News archive Page 11
918 articles · sorted newest first · page 11 of 39
Looking for a specific story? Search and filter the full archive.
BIND 9 Patches 14 Flaws Including Unauthenticated DoH Crash
ISC patched 14 vulnerabilities in BIND 9, including a flaw that lets unauthenticated attackers crash resolvers via DNS-over-HTTPS. Update to 9.20.29 or 9.21.26.
CVE-2026-91843: Check Point Management Server RCE
A stack overflow in the Check Point Security Management Server login handler allows unauthenticated RCE as root. CVSS 9.8. Patch available via sk1000155.
WSO2 CVSS 10 JWT Bypass Exploited in the Wild
CVE-2026-5430 lets unauthenticated attackers forge JWTs and gain administrative access to WSO2 deployments. Active exploitation confirmed. Patch immediately.
Google Patches Pixel Modem Zero-Day Under Attack
Google's September 2026 Pixel update patches 110 vulnerabilities including CVE-2026-58704, a high-severity modem flaw already under active exploitation. CISA deadline is September 19.
Cisco ISE Zero-Day CVSS 10.0 Under Active Exploitation
CVE-2026-76460, a CVSS 10.0 auth bypass in Cisco ISE and ISE-PIC, is under active exploitation. Patches cover all supported releases; no workarounds exist.
CVE-2026-90895: MISP CLI Exposes Auth Creds, Bypasses ACLs
MISP through 2.5.45 has CLI access controls separate from the web app, exposing feed HTTP credentials and sync authkeys to unauthorized users.
Mattermost CVE-2026-14344: Board Permission Check Skipped
CVE-2026-14344 lets any authenticated Mattermost user create boards regardless of role assignments. Four active release branches affected; upgrade per the security advisory.
D-Link DWR Routers Hit by Three Critical Command Injections
Three critical command injection flaws in D-Link DWR-M920 and DWR-M921 firmware. Researcher H3rmesk1t disclosed all three; no D-Link patch available.
Rapid7 Tracks Active Exploits Against GitLab Path Traversal
Rapid7's ETR on CVE-2026-85706 confirms active exploitation the day CISA's federal deadline expired. Unpatched GitLab instances are overdue.
Apache Syncope Patches 7 Critical Flaws
Apache Syncope patches seven critical CVEs: JWT forgery, Cypher injection, and search injection across 3.x and 4.x. Upgrade and rotate connector credentials.
LightLLM Config Server Has Unauthenticated RCE
CVE-2026-90919 (CVSS 9.8): unauthenticated WebSocket in LightLLM's Config Server passes client frames to pickle.loads, enabling RCE on any exposed instance.
Three Artifactory Flaws Exploited to Plant Backdoors
SecurityWeek reports three JFrog Artifactory flaws actively exploited to reach admin access and deploy backdoors in enterprise build pipelines.
Microsoft OOB Fixes RDS, Hyper-V Failures from Sept Patches
Out-of-band Windows updates address Remote Desktop Services failures, Hyper-V errors, and USB audio problems introduced by September 2026 Patch Tuesday.
Apple iOS 27, macOS Golden Gate Patch 200 Vulns
Apple released iOS 27 and macOS Golden Gate 27 on September 15, patching roughly 200 vulnerabilities including kernel flaws that enable privilege escalation and memory corruption.
Japan Digital Agency Breach Exposes 246K Staff Records
Japan's Digital Agency disclosed a VPN breach affecting roughly 246,000 rows of government employee personal information. The specific CVE and VPN vendor have not been named.
China-Linked Group Deploys GRIMWEDGE via Zero-Day Chain
A China-linked group uses a Chrome-plus-Windows zero-day chain in targeted spear-phishing campaigns to drop GRIMWEDGE, a JavaScript backdoor, on victim systems.
Cisco Email Gateway SQLi Grants Root, Now in KEV
CVE-2026-76461, a SQL injection in Cisco AsyncOS, lets unauthenticated attackers run OS commands as root. CISA added it to KEV on Sept. 14 with a Sept. 17 deadline.
ScreenConnect Worm Attacks: CVE-2026-84869 Now Patched
Huntress documented worm-like ScreenConnect attacks active since August 20. ConnectWise has released version 26.6.5 patching CVE-2026-84869, a CVSS 9.9 flaw exploited in the campaign.
Revolut Breach Exposes Passports and Financial Data
A threat actor impersonated a government agency to obtain passport copies, identity documents, and complete transaction records from an undisclosed number of Revolut customers.
CVSS 10 Flaw in WordPress Payment Plugin Grants Admin Access
CVE-2026-81648 skips authorization on a CryptoPayment Gateway AJAX endpoint in versions 1.2.1-1.2.2, giving unauthenticated visitors admin-level access.
BioStar 2 API Leaks Active Directory Credentials
Suprema BioStar 2 before 2.9.12 exposes Active Directory service credentials via an unauthenticated API. Patch and rotate the affected service account.
China-Linked UNC3569 Deploys GrayRabbit via Sogou Flaw
Gen Threat Labs links China-aligned UNC3569 to GrayRabbit backdoor deployments through a chained flaw in Tencent's Sogou Input Method for Windows. Patch to v16.3.0.3498.
Events Calendar Plugin: Two CVSS 9.8 RCEs
Two unauthenticated CVSS 9.8 RCEs in The Events Calendar WordPress plugin affect all versions through 6.17.4. Disable or update immediately.
BlueMoon Exploit Kit Chains Chrome, Windows Zero-Days
BlueMoon exploit kit bundles Chrome renderer and Windows privilege-escalation zero-days into a two-stage chain, with espionage-motivated actors adopting it in rushed campaigns.