#уязвимости
-
Critical cPanel Vulnerability: A Hosting Customer Could Run SQL as the Database Root
cPanel has patched CVE-2026-58048 (CVSS 9.4), which let a hosting account holder execute arbitrary SQL commands with administrative privileges. The same release fixes two more flaws that broke through account boundaries.
-
INC Ransomware Emerges as the Top Exploiter of SonicWall SMA 1000 Vulnerabilities
According to Resecurity, since early August 2026 the INC Ransomware group has been actively exploiting a chain of vulnerabilities in SonicWall VPN appliances to breach corporate networks.
-
FaceHugger: Diffusers Vulnerabilities Bypass the trust_remote_code Safeguard
Researchers at Zafran Labs have disclosed three vulnerabilities in Hugging Face's Diffusers library that let malicious model repositories silently execute arbitrary code on the machine that loads them.
-
N-central Breach: The First Patch Didn't Close the Hole, Attackers Took Over MSP Servers
N-able reported that attackers exploited an authentication bypass in the N-central platform, gained administrative access to servers, and reached the client systems managed through them. The first fix turned out to be incomplete.
-
Pre-auth RCE in Apple Screen Sharing: root in 60 seconds thanks to a forgotten error code
A critical vulnerability has been found in the screensharingd daemon on macOS up to version 26.5: a bug in the SRP frame-length check lets an unauthenticated attacker gain root privileges with no password and no user interaction.
-
Adobe Patches Maximum-Severity CVSS 10.0 Flaw in Campaign Classic
A defect in Adobe's Campaign Classic marketing platform allows arbitrary code execution without any user interaction. The updates also address a series of critical holes in Adobe Bridge.
-
84 Vulnerabilities in 4G and 5G Network Cores: From Denial of Service to Session Hijacking
Researchers from Nanyang Technological University have uncovered an entire class of vulnerabilities in open-source implementations of mobile cores, born of the “blind trust” between network functions.
-
AI Helped Chrome Close 1,072 Vulnerabilities Across Two Releases
Google claims that language models have dramatically sped up the discovery and patching of holes in the browser: versions 149 and 150 fixed more bugs than the previous 23 releases combined.
-
Cisco: Embedded Credentials in Secure FMC Used in Zero-Day Attacks
Cisco is warning of active exploitation of CVE-2026-20316 in Secure Firewall Management Center, caused by static credentials hardcoded into the software. Patches have already been released, and there are no workarounds.
-
Broadcom Patches Three Critical VMware Vulnerabilities: Authentication Bypass, RCE and VM Escape
The updates affect VMware ESX, vCenter, Workstation and Fusion. Three of the fixed flaws are rated critical, including an authentication bypass in vCenter with a CVSS score of 9.8.
-
24,000 Server BMCs Leak Password Hashes via a 20-Year-Old IPMI Flaw
More than 24,000 internet-facing servers are exposing material for cracking their passwords because of an old weakness in the IPMI 2.0 protocol. For a third of them, researchers were able to recover working credentials.
-
Critical DHCPv6 Vulnerability in OpenWrt Opens the Door to Code Execution with Root Privileges
OpenWrt has shipped version 24.10.8, closing a critical stack overflow in odhcpd (CVE-2026-53921, CVSS 9.8) along with a number of other vulnerabilities in network services enabled by default.
-
STAR Labs Turned a Race Condition in Linux's Traffic-Control Subsystem Into a Root Exploit With the Help of AI
Researcher Li Jia Jie says artificial intelligence helped him find a use-after-free vulnerability (CVE-2026-53264) and speed up the development of an exploit that grants a local user root privileges.
-
Critical TeamCity Vulnerability: Command Execution Without Authorization
JetBrains is urging users of on-premises TeamCity to update immediately: a critical flaw rated 9.8 lets an unauthenticated attacker execute operating system commands.
-
Calif throws down the gauntlet: beat Apple's MIE with two vulnerabilities
Researchers at Calif have disclosed two vulnerabilities in the SMBClient and WebDAV components of macOS and invited the community — humans, AIs and mixed teams alike — to build on them an exploit that grants root on a device with MIE protection fully enabled.
-
Arista Patches Critical VeloCloud Orchestrator Zero-Day Already Exploited in Attacks
The flaw, rated a maximum 10.0, allows unauthenticated command execution on the SD-WAN management server. CISA has added it to its Known Exploited Vulnerabilities catalog.
-
Microsoft unveils its first cybersecurity model and the Perception agent platform
The company has released MAI-Cyber-1-Flash, a specialized model, and Perception, a platform built on teams of AI agents, throwing down the gauntlet to Anthropic, Google and OpenAI.
-
PoC Exploit for GitLab: An Authenticated User Gains Command Execution as git
A researcher has published a working exploit for unpatched self-managed GitLab: all it takes is to commit two crafted Jupyter notebooks and request a diff of them.
-
Clop Hits PTC Windchill and FlexPLM Through Critical Vulnerability
The Clop ransomware gang is exploiting a critical vulnerability in PTC's PLM platforms to steal corporate customers' data and demand ransoms.
-
Kimi K3 AI agents found flaws in Redis and assembled a working RCE exploit
On July 23, Redis shipped seven fixes after the publication of PoCs demonstrating remote code execution against stock builds 6.2.22, 7.4.9, 8.6.4 and 8.8.0. The researchers claim the chains were found by autonomous AI agents.
- More