Tag

Vulnerability

All articles tagged with #vulnerability

security3 days ago•2 min saved

Atlassian patches critical unauthenticated file-read flaw across eight self-hosted products

Atlassian disclosed CVE-2026-21589 on October 5, a critical path traversal flaw affecting eight self-hosted Data Center products. The vulnerability allows unauthenticated attackers to read specific files in the web application root directory if they know the exact file path. Atlassian rated the flaw 9.3/10 on the CVSS scale. Cloud versions are already patched, but self-hosted users must upgrade to specific fixed versions or apply temporary mitigations. Atlassian has not confirmed active exploitation but advises users to check logs for suspicious requests.

via The Hacker News|

#atlassian #cve-2026-21589 #data-center

cybersecurity4 days ago•1 min saved

Dell Urges Immediate Patching for Critical Kubernetes Storage Flaws

Dell has released version 1.18.0 of its Container Storage Modules (CSM) to fix six critical vulnerabilities, including two with a maximum CVSS score of 10.0. These flaws allow unauthenticated attackers to bypass authentication and gain full administrative control over storage infrastructure and Kubernetes clusters. Dell advises immediate upgrades as no workarounds exist.

via BleepingComputer|

#csm #cve-2026-63688 #cybersecurity

security7 days ago•5 min saved

ChatGPT Mac App Flaw Exposed Deep System Access Risks

A critical vulnerability in the macOS version of ChatGPT, discovered by Objective-See Foundation researchers, could have allowed attackers to access sensitive user data and execute commands. The flaw, which required only about ten lines of code to exploit, was patched by OpenAI on September 25, 2026. It highlighted the security risks of granting AI agents broad system permissions.

via WIRED|

#ai-agents #cybersecurity #macos

technology7 days ago•20 min saved

Apple Patches Critical Zero-Day Flaw in CoreGraphics After Targeted Attacks

Apple released emergency updates for iOS and macOS to fix CVE-2026-86950, a critical out-of-bounds write vulnerability in the CoreGraphics framework. The flaw, which allows arbitrary code execution, is being actively exploited in 'extremely sophisticated' attacks against specific individuals. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies patch the issue by October 2. While Apple credited Meta with discovering the flaw, security researchers have published a proof-of-concept that suggests a malicious PDF could trigger the bug, potentially via WhatsApp.

via Yahoo Finance|

#apple #cisa #cybersecurity

technology11 days ago•12 min saved

Researcher Demonstrates How Malicious Extensions Can Hijack Browser AI Agents

Security researcher Gal Weizman of Forever Security revealed a new attack vector called 'BragJack' that allows malicious browser extensions to hijack AI assistants in Chrome, Edge, and other Chromium-based browsers. By exploiting the declarativeNetRequest system, attackers can force AI agents to perform actions without additional user clicks, potentially accessing local files, screenshots, and camera feeds. The research led to over $20,000 in bug bounties and two CVEs, with Google and Microsoft confirming patches for the identified vulnerabilities.

via Fox News|

#ai-agents #browser-extensions #chrome

cybersecurity11 days ago•2 min saved

OnePlus 15 Root Exploit Exposes Flawed Debugging Services Across OPPO Devices

Security researcher Rasmus Moorats disclosed two unpatched flaws in OxygenOS that allow installed apps to gain root access without permissions. The exploit chains a debugging service with a hardware helper to bypass Android restrictions. OnePlus confirmed the issues affect multiple brands but withheld fixes and threatened legal action against the researcher.

via The Hacker News|

#android-security #cybersecurity #oneplus

cybersecurity11 days ago•2 min saved

Cloudflare patches cross-tenant flaw that exposed residual disk data to paying customers

Cloudflare has patched a vulnerability in its Containers and Sandboxes services that allowed customers with a Workers Paid plan to read residual data from other customers' containers on the same physical host. The flaw, reported by security researcher Oren Yomtov of Accomplish on September 4, 2026, stemmed from a shared storage pool that skipped zeroing reused 64 KiB blocks. While the researchers found leftover data on 18 of 24 container placements, Cloudflare confirmed no actual customer data was exposed and that no malicious exploitation occurred. The company completed mitigation by September 19, 2026, requiring no action from users.

via BleepingComputer|

#cloudflare #containers #cybersecurity

security27 days ago•2 min saved

GitLab fixes critical path-traversal flaw after rapid in-the-wild probes

GitLab released patches for a critical path-traversal flaw (CVE-2026-85706, CVSS 10) in the repository commits API that could let an unauthenticated attacker read arbitrary server files; in-the-wild probes were observed within hours of disclosure. The fixes also address a high-severity insecure deserialization issue in GitLab EE (CVE-2026-87719). Admins should upgrade to patched versions (CE/EE 19.1.8, 19.2.6, 19.3.2) or limit internet exposure, and monitor for suspicious POST requests to /api/v4/projects/{id}/repository/commits/ containing file.Path parameters to identify exploitation attempts.

via The Hacker News|

#cve-2026-85706 #gitlab #path-traversal

technology1 month ago•2 min saved

Exposed MikroTik SSH Flaw Lets Attackers Seize Router Admin Control

CERT Polska warns that attackers are exploiting publicly reachable MikroTik SSH to gain full administrative control without authentication, with assaults dating back to Sept 2; MikroTik RouterOS updates exist across affected versions and should be installed immediately from official sources, followed by checking for unauthorized changes. The advisory notes a two-flaw chain dubbed MikroTrick and urges disabling exposed services or restricting SSH/WWW management to trusted networks until patched. Do not use TLS or the built-in SSH on unpatched devices, and monitor logs for signs of compromise (e.g., unknown users or ssh:-2@ entries). After updating, verify the device-mode status and examine logs; if compromised, isolate the router, preserve logs, reset to factory, and recreate configuration from a trusted source rather than restoring backups. The Hacker News reports no victim count or attacker identity and notes that zero-day status remains unverified.

via The Hacker News|

#cert-polska #mikrotik #routeros

technology1 month ago•3 min saved

Plex Urges Immediate Patch to Fix Unnamed Flaws in Media Server and Desktop Apps

Plex is urging users to urgently patch Plex Media Server to version 1.43.3 and Plex Desktop to 1.115.0 after identifying multiple security issues in older releases (pre-1.43.3/1.115.0). CVE IDs have not yet been published; users are advised to update now, with NAS users possibly needing manual installs. The company warned that attackers could reverse‑engineer patches, and while it cites past Plex-related CVEs and data breaches, it provided few details about the current flaws.

via BleepingComputer|

#cve #patch #plex

security1 month ago•5 min saved

PaperCut rolls out second emergency patch to seal auth-bypass and RCE flaws

PaperCut released Emergency Patch Release 2 to address two actively exploited flaws in NG/MF—CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe dynamic class loading leading to remote code execution). The update adds hardening beyond the first patch and is required for NG/MF 24–26; customers should upgrade (and restrict web interface access with firewalls) while investigators track post-exploitation activity and IOCs.

via BleepingComputer|

#authentication-bypass #emergency-patch #papercut

technology1 month ago•1 min saved

PaperCut Zero-Day Exploitation Forces Emergency Patch Across NG and MF

PaperCut warns that attackers are actively exploiting a zero-day flaw in all NG and MF versions, prompting an emergency patch for v25/v26 and ongoing investigation; security indicators include suspicious post-exploitation activity (pc-app.exe) and anomalous server.log entries, with guidance to restrict PaperCut access to trusted IPs; no details on the flaw or attackers yet, though a 2023 CVE was previously exploited by known threat actors.

via The Hacker News|

#cybersecurity #papercut #patch

security1 month ago•4 min saved

Active zero-day exploit hits PaperCut NG/MF; emergency patches and access controls urged

PaperCut warns a zero-day vulnerability affecting all PaperCut NG and MF versions is being actively exploited against customers with internet-facing servers. Emergency patches have been released, and admins are urged to restrict web interfaces to trusted IPs or via firewall rules. The advisory lists indicators of compromise such as unusual activity from pc-app.exe and changes to server.log, but warns that lack of indicators does not guarantee security as the investigation continues and no attacker details or data exfiltration specifics are disclosed.

via BleepingComputer|

#cybersecurity #papercut #patch

markets1 month ago•19 min saved

Broadcom Slumps as VMware Flaw Exploitation Spreads Globally

Broadcom shares slipped about 6% after reports that attackers are exploiting a recently patched VMware vCenter Syslog Server vulnerability; the flaw, deemed critical and patched July 29, could let remote attackers run unauthorized code. A Digital forensics firm linked 361 affected IP addresses across 47 countries, with Germany, the United States, Turkey, Iran and France accounting for over half. Affected systems reportedly began contacting attacker infrastructure on Aug. 3, and researchers say the exploitation includes a reverse SSH tool for persistent remote access.

via Yahoo Finance|

#broadcom #cybersecurity #markets

security1 month ago•3 min saved

Microsoft fixes LegacyHive Windows zero-day after Nightmare Eclipse PoC disclosure

Microsoft issued August Patch Tuesday updates to fix CVE-2026-62832, a Windows User Profile Service zero-day nicknamed LegacyHive that could let an authenticated local attacker load another user's registry hive and gain administrator privileges. The Nightmare Eclipse PoC reportedly required credentials, limiting weaponization, and defenders published Defender detection queries while 0Patch released unofficial patches; several related zero-days remain unpatched.

via BleepingComputer|

#microsoft #security #vulnerability