#уязвимости
-
Citrix Urges Admins to Patch New NetScaler RCE Flaw at Once
A critical flaw in NetScaler ADC and NetScaler Gateway allows remote code execution or a denial-of-service crash. No active attacks have been seen yet, but more than 21,000 appliances remain exposed online.
-
Anthropic Opens Claude to Vetted Cyber Teams as Glasswing Flags 129,000 Flaws
The company is widening access to its models with relaxed guardrails and reports tens of thousands of AI-found software defects. Yet very few of them prove exploitable in practice.
-
GrayKey Defeats the iPhone's Inactivity Reboot
A maker of phone-cracking tools has found a way around the iOS feature that moves an idle iPhone into a more secure state. Instead of rebooting after 72 hours, the data is preserved indefinitely.
-
Microsoft Patches Exchange Server Flaw That Let Users Read Each Other's Mail
Out-of-band updates close CVE-2026-96940 (CVSS 8.8): an authenticated user could reach other mailboxes within the same organization.
-
New Dell System Update flaw hands attackers root access
Dell is urging customers to patch its System Update tool as soon as possible: the flaw lets a remote attacker execute code with root privileges on unpatched systems.
-
Attackers Hit Rejetto HFS: Weak RNG Opens the Door to Admin Session Forgery
A critical flaw in Rejetto HTTP File Server is already under attack: a predictable signing key lets intruders forge an administrator cookie and run arbitrary code.
-
Warlock Keeps Exploiting SharePoint Flaws to Hit Critical Infrastructure
The suspected China-linked Warlock group continues to weaponize Microsoft SharePoint vulnerabilities, disable security tools, and deploy ransomware. Its recent victims span Portuguese- and Spanish-speaking countries.
-
GitLab Patches Critical 9.9 AI Gateway Flaw Enabling Command Execution
A flaw rated 9.9 let a logged-in user with Duo Agent Platform access escape the prompt template sandbox and run arbitrary commands on the gateway. Only organizations that host their own AI Gateway need to act.
-
Dell patches max-severity flaws in Kubernetes storage modules
The company has fixed two maximum-severity vulnerabilities in its CSM authorization modules that let an unauthenticated attacker seize full administrative control over enterprise storage.
-
Fortinet warns of critical FortiMail flaw already exploited in the wild
Fortinet has disclosed a critical FortiMail vulnerability with a CVSS score of 9.8 that attackers are exploiting as a zero-day. Patches are not yet available for every affected version.
-
Attackers Weaponize Zimbra Flaw to Plant Web Shells and Steal Auth Secrets
Microsoft reports that attackers exploited an already-patched Zimbra Collaboration Suite flaw to deploy web shells, read mailboxes, and harvest server-wide authentication secrets.
-
TeamViewer urges users to patch severe flaws as soon as possible
The remote access software maker issued a rare advisory, urging all users to update to version 15.82 without delay.
-
OpenSSL Patches High-Severity DTLS Bug That Can Leak Heap Memory in the Clear
On September 29 OpenSSL shipped fixes for a High-severity DTLS flaw that can send heap memory to the other side of a connection unencrypted, or crash the program.
-
Inside the Citrix NetScaler Exploit: From a DTLS Packet to Root-Level Code
Researchers have published technical details of CVE-2026-88772, a critical flaw in Citrix NetScaler ADC and Gateway. The DTLS buffer overflow is already being abused in the wild.
-
CISA orders federal agencies to patch exploited Citrix flaws by Wednesday
The US cybersecurity agency has ordered agencies to shield their systems against attacks abusing two critical NetScaler vulnerabilities that are already being exploited in the wild.
-
Attackers Bypass WAFs to Exploit an Oracle PeopleSoft Flaw
Google warns of a renewed wave of mass exploitation against a critical Oracle PeopleSoft flaw, with a ShinyHunters-linked group slipping past WAF rules and dropping web shells.
-
CISA Flags SharePoint and MikroTik RouterOS Flaws as Actively Exploited
CISA added two vulnerabilities — in Microsoft SharePoint and MikroTik RouterOS — to its KEV catalog, citing evidence of active exploitation. One RouterOS flaw is part of the MikroTrick chain that hijacks routers without a password.
-
ShinyHunters breached Clop's leak site via a Grav CMS path traversal flaw
The Clop ransomware crew has moved its leak site to a new Tor address after admitting its old server was hacked and defaced through an unpatched path traversal flaw in Grav CMS.
-
CISA Adds Exploited WSO2 and Adobe Commerce Flaws to Its KEV Catalog
The U.S. cybersecurity agency CISA has added two critical flaws in WSO2 and in Adobe Commerce and Magento to its KEV catalog, citing evidence of active attacks. Federal agencies must patch them by September 27, 2026.
-
Critical Roundcube flaw now under active exploitation
Canada's cyber security agency warns that a Roundcube Webmail vulnerability, patched back in May, is now being used in real-world attacks.
- More