#уязвимости
-
SonicWall Patches Two 0-Days in SMA 1000: Attackers Chain the Flaws Together
The company released updates for its SMA 1000 series VPN gateways after two vulnerabilities — one of them rated a maximum 10 on the CVSS scale — were actively exploited.
-
The “Vulnpocalypse” Is Reshaping the Economics of Bug Bounty Programs
Dark Reading argues that the avalanche of new vulnerabilities is repricing the bug bounty market.
-
JFrog Artifactory Critical Vulnerability Comes Under Attack Within Days
Attackers are exploiting a fresh authentication bypass flaw in JFrog Artifactory to mint themselves admin tokens. According to watchTowr, the attacks began just days after disclosure.
-
Nearly 22,000 Microsoft Exchange Servers Vulnerable to Mail Hijacking
Tens of thousands of unpatched Exchange servers remain exposed online, vulnerable to the CVE-2026-62911 authentication bypass. An exploit is already public, and the most unpatched systems are in the US and Germany.
-
Fresh PaperCut Vulnerabilities Exploited to Steal Data
Two recently patched zero-day vulnerabilities in PaperCut NG and MF are now being used by attackers to steal data from vulnerable print servers.
-
FreeBSD 14.5-RC1 Released with a Batch of Security Fixes
The final test build before the stable release of FreeBSD 14.5 closes several vulnerabilities that let local users escalate privileges. The release is expected on September 8.
-
Five Critical Vulnerabilities in WordPress Plugins and Themes Threaten Site Takeover
Researchers at Wordfence and Patchstack have disclosed five critical flaws in popular WordPress add-ons — ranging from authentication bypass to remote code execution. WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP are all at risk.
-
Three ServiceNow Vulnerabilities Rated CVSS 10.0 Open the Door to Remote Code Execution
ServiceNow has released fixes for four vulnerabilities in its AI platform; three of them received the maximum severity score and, under certain conditions, allow an unauthenticated attacker to execute code or SQL queries.
-
Next.js Patches Two Critical Remote Code Execution Vulnerabilities
Vercel has shipped out-of-band patches for Next.js: one flaw is exploited through a malicious AVIF file, the other through path traversal on Windows servers. Both allow code execution without authentication.
-
CISA Adds Six Exploited Vulnerabilities to Its KEV Catalog, Including a Citrix NetScaler Flaw
The U.S. agency CISA has added six new entries to its list of actively exploited vulnerabilities — ranging from a fresh Citrix NetScaler flaw to old holes in Linux, SQL Server and Red Hat utilities.
-
Critical RCE Vulnerability in Gitea Already Being Exploited for Cryptojacking
CISA has warned of active attacks against CVE-2026-60004 in Gitea. Rated 9.8, the flaw allows arbitrary command execution, and the first victims have found a miner-like payload on their servers.
-
CISA Adds Critical Oracle WebLogic Vulnerability to Its Catalog of Actively Exploited Flaws
The CVE-2026-21962 vulnerability, with a maximum CVSS score of 10.0, lets an unauthenticated attacker access critical data over HTTP. Patches shipped back in January, but the attacks continue.
-
CISA Orders Urgent Patching of TrueConf Server Flaws Being Exploited in Attacks
The U.S. agency CISA has given federal agencies two weeks to remediate two critical vulnerabilities in the TrueConf Server platform. According to Kaspersky Lab, the Head Mare group is using them against Russian companies.
-
Cisco Fixes Nine Vulnerabilities in Crosswork and Secure Workload, Five Rated 10.0
The company has released a fresh batch of patches for the Crosswork and Secure Workload platforms following an internal security audit. Five of the nine holes received the maximum CVSS score of 10.0.
-
Critical Entra ID Vulnerability (CVSS 10.0): Remote Code Execution Already Exploited
Microsoft has disclosed a maximum-severity flaw in its Entra ID cloud identity service that attackers have already exploited. The company insists the vulnerability has been fully remediated and that no action is required from customers.
-
Critical NetScaler Vulnerability Allows Authentication Bypass
Citrix has released updates for NetScaler ADC and NetScaler Gateway, patching two vulnerabilities, including a critical authentication bypass on gateways and AAA servers.
-
Holes in NASA's AIT-GUI let attackers send commands to spacecraft without a password
Cycode researchers have disclosed a chain of vulnerabilities in the operator console of NASA/JPL's AMMOS toolkit: an anonymous attacker can send arbitrary commands to the command bus of instruments and spacecraft. The vulnerability is rated 9.4 on the CVSS scale.
-
Critical Elementor Pro Vulnerability Opens the Door to Unauthenticated Code Execution
A flaw in the forms module of the popular WordPress plugin lets an unauthenticated attacker upload a PHP file and run arbitrary code. The patch landed on August 19.
-
CISA: Critical Windows IKE Vulnerability Already Exploited in Attacks
The U.S. agency CISA has warned of active exploitation of a critical RCE vulnerability in the IKE service extensions component, affecting all supported versions of Windows.
-
Attacks on MLflow: SSRF Vulnerability Exploited to Steal Cloud Secrets
Attackers have begun mass-scanning exposed MLflow servers, exploiting a critical SSRF vulnerability to reach cloud metadata. At the same time, the industrial platform FUXA has come under fire.
- More