Attackers target unauthenticated server-side request forgery flaw in SonicWall SMA 1000 appliances, prompting urgent vendor patching and heightened alert status.
A flaw in sandboxed.sh versions up to 1.3.0 allows container code to bypass isolation and access host files, creating severe security risks for organizations using the tool.
Self-managed GitLab users must upgrade immediately to fix severe authorization and code execution flaws released in October 2026.
Horizon3.ai reports that CVE-2026-102489 in Zammad allows attackers to steal session cookies and potentially execute remote code through error messages.
A critical vulnerability in the rtMedia plugin allows attackers to traverse directories, potentially exposing sensitive data on WordPress, BuddyPress, and bbPress sites.
Unauthenticated PHP object injection in Stargaze versions 1.10 and earlier allows attackers to take full control of affected websites.
Attackers are targeting unpatched AhsayCBS management consoles to install webshells and cryptocurrency miners, posing a significant risk to MSPs.
A critical authentication bypass in Wukong_HRM allows unauthenticated remote attackers to access all HR endpoints and modify employee records without credentials.
US fund managers halted the Nvidia-backed security firm's public listing within 48 hours, citing a mismatch between its $30B price tag and revenue.
TrendForce data shows non-China laptop production dropping to 21% in 2026 as manufacturers reverse supply chain shifts due to expense.
A critical vulnerability in Privasys RA-TLS clients allows relay attacks that bypass secure enclave verification, affecting Rust and Go libraries before version 0.5.0.
A critical flaw in Astron Agent allows authenticated users to run code as root, bypass tenant isolation, and access shared credentials in versions prior to 1.1.2.
A critical vulnerability in the Privasys rustls library allows attackers to relay genuine enclave quotes, bypassing attestation checks in affected versions.
A critical vulnerability in Privasys Go allows attackers to relay valid enclave quotes, undermining remote attestation security in affected versions.
A critical vulnerability in the ThemeREX Camelia WordPress plugin allows object injection, exposing sites to severe security risks until a patch is released.
A CVSS 9.8 vulnerability in the Booklovers WordPress theme allows attackers to inject objects via untrusted data deserialization, affecting versions up to 2.13.0.
A new analysis explores the practical challenges of risk management and keeping critical business systems running during security gaps.
Five critical vulnerabilities in Cisco's data center OS allow remote code execution with root privileges, threatening network integrity.
Attackers are exploiting a critical flaw in self-hosted Atlassian tools to read specific files without login credentials, affecting Jira, Confluence, and Bitbucket.
A critical vulnerability in Cisco NX-OS allows unauthenticated remote code execution, forcing network admins to patch immediately to prevent full system compromise.