#уязвимость
-
Adobe Acrobat's Chrome Extension Exposed WhatsApp Web Chats
The HermeticReader vulnerability let any malicious site read WhatsApp Web conversations through the Adobe Acrobat extension — with no password, no cookies and no user interaction. Adobe has already shipped a fix.
-
Critical SharePoint Vulnerability CVE-2026-50522 Exploited After PoC Release
The third SharePoint Server vulnerability from Microsoft's July patch batch has come under active exploitation: attackers are stealing servers' machine keys to gain persistence in the system.
-
7-Zip patches critical vulnerability allowing arbitrary code execution
The 7-Zip developers have released version 26.02, closing a remote code execution vulnerability exploitable through specially crafted archives. Users are advised to update the application as soon as possible.
-
HollowByte Vulnerability in OpenSSL Allows a Denial of Service with an 11-Byte Packet
Researchers have discovered the HollowByte vulnerability, which allows unauthenticated attackers to cause a denial of service on OpenSSL-based servers using an extremely small malicious packet.
-
New LegacyHive exploit discovered for privilege escalation in Windows
A researcher operating under the alias Nightmare Eclipse has published a zero-day exploit called LegacyHive that grants administrator rights on fully updated Windows systems.
-
Vulnerability in Shark Robot Vacuums Allows Hijacking Other Devices Across an Entire AWS Region
A researcher going by the handle tokay0 has discovered and published a method for gaining root access to other people's Shark robot vacuums within a single AWS region. The manufacturer has yet to patch the vulnerability.
-
Zoom Warns of Critical Vulnerability Allowing Account Takeover
Zoom has disclosed a critical vulnerability in its Windows client and SDK that could be exploited to take over user accounts. The attack requires no authentication on the attacker's part.
-
Researcher Publishes New PoC for Windows Vulnerability Shortly After Patch Tuesday
A specialist using the alias Chaotic Eclipse has presented the LegacyHive exploit, which leverages a vulnerability in the Windows User Profile Service to escalate privileges.
-
Cursor Vulnerability: A Cloned Repository Can Run Code on Windows
A vulnerability has been found in the Cursor code editor on Windows: if a file named git.exe sits in the project root, the editor runs it with no warning and no confirmation. The malicious file then gains access to the user's SSH keys, cloud tokens and source code.
-
Critical Zimbra Vulnerability Allows Code Execution Through Emails
Zimbra is urging customers to install updates that fix a critical vulnerability in the Classic Web Client, which allows arbitrary code execution through specially crafted emails.
-
An Unpatchable XRING Vulnerability Found in Alibaba's XQUIC Library
A FoxIO researcher discovered that a single wrong variable in the XQUIC code lets an attacker remotely crash an HTTP/3 server with ordinary, fully legitimate traffic. There is no patch yet.
-
“Squidbleed”: a 29-year-old vulnerability in the Squid proxy server allows HTTP requests to be intercepted
A vulnerability dubbed “Squidbleed” has been found in the popular caching proxy server Squid, allowing the contents of HTTP requests to leak. The flaw is nearly three decades old.
-
Hackers Are Attacking a Critical Vulnerability in the Gitea Docker Image
Attackers are actively exploiting a critical vulnerability in the official Docker image of the self-hosted Gitea service that allows them to impersonate any user, including administrators.
-
Microsoft Patches RoguePlanet Zero-Day in Defender
Microsoft has released a fix for a zero-day vulnerability in Defender called RoguePlanet. The issue came to light after the June 2026 “Patch Tuesday.”
-
Google Pays $250K for a Linux Vulnerability Allowing Guest VM Escape
Two vulnerabilities have been discovered in Linux that grant unprivileged users root access. For one of them, which allows escaping a guest virtual machine, Google paid the researcher $250,000.
-
GitLost: researchers tricked GitHub's AI agent into exposing private repositories
Researchers demonstrated an attack called GitLost that deceived GitHub's AI agent into leaking data from private repositories. The write-up on the research drew notable attention on Hacker News.
-
A vulnerability allowing root privileges has been discovered in OpenBSD
A use-after-free vulnerability that lets a local user escalate privileges to root has been found in versions of OpenBSD up to and including 7.9. The vulnerability has been assigned the identifier CVE-2026-57589.
-
16-year-old Januscape vulnerability found in the Linux kernel enables virtual machine escape
Researchers have discovered a vulnerability in the Linux kernel called Januscape that had existed for 16 years. It allows attackers to break out of a virtual machine and execute arbitrary code on the host system.