Vulnerability & Exploit Coverage
918 articles · sorted newest first
News results
PTC Patches New Critical Windchill and FlexPLM RCE
CVE-2026-126325 is a deserialization flaw rated CVSS v4 9.2 in Windchill and FlexPLM. PTC-hosted systems are already fixed; self-hosted ones need the patch.
N-central 4EverAble2Shell Exploited Hours After PoC
Attackers are exploiting a new N-central zero-day, 4EverAble2Shell, within hours of a public PoC, including on fully patched servers. Here is what to do now.
Maersk Confirms Breach as WhiteArmor Demands $5M
Maersk confirms a threat actor breached a system from an acquired company. WhiteArmor claims 100GB stolen and demands $5 million. Maersk reports no operational impact.
Apache HTTP Server 2.4.71 Fixes Critical mod_http2 RCE
CVE-2026-119618 is a race condition in Apache's mod_http2 that can allow unauthenticated code execution. Upgrade to 2.4.71 or turn off HTTP/2 until you can.
CISA Adds Cisco BroadWorks XXE Flaw to KEV, Patch Now
CISA says CVE-2026-20320 in Cisco BroadWorks is exploited in attacks. Cisco patched it in August; federal agencies have until November 24. Here is the order of work.
SSHole OpenSSH Bypass Now Exploited, Patch to 10.6p2
Attackers are exploiting SSHole, CVE-2026-123158, an OpenSSH password bypass hitting musl-based Linux like Alpine and OpenWrt. Update to 10.6p2 and restart sshd.
Lone attacker's AI agents pulled Taipei dispatch records
Acronis researchers say one Taiwan-based attacker ran AI agents against hundreds of targets in 11 countries, reaching Taipei emergency dispatch records.
US Agencies Warn of Attacks on Refrigeration Controllers
CISA, FBI, HHS, USDA and DOT say actors are hitting internet-exposed cold-chain controllers, forcing heating and defrost cycles. Here is what operators should do.
OpenEMR advisories cover portal, fax and FHIR flaws
Three OpenEMR advisories describe patient-record exposure through the portal, fax/SMS module and FHIR API. Patched releases are 8.3.0 and 8.4.0.
Kyverno 1.19.1 Namespace Clamp Bypass Reaches Cluster Admin
A critical Kyverno advisory says a namespace tenant can escape the apiCall clamp added in 1.19.1 and escalate to cluster admin. Version 1.19.2 fixes it.
OpenAM 16.1.4 fixes critical SSO account takeover flaws
OpenAM 16.1.3 and earlier have critical flaws allowing unauthenticated session theft and admin account creation. Version 16.1.4 is the fix.
Vikunja 2.7.1 fixes a null-filter crash in project views
A Low-severity Vikunja advisory describes how a project admin could save a malformed view filter that makes every read of that view fail. Version 2.7.1 fixes it.
Iris Ohyama Cloud Breach May Expose 7.7M Customers
Iris Ohyama says a third-party cloud service tied to its Iris Plaza store was accessed by an unauthorized party. Up to 7.7 million people may be affected.
Queens Public Library Confirms Ransomware Attack
Queens Public Library says ransomware has taken down on-site computers, Wi-Fi and digital services across its 66 branches. No gang has claimed the attack yet.
SonicOS SSL-VPN SAML Bypass Exploited, Patch Now
SonicWall fixed seven SonicOS flaws, including CVE-2026-19868, an SSL-VPN SAML bypass exploited in attacks and on CISA's KEV list. No workaround exists.
WordPress Fix Can Expose Sites During Its Own Update
The update that installs the CVE-2026-119977 fix still runs old code, so some sites stay exposed during the install. Block wp-content/upgrade first.
D-Link DGS-3130 Switches Have Unpatched DDP Flaws
D-Link disclosed unpatched flaws in DGS-3130 switches involving its Discovery Protocol. No CVE IDs yet. Disable DDP and isolate management access.
Windows Paint RCE Fix Ships Via Store, Not Windows Update
Microsoft fixed CVE-2026-83844 in Paint build 11.2609.401.0, but only the Microsoft Store delivers it. Check every user's copy, and ignore the older fixed-build number.
GhostMap Android Flaw Can Boot-Loop Phones, No Patch
Bitdefender says a permissionless Android app can trap a phone in a boot loop. Google closed the report as not reproducible. No fix is confirmed.
SonicWall Won't Patch Two Flaws in End-of-Life GMS
SonicWall says GMS 9.5.2 and earlier has an unauthenticated file read and a SQL injection flaw, and that no fix is coming. Owners are told to move to NSM.
CISA Adds Old Apple PAC Bypass to KEV After APT29 Reports
CVE-2024-27834, a medium-severity Apple pointer authentication bypass patched in May 2024, is now in CISA's KEV catalog. Federal deadline is November 18.
Zyxel GS1900 Zero-Day CVE-2026-107441 Patched After Attacks
Zyxel fixed CVE-2026-107441 in ten GS1900 switch models after about 1,000 devices were hit. The June patch did not cover it. Update the firmware.
Rails Active Storage ImageMagick Flaw Allows File Writes
Rails fixed a critical Active Storage flaw in 8.1.4.1 and 8.0.5.2. Apps using ImageMagick on untrusted uploads let attackers write server files.
WordPress Core Upgrade Flaw Hits CISA KEV, Due Nov 6
CISA lists WordPress Core CVE-2026-119977, a race condition during full core upgrades, as exploited. Patches shipped late October; federal deadline is Nov 6.
No articles match the current filters.