#cve
-
Critical SonicWall SMA 1000 Flaw Exploited Days After Patch
CVE-2026-102255, rated a maximum CVSS 10.0, allows pre-authenticated SSRF attacks. Researchers have already logged 135 exploitation attempts.
-
Citrix Urges Admins to Patch New NetScaler RCE Flaw at Once
A critical flaw in NetScaler ADC and NetScaler Gateway allows remote code execution or a denial-of-service crash. No active attacks have been seen yet, but more than 21,000 appliances remain exposed online.
-
curl 8.23.0 ships early over a serious vulnerability
The curl project is bringing version 8.23.0 forward to October 14, bundling a fix for one HIGH-severity flaw together with twenty-one lesser ones.
-
Atlassian patches critical file-access flaw in Jira and Confluence
The CVE-2026-21589 vulnerability lets an unauthenticated attacker read specific files in a web application's root directory. It affects self-hosted Data Center products, including Confluence, Jira and Bitbucket.
-
Microsoft Patches Exchange Server Flaw That Let Users Read Each Other's Mail
Out-of-band updates close CVE-2026-96940 (CVSS 8.8): an authenticated user could reach other mailboxes within the same organization.
-
Attackers Hit Rejetto HFS: Weak RNG Opens the Door to Admin Session Forgery
A critical flaw in Rejetto HTTP File Server is already under attack: a predictable signing key lets intruders forge an administrator cookie and run arbitrary code.
-
Citrix rushes out fix for exploited NetScaler zero-day
Citrix has shipped emergency NetScaler updates for CVE-2026-88779, already used in attacks. It is billed as a denial-of-service flaw, but researchers suspect remote code execution too.
-
GitLab Patches Critical 9.9 AI Gateway Flaw Enabling Command Execution
A flaw rated 9.9 let a logged-in user with Duo Agent Platform access escape the prompt template sandbox and run arbitrary commands on the gateway. Only organizations that host their own AI Gateway need to act.
-
Dell patches max-severity flaws in Kubernetes storage modules
The company has fixed two maximum-severity vulnerabilities in its CSM authorization modules that let an unauthenticated attacker seize full administrative control over enterprise storage.
-
Debian ships a record-long list of Linux kernel fixes
Advisory DSA-6528-1 patches hundreds of kernel vulnerabilities that could lead to privilege escalation, denial of service or information leaks. In Debian stable they are fixed in version 6.12.111-1.
-
Debian ships a major rsync upgrade to fix 33 CVEs
Rather than backport patches one by one, the maintainer bumped the whole package. The fixes bring behavior changes that may break existing setups.
-
Attackers Weaponize Zimbra Flaw to Plant Web Shells and Steal Auth Secrets
Microsoft reports that attackers exploited an already-patched Zimbra Collaboration Suite flaw to deploy web shells, read mailboxes, and harvest server-wide authentication secrets.
-
OpenSSL Patches High-Severity DTLS Bug That Can Leak Heap Memory in the Clear
On September 29 OpenSSL shipped fixes for a High-severity DTLS flaw that can send heap memory to the other side of a connection unencrypted, or crash the program.
-
One Pixel Too Many: A 0-Click Flaw in Apple's EXR Decoder
An ironPeak researcher details CVE-2026-86869: Apple's EXR image decoder on iOS, iPadOS and macOS overran a heap buffer, and the attack could be delivered over iMessage without a single tap.
-
A Race in AF_ALG: a 14-Year-Old Linux Kernel Hole Worth $113,337
A STAR Labs researcher found a race condition in the Linux kernel's crypto subsystem that lets an ordinary user become root and break out of a Docker container. The flaw, CVE-2025-39964, had lived in the code for roughly fourteen years.
-
Critical Roundcube flaw now under active exploitation
Canada's cyber security agency warns that a Roundcube Webmail vulnerability, patched back in May, is now being used in real-world attacks.
-
Critical Bifrost AI Gateway Flaw Allows Command Execution Without Credentials
A critical flaw in Bifrost, the open-source AI gateway that routes requests to over 20 LLM providers, lets an unauthenticated attacker run arbitrary commands on the gateway server with a single HTTP request.
-
Maxed-Out VeloCloud Orchestrator Flaw Already Under Active Attack
Arista warns that a new flaw in on-premises VeloCloud Orchestrator is being actively exploited. Only orchestrators that authenticate their Edge devices with certificates are at risk.
-
WordPress Comment2Shell: How a Comment Could Become a Server Takeover
A WordPress core flaw let an anonymous visitor plant a hidden script in a comment that fired when an administrator opened the page. The fix landed on September 17 in version 7.1.1.
-
SolarWinds Patches Hard-Coded Key Flaw in Access Rights Manager
SolarWinds has released security updates fixing a flaw in Access Rights Manager that allowed arbitrary code execution without authentication. The cause was a hard-coded static key.
- More