Vulnerabilities — Page 2
PAN-OS VPN Flaw Is Being Exploited Right Now
Palo Alto Networks confirms hackers are abusing a login bypass in its GlobalProtect VPN. A small number of attempts have succeeded.
Next.js Pushes Emergency Fix for Two Critical Holes That Let Attackers Run Code
The React framework behind a huge slice of the modern web shipped out-of-band patches on October 14 for flaws in its server rendering layer and SVG image handling.
Palo Alto Firewall Flaw Gives Attackers Root Control: Federal Agencies Have Three Days to Fix It
A code injection bug in PAN-OS is already being exploited in the wild. US federal agencies must patch or pull the plug by October 17, and every other organisation running the affected hardware should treat this as urgent.
Cisco patches two critical email gateway bugs that let a single message take over the box
Attackers can send a booby-trapped email through a Cisco Secure Email Gateway and gain root. No login required, no workaround available.
Attackers plant web shells on Nextcloud servers through Collabora CODE app flaw
A bug in Nextcloud's built-in Collabora Online CODE Server lets attackers run commands as the web server user. Admins started reporting live attacks on September 10.
A curl bug let a hostile server hijack the uploader, and someone proved it
CVE-2026-92392 turns a memory bug in curl's HTTP/2 upload code into client-side code execution. The fix landed in curl 8.23.0 on October 14.
Ivanti's VPN Appliances Are Being Broken Into Without a Password
A flaw in Ivanti Connect Secure lets attackers walk straight past the login screen and run commands on corporate network gateways. Federal agencies face a legally binding patch deadline.
AI Agents Built a Working Chrome Attack in Six Days. Google Paid $250,000.
A research team at XBOW used a public OpenAI model to find three unknown Chrome flaws and chain them into a one-click takeover. Google shipped the fix in Chrome 152 alongside hundreds of other security patches.
A Linux Kernel Bug Called Vghost Lets a Guest VM Reach Into the Host
CVE-2026-74580 sits in the vhost subsystem and survived almost a decade of kernel releases. Tencent's Zhuque Lab found it with help from an AI tool.
Hackers defrosted hundreds of French supermarket fridges overnight
Criminals triggered the defrost cycle on refrigeration controllers at hundreds of French stores. A Danfoss authentication bug patched in May is the obvious suspect.
SAP's Python SDK for Business Cloud Had a Hole That Leaked Login Keys
A flaw rated as serious as they come let attackers trick SAP's Cloud SDK for Python into handing over OAuth2 client credentials. Patch is in version 0.45.2.
GitLab Rushes Out Patch for Flaw That Let Strangers Run Code on the Server
The October 12 release fixes a maximum-severity bug in Community and Enterprise Edition. Self-managed installs need to update now.
MarkLogic Patches 31 Database Flaws, Two Let Junior Admins Seize the Whole Server
Progress Software has shipped fixes for a batch of MarkLogic Server bugs, including two that turn a limited management account into a full administrator.
SonicWall SMA1000 Flaw Rated Perfect 10 Is Already Under Attack
A critical security hole in SonicWall's remote-access appliances was being exploited within 48 hours of the public fix. What that means and what to do now.
Atlassian warns of critical file-access flaw across every Data Center product
A new vulnerability lets strangers read sensitive files on self-hosted Atlassian servers, and attackers tend to move fast on bugs like this one.