CVEs to Near 2,000 Per Release
The number of CVEs per Linux kernel release, which for years came in around 500, now is closing in on 2,000 due in large part to AI-armed vulnerability hunters, and that will only get higher, security pros say. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/ai-helps-drive-number-of-linux-kernel-cves-to-near-2000-per-release/
-
Attacks Targeting Langflow AI Agent-Building Tool Surge
Tags: access, ai, attack, credentials, exploit, framework, ibm, intelligence, open-source, software, tool, vulnerabilityTool’s Access to Compute Resources, Keys and Credentials Make It a Repeat Target. Open-source framework Langflow, designed to build artificial intelligence agents and workflows, is under fire again, with attackers now wielding exploit code for a vulnerability first detailed in January. Outdated versions of the IBM-maintained software with known vulnerabilities appear to abound. First seen…
-
ServiceNow Patches 3 Critical Flaws in Its AI Platform
Unauthenticated Attackers Could Execute Code, Alter Data, Gain Privileges. ServiceNow patched three critical vulnerabilities in its AI platform that could let unauthenticated attackers execute code, alter data or gain higher privileges. A fourth, high-severity flaw could allow code to escape a restricted environment and potentially expand an attacker’s access. First seen on govinfosecurity.com Jump to…
-
Critical Langflow flaw exploited to steal OpenAI and AWS keys
Tags: ai, credentials, exploit, flaw, framework, open-source, openai, remote-code-execution, threat, vulnerabilityThreat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/
-
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr.The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory.”JFrog Artifactory contains an authentication weakness that, under default First seen on thehackernews.com Jump…
-
CISA review makes the case for eliminating vulnerability classes
For years, the security industry has treated vulnerabilities as an endless queue of individual fixes. A recent CISA review argues that this is precisely why attackers keep … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/cisa-on-eliminating-recurring-security-weaknesses/
-
CISA review makes the case for eliminating vulnerability classes
For years, the security industry has treated vulnerabilities as an endless queue of individual fixes. A recent CISA review argues that this is precisely why attackers keep … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/cisa-on-eliminating-recurring-security-weaknesses/
-
CISA review makes the case for eliminating vulnerability classes
For years, the security industry has treated vulnerabilities as an endless queue of individual fixes. A recent CISA review argues that this is precisely why attackers keep … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/cisa-on-eliminating-recurring-security-weaknesses/
-
Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague
Chaotic Eclipse released PrettyPrague, a PoC exploit for a GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting GenDigital Avast Antivirus. The researcher named the exploit PrettyPrague, it triggers a privilege escalation flaw. The researcher claims to have found…
-
Hackers Exploit Critical Langflow and Ruby on Rails Flaws in Active RCE Attacks
Tags: ai, attack, cloud, control, credentials, cve, cyber, exploit, flaw, hacker, rce, remote-code-execution, theft, threat, vulnerabilityThreat actors are actively exploiting two newly disclosed remote code execution vulnerabilities affecting Langflow and Ruby on Rails. These campaigns focus on cloud credential theft, host reconnaissance, and the establishment of command-and-control (C2) functions. VulnCheck researchers have reported exploitation targeting CVE-2026-0768 in Langflow, a low-code platform for building AI-powered applications and automated workflows. This vulnerability…
-
Cyber Insurance Pentest Requirements: What Insurers Ask For
Key TakeawaysMost carriers now require an annual third party penetration test for cyber insurance policies above 1 million dollars in coverage, and internal vulnerability scans do not satisfy this requirement on their own.Policies at 5 million dollars and above typically… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/cyber-insurance-pentest-requirements-what-insurers-ask-for/
-
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/
-
Hackers Exploit Langflow RCE Flaw to Harvest OpenAI and AWS Credentials
Tags: ai, credentials, cve, cyber, exploit, flaw, hacker, openai, rce, remote-code-execution, threat, vulnerabilityThreat actors are actively exploiting a critical remote code execution vulnerability in Langflow, a low-code platform used for building AI-powered applications and automating workflows. This vulnerability, tracked as CVE-2026-0768, affects the code validator in Langflow’s custom component editor. According to Caitlin Condon, VP of Security Research at VulnCheck, the flaw allows unauthenticated remote code execution…