Browse the latest CVE vulnerability disclosures, CISA KEV alerts, and OSV advisories. Check original vendor advisories and referenced records.
Elastic addresses a critical vulnerability in Kibana, enabling arbitrary code execution. Learn how this flaw impacts Elasticsearch visualization and how to mitigate risks.
CVEs: CVE-2025-25012
Threat actors have launched a malicious campaign targeting organizations in Japan since January 2025. The attackers exploit the PHP-CGI RCE vulnerability (CVE-2024-4577) to gain access to victim machines.
CVEs: CVE-2024-4577
Mirai-based botnets are exploiting a zero-day flaw in Edimax IP cameras for remote command execution. US CISA warns of the vulnerability, urging organizations to report suspicious activity. Learn more about the impact and mitigation strategies.
CVEs: CVE-2025-1316
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language extensions installed on the server. The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8. Any code run this way has the rights of the operating
CVEs: CVE-2026-6460
Zoom fixes two Windows Workplace flaws, including a critical bug that could let unauthenticated attackers remotely escalate privileges. Zoom has released security updates to fix two vulnerabilities in Zoom Workplace for Windows. One is critical and could let attackers gain higher privileges on affected systems. The vulnerabilities are: CVE-2026-108186 (CVSS 9.6): An input validation flaw that could allow an attacker to gain higher privileges through a network connection, without logging in. CVE-2026-108187 (CVSS 8.1): An origin validation flaw that could also allow an unauthenticated attacker…
CVEs: CVE-2026-108186, CVE-2026-108187
CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads. All versions of GPUStack prior to 2.2.0, which was released at the end of June. This vulnerability was not made public until the end of July, and the CVE was assigned on November 4th.
CVEs: CVE-2026-102895
Key Takeaways Neither flaw is in your application code. Every app and API on a vulnerable runtime inherits the risk. PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node2Shell (CVE-2026-111497) is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. Both are on the CISA KEV list. PHP2Shell was added on October 26. Node2Shell followed on October 27. Qualys TotalAppSec tests the application and the APIs with four non-intrusive QIDs for detection of vulnerabilities and two intrusive QIDs for verification of the fix. Patching fixes the runtime. A rescan…
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
CVEs: CVE-2026-108186
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild. The vulnerability is a use after free issue that resides in XML and was reported by an anonymous source on November 6, 2026.. “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” reads the advisory . A Use-after-free (UAF) is a memory corruption vulnerability that occurs when a…
CVEs: CVE-2026-125350
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
CVEs: CVE-2026-123158
Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect. Our honeypots collect only the first 255 characters of SSH passwords. Longer passwords are highly unusual and not used for the usual password brute-forcing we observe.
CVEs: CVE-2026-123158
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek .
CVEs: CVE-2026-19868
U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog . CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS. “An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass S…
CVEs: CVE-2026-19868
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
CVEs: CVE-2026-123158
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates
CVEs: CVE-2026-83844
This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.
CVEs: CVE-2023-20198
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple flaw, tracked as CVE-2024-27834 (CVSS score of 5.5), to its Known Exploited Vulnerabilities (KEV) catalog . “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” reads the advisory by CISA. CVE-2024-27834 is a security vulnerability affecting Apple’s operating systems and Safari. It could a…
CVEs: CVE-2024-27834
Barracuda patched two flaws that can be chained to give attackers root access to Email Security Gateway appliances. Barracuda has patched two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances. CVE-2026-116606 (CVSS score of 9.3) is an authentication bypass that lets unauthenticated attackers modify appliance configurations. CVE-2026-111560 (CVSS score of 8.6) is a command injection flaw affecting six Barracuda products. An attacker with administrator privileges could exploit it to execute operating system commands as root. “Barracuda …
CVEs: CVE-2026-116606, CVE-2026-111560
SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files,
CVEs: CVE-2026-109593
![[SECURITY] Apache Juneau 9.2.1 fixes multiple vulnerabilities (CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, CVE-2026-73099, CVE-2026-73100, CVE-2026-73101, CVE-2026-73098, CVE-2026-73116, CVE-2026-73117)](https://seclists.org/images/oss-sec-img.png)
Posted by James Bognar on Nov 04Apache Juneau 9.2.1, released on 2026-11-03, fixes the following vulnerabilities. All affect Apache Juneau through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes these issues. The juneau-shaded-* and oth…
CVEs: CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, CVE-2026-73099, CVE-2026-73100
One of the early web application vulnerabilities I remember was CVE-2000-0411 [CVE]. This was a simple vulnerability in a CGI-bin script used to send e-mail. The vulnerability was pretty straightforward: Adding additional parameters to the URL leaked environment variables. Other vulnerabilities allowed setting the "To" address and were heavily abused by spammers. And if parameters were passed directly to the sendmail binary, similar vulnerabilities could allow arbitrary code execution.
CVEs: CVE-2000-0411
Executive Summary PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution on exposed PHP servers. PHP has released fixed versions. On Linux, distribution packages carry the fix. On Windows and macOS, they don’t: Microsoft and Apple don’t ship PHP, so the fix is an in-place PHP upgrade that has traditionally been done by hand, one server at a time. Qualys TruRisk Eliminate’s Custom Assessment and Remediation (CAR) capability runs Qualys TRU-published scripts that upgrade each PHP installation to the latest patch release of its current minor series. On Windo…
CVEs: CVE-2026-109618, CVE-2026-109619
Late October brought several unsettling cybersecurity stories all at once. Among these were two critical vulnerabilities in PHP, which potentially affected about 70% of websites worldwide. CVE-2026-109618 and CVE-2026-109619 — dubbed PHP2Shell — could let attackers execute code on a server remotely, without authentication. On October 21, PHP’s developers released emergency patches for the supported PHP 8.2–8.5 branches and for the unsupported PHP 7.4, 8.0, and 8.1. Experts predicted that attacks on vulnerable servers would start within 15 minutes of the updates going public. Amazon even repor…
CVEs: CVE-2026-109618, CVE-2026-109619
Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux's implementation (RFC 8684, CVE-2026-98432)
CVEs: CVE-2026-98432
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog : CVE-2026-111357 (CVSS score of 8.8) – A missing authentication check for a critical function that could allow an authenticated local attacker to gain higher privileges. CVE-2026-118527 (CVSS score of 4.3) – A predictable identifier vulnerability that could allow an a…
CVEs: CVE-2026-111357, CVE-2026-118527
このブログは「Security advisory: CVE-2026-111487: Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework」の抄訳です。 Qt3DモジュールのassimpシーンインポートプラグインにおいてOut-of-bounds write(範囲外書き込み)の脆弱性が発見され、CVE IDとして CVE-2026-111487が割り当てられまし…
CVEs: CVE-2026-111487
このブログは「Security advisory: CVE-2026-107457 Memory corruption vulnerability in QMqttClient impacts Qt MQTT」の抄訳です。 Qt MQTTモジュールのQMqttClientクラスにメモリ破損の脆弱性が発見され、CVE-2026-107457が割り当てられました。
CVEs: CVE-2026-107457
このブログは「Security advisory: CVE-2026-105924 NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt」の抄訳です。 Qt Coreモジュールの Qt QCborValue からJSONへの変換処理において、NULLポインタ参照の脆弱性が発見され、CVE IDとしてCVE-2026-105924が割り当てられました。
CVEs: CVE-2026-105924
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539 , in its Commerce Core module. The vulnerability is caused by missing authorization checks. “This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs. The module doesn’t sufficiently protect certain routes and entity fields, leading to an access…
CVEs: CVE-2026-118539
Free external PHP vulnerability scanner (php2shell / CVE-2026-109618, CVE-2026-109619) — passive fingerprinting plus limited, read-only path checks. No exploit probes.
CVEs: CVE-2026-109618, CVE-2026-109619