#cve
-
Critical Vulnerability in Orkes Conductor: Unauthenticated RCE Exploited in Real-World Attacks
Fortinet reports active exploitation of the critical flaw CVE-2026-58138 in the Orkes Conductor workflow orchestration platform, which allows arbitrary commands to be executed without authentication.
-
Microsoft Patches Azure AI Foundry Flaw With Maximum CVSS Score of 10.0
A critical hole has been found in the Azure AI Foundry platform that let an unauthenticated attacker elevate privileges over the network. Microsoft has already fixed the issue on its end — no customer action is required.
-
Four Local Root Vulnerabilities in the Linux Kernel: DirtyAH6, TUNderflow, PPPoEject and DiagSpill
Researcher Asim Manizada has disclosed four vulnerabilities in the Linux kernel that let an unprivileged user gain root. The bugs are between 10 and 21 years old, and the fixes have already landed in the stable branches.
-
Critical Flaw in Unbound's DNSSEC Validator Threatens Remote Code Execution
NLnet Labs has released Unbound 1.26.1, fixing a critical heap overflow in the DNSSEC validator (CVE-2026-81642) that could lead to RCE via a malicious DNS zone, along with eight other vulnerabilities.
-
CISA: Critical GitLab Vulnerability Already Being Exploited in Attacks
The CISA agency has warned of active exploitation of a maximum-severity vulnerability in GitLab that allows secrets to be read from vulnerable servers without authentication.
-
GitLab Patches Critical Path Traversal Flaw in Commits API
GitLab has urged administrators to update their servers immediately: the maximum-severity vulnerability CVE-2026-85706 lets unauthenticated attackers read arbitrary files. A second critical flaw in GraphQL was patched at the same time.
-
Attacks on JFrog Artifactory: A Flaw Chain Opens the Path to Admin Rights
Wiz has recorded attacks on unpatched self-hosted JFrog Artifactory servers: attackers chained two vulnerabilities to gain administrator rights and plant backdoors.
-
Check Point Patches Two Critical Flaws in VPN Certificate Handling
Both holes carry a 9.8 rating and could, in theory, let an unauthenticated attacker execute code remotely — but the vendor won't spell out the “certain conditions.”
-
Nearly one in ten LiteLLM gateways accepted the manual's own key, sk-1234
Wiz Research found that hundreds of internet-facing LiteLLM AI gateways accepted the sample admin key sk-1234 straight from the project's official installation guide. Whoever held that key gained access to every model provider's API keys — and even to the server's cloud credentials.
-
Cisco Confirms Exploitation of Critical Secure FMC Vulnerability
The CVE-2026-20079 vulnerability, with a maximum CVSS score of 10.0, allows attackers to bypass authentication and execute commands with root privileges. Cisco has acknowledged that it is already being used in attacks, and CISA has ordered government agencies to remediate the flaw by September 12.
-
JetBrains Breached Through Its Own Unpatched TeamCity: AWS Keys and Code Leaked
The company is urging users of its Cadence cloud service to immediately revoke and rotate all secrets: attackers penetrated its infrastructure through a TeamCity vulnerability that JetBrains had failed to patch on its own systems.
-
Hackers Target Schools and Universities Through PaperCut Vulnerabilities
Attackers are chaining two recently discovered vulnerabilities in the PaperCut print management system to steal credentials at educational institutions across the US and Europe.
-
Actively Exploited Sandbox RCE Vulnerability in All Versions of Chromium
An entry has appeared in the NVD for the critical vulnerability CVE-2026-85046, which affects all versions of Chromium and, judging by its description, is already being used in attacks.
-
Attacks on a Critical Authentication-Bypass Flaw in Citrix NetScaler Have Begun
Threat actors have started exploiting the critical CVE-2026-19490 vulnerability in Citrix NetScaler following the release of a working PoC exploit. The flaw allows authentication to be bypassed remotely and without privileges.
-
Plex Urges Immediate Update After Patching Undisclosed Vulnerabilities
Plex has released Media Server and Desktop updates that fix several vulnerabilities, but is withholding the details for now. The company recommends installing them as soon as possible.
-
JFrog Artifactory Critical Vulnerability Comes Under Attack Within Days
Attackers are exploiting a fresh authentication bypass flaw in JFrog Artifactory to mint themselves admin tokens. According to watchTowr, the attacks began just days after disclosure.
-
Nearly 22,000 Microsoft Exchange Servers Vulnerable to Mail Hijacking
Tens of thousands of unpatched Exchange servers remain exposed online, vulnerable to the CVE-2026-62911 authentication bypass. An exploit is already public, and the most unpatched systems are in the US and Germany.
-
Hackers Launch Mass Attacks on Critical Langflow and Ruby on Rails Vulnerabilities
VulnCheck researchers have observed active exploitation of two critical flaws in the AI platform Langflow and in Ruby on Rails: attackers are hunting for credentials and standing up command infrastructure.
-
Five Critical Vulnerabilities in WordPress Plugins and Themes Threaten Site Takeover
Researchers at Wordfence and Patchstack have disclosed five critical flaws in popular WordPress add-ons — ranging from authentication bypass to remote code execution. WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP are all at risk.
-
ownCloud Flaw Used to Steal Nuclear Data in the Philippines
CISA added a critical ownCloud flaw to its exploited-vulnerabilities catalog after a Chinese-speaking group exfiltrated documents from a Philippine nuclear research center.
- More