#уязвимость
-
Critical Avada Theme Vulnerability for WordPress: Zero-Click RCE
A chain of six vulnerabilities in the popular Avada theme lets an unauthenticated attacker execute arbitrary PHP code on the server. The flaw was found by a Wordfence AI tool in under two hours.
-
A Malicious Webpage Can Poison Your Local AI Model Through NVIDIA NemoClaw
Oasis Security has disclosed a weakness in the open-source NVIDIA NemoClaw stack: an attacker-controlled website can hijack a local Ollama without authentication and inject hidden instructions straight into the model.
-
Attack on Zimbra: Over 270 Servers Breached Through an SNMP Vulnerability
Attackers are actively exploiting the critical vulnerability CVE-2026-73570 in Zimbra Collaboration Suite, which allows remote code execution without authentication. According to Shadowserver, hundreds of servers have been compromised.
-
Attacks on the miniOrange SAML SSO plugin for WordPress: login bypass grants admin rights
Attackers are mass-scanning WordPress sites for the Xecurify miniOrange SAML 2.0 SSO plugin, whose two vulnerabilities allow logging in as any user without authentication.
-
Vulnerability in Calix routers exposes home devices to the entire internet
An unpatched hole in Calix GS7 XGS routers lets attackers create port-forwarding rules remotely and without authentication, bypassing NAT and the firewall. The manufacturer never responded to the researcher's outreach.
-
Critical Keycloak Vulnerability Lets Attackers Hijack Any Account via Password Reset
Red Hat and the Keycloak project have released patches for the critical flaw CVE-2026-18963 (CVSS 9.1): an unauthenticated attacker can take over any account, including an administrative one, by forcing the system to reset the password.
-
NTFS3 Driver Vulnerability: A Crafted Image Grants Root on Linux
A specially crafted NTFS image on a USB stick lets a local user gain root privileges on Linux. The problem has remained unpatched since early summer.
-
Emacs Once Again Found to Execute Code When Opening a File
The vulnerability exploits the Emacs Lisp symbol shorthands mechanism and allows arbitrary code to run when opening any file in the default configuration. All versions from 28.1 onward are affected.
-
Critical GitLab Vulnerability CVE-2026-19478 Comes Under Exploitation Within Days
A fresh GitLab flaw rated CVSS 9.4 lets an unauthenticated attacker overwrite and delete public projects. According to watchTowr, real-world attacks began almost immediately after disclosure.
-
A Critical Zimbra Vulnerability Is Already Being Exploited in Attacks
Poland's CERT has warned of active exploitation of the critical vulnerability CVE-2026-73570 in the Zimbra Collaboration Suite mail server, which allows arbitrary code execution without authentication.
-
macOS Screen Sharing Flaw Exploited to Mine Monero
The Dutch cybersecurity center is warning of active exploitation of an authentication-bypass vulnerability in macOS: attackers gain root access and install a cryptocurrency miner.
-
Hackers Target Critical Adobe Commerce Flaw to Hijack Shopper Accounts
Attempts have been detected to exploit CVE-2026-71362 in the Adobe Commerce and Magento platforms, a flaw that allows unauthenticated takeover of other users' sessions.
-
Cisco Warns of Active Exploitation of a Flaw in ASA and FTD
A vulnerability in the VPN components of Cisco Secure Firewall lets attackers reboot devices remotely. The company has observed attacks and released fixes.
-
Zapscape: KVM Vulnerability Lets Attackers Escape a Guest VM onto the Linux Host
A new bug in KVM/x86's shadow MMU (CVE-2026-64561) lets privileged code inside a nested virtual machine run commands on the host as root. The risk applies to systems running nested virtualization exposed to untrusted guests.
-
Thermo Fisher Patches Flaw That Let Forensic DNA Files Be Tampered With Undetected
The company has released digitally signed updates for its Applied Biosystems software, but three legacy product lines won't get the fix. Researchers believe the flaw has existed in forensic lab files since 1995.
-
CosmosEscape: An Azure Cosmos DB Flaw Opened the Door to Every Customer's Databases
Wiz researchers demonstrated an attack chain that led through a Gremlin sandbox escape to a platform key granting access to any Cosmos DB database. Microsoft has fixed the issue.
-
One Visit Compromises Tor Browser: A Firefox JIT Vulnerability
Researchers at Nebula Security have shown that a now-patched flaw in Firefox's JIT compiler allowed code execution in the browser from simply visiting a malicious page — and it affected Tor Browser. Mozilla fixed the hole in version 151.0.3.
-
n8n Sandbox Escape: Workflow Editor Could Run OS Commands
The n8n automation platform has patched a high-severity vulnerability: an authenticated workflow editor could break out of the expression sandbox and run operating-system commands with the privileges of the n8n process.
-
AgentForger: How a Single Phishing Link Turned ChatGPT into an Autonomous Spy Inside a Company
Researchers at Zenity Labs have disclosed a critical vulnerability in ChatGPT's Workspace agents: clicking a single link made it possible to covertly create, authorize and launch a hostile AI agent with an employee's privileges. OpenAI closed the hole on June 8, 2026.
-
Check Point Patches SmartConsole Flaw That Granted Administrator Rights
The company has released updates for its Security Management and Multi-Domain Management products, fixing among other things a critical flaw that is already being used in real-world attacks.
- More