Browse the latest CVE vulnerability disclosures, CISA KEV alerts, and OSV advisories. Check original vendor advisories and referenced records.
Elastic addresses a critical vulnerability in Kibana, enabling arbitrary code execution. Learn how this flaw impacts Elasticsearch visualization and how to mitigate risks.
CVEs: CVE-2025-25012
Threat actors have launched a malicious campaign targeting organizations in Japan since January 2025. The attackers exploit the PHP-CGI RCE vulnerability (CVE-2024-4577) to gain access to victim machines.
CVEs: CVE-2024-4577
Mirai-based botnets are exploiting a zero-day flaw in Edimax IP cameras for remote command execution. US CISA warns of the vulnerability, urging organizations to report suspicious activity. Learn more about the impact and mitigation strategies.
CVEs: CVE-2025-1316
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online – Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog . Collabora Online – Built-in CODE Server is an app for Nextcloud that lets you open, edit and collaborate on documents, spreadsheets and presentations directly in your browser, without needing Microsoft Office installed on your comp…
CVEs: CVE-2026-110447
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog . VeloCloud Orchestrator (VCO) is the central management system for VMware SD-WAN, a technology that helps companies securely connect offices, data centers, cloud services, and remote sites over wide-area networks. It is now associ…
CVEs: CVE-2026-114625
Runtime probe for MCP cross-tenant response leaking via JSON-RPC id collision (CVE-2026-111770)
CVEs: CVE-2026-111770
Runtime probe for MCP cross-tenant response leaking via JSON-RPC id collision (CVE-2026-111770)
CVEs: CVE-2026-111770
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
CVEs: CVE-2026-110447
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
CVEs: CVE-2026-109618, CVE-2026-109619
A denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) of the qtbase component has been discovered and has been assigned the CVE id CVE-2026-16762.
CVEs: CVE-2026-16762
Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services: CVE-2026-109618 and CVE-2026-109619 . Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell. The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the following day. We’ve already covered the technical details of these vulnerabilities and explained what companies and server administrators should do .…
CVEs: CVE-2026-109618, CVE-2026-109619
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ’s calling library could allow a malicious caller to interfere with call termination, potentially leaving the victim’s microphone and camera active after they believe the conversation has ended. The flaw affects versions before 2.72.0 of the library RingRTC, which the messaging app uses to provide voice and video calling. It highlights a security problem that deserves attention…
CVEs: CVE-2026-113380
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence. “Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.” reads the report published by Amazon team.”The exploit attempt originated from an IP ad…
CVEs: CVE-2026-109618, CVE-2026-109619
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.
CVEs: CVE-2026-109618, CVE-2026-109619
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10. Why this matters PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many o…
CVEs: CVE-2026-109618, CVE-2026-109619
Two critical vulnerabilities have been discovered in the popular PHP programming language. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 , allow attackers to remotely execute code on a server running PHP without authentication. The language’s development team has released updates for all supported branches, but the first attempts to exploit the vulnerabilities were observed even before the patches were published. The exploit has been named PHP2Shell. The architectures of popular marketplaces, e-commerce platforms, and learning management systems (LMS) are written in P…
CVEs: CVE-2026-109618, CVE-2026-109619
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell . The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. Cloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation , OpenAI and Wiz among others. Cloudflare has developed and deployed web application firewal…
CVEs: CVE-2026-109618, CVE-2026-109619
Executive Summary BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain targeting the Windows Defender Antimalware Platform before 4.18.26030.3011. It does not grant initial access; an attacker needs standard-user code execution first. Still, in the lab, it reached NT AUTHORITY\SYSTEM, recovered domain-admin credentials from LSASS, and moved laterally via pass-the-hash. This is not memory corruption. It chains CloudFilter callbacks, batch oplocks, object-manager symlinks, Defender’s update RPC, offline SAM parsing, and SAMR. Crucially, affected is not the same as expl…
CVEs: CVE-2026-33825
A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 ( CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it encrypts conversations. According to the published vulnerability description , another participant c…
CVEs: CVE-2026-113380
Executive Summary PHP2Shell is two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) that can allow unauthenticated remote code execution on PHP installations serving web requests. Researchers have also demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens, and API keys. Cloudflare has already reported attack traffic, including attempts to evade its protections. Updating is the only complete fix: prioritize internet-facing deployments, starting with Apache mod_php, and assign an owner and remediation deadlin…
CVEs: CVE-2026-109618, CVE-2026-109619
Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' managemen…
CVEs: CVE-2026-76519, CVE-2026-0322
Today's episode covers hidden Visual Basic for Applications (VBA) macros left behind in AutoCAD drawings, Ledger hardware crypto wallets found with LTE implants that steal seed phrases, a Docker Hub account conversion flaw that exposed personal access tokens,…
CVEs: CVE-2026-105445
Citrix patched CVE-2026-107406, a critical NetScaler ADC and Gateway flaw that could allow remote code execution or denial-of-service attacks. Citrix has released security updates to fix CVE-2026-107406 (CVSS score of 9.5), a critical flaw affecting NetScaler…
CVEs: CVE-2026-107406
![[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))](https://seclists.org/images/oss-sec-img.png)
Posted by Jeremy Stanley on Oct 08========================================================================== OSSA-2026-044: Four authorization and privilege vulnerabilities in Mistral ========================================================================== …
CVEs: CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147
Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products. The post Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication appeared first on SecurityWeek.
CVEs: CVE-2026-21589
Posted by Goutham Pacha Ravi on Oct 07Errata 1 for OSSA-2026-043: CVE-2026-107363 has been assigned for this vulnerability. ===================================================================================== OSSA-2026-043: Zaqar WebSocket project substitu…
CVEs: CVE-2026-107363
CVE-2026-85706 is a critical GitLab path-traversal vulnerability that has moved beyond theoretical risk into confirmed exploitation. It affects self-managed GitLab CE/EE and could allow an unauthenticated remote attacker to read arbitrary files from the GitLa…
CVEs: CVE-2026-85706
Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected. T…
CVEs: CVE-2026-86950
Mechanism of the Authentication Bypass CVE-2026-76460 is a critical vulnerability within the Cisco Identity Services Engine (ISE) management interface, assigned a CVSS score of 10.0. The flaw, categorized as CWE-648, arises from the incorrect use of privilege…
CVEs: CVE-2026-76460
Azure Vulnerability Cluster Expands to Data and Financial Tiers Azure Database for PostgreSQL is vulnerable to CVE-2026-85878, an Improper Authorization flaw (CWE-285) carrying a CVSS score of 9.9. Simultaneously, Azure Billing is affected by CVE-2026-62874, …
CVEs: CVE-2026-85878, CVE-2026-62874