Vulnerabilities — Page 24
What Is Really Inside Your Work Apps? Lookout's New Tool Aims to Tell You
A new scanning service from mobile security firm Lookout builds detailed ingredient lists for enterprise apps, exposing hidden vulnerable components before criminals can exploit them.
Hackers Hit Unpatched Fastjson Bug in Spring Boot Apps, No Fix Yet
CVE-2026-16723 lets attackers run code on vulnerable Java servers without a password. Alibaba scores it 9.0. No patch is available.
GitLab Flaw Lets Any Logged-In User Run Commands on Self-Hosted Servers
Researcher Yuhang Wu published working exploit code against GitLab 18.11.3 that hijacks the server through two booby-trapped notebooks and a diff request.
Rockwell Automation Fixes Four Code-Execution Bugs in Arena Simulation Software
A booby-trapped file is all it takes to trigger the flaws. Defence contractors, hospitals and supply-chain firms all run the software.
A Single Default Setting in Azure Automation Could Have Let Hackers Steal Any Tenant's Cloud Identity
A researcher found that Microsoft's cloud automation service was, by default, leaving account identities visible to the public internet, giving any attacker a path to impersonate other organisations' privileged accounts.
Vatican Prayer App Left 700,000 Users' Names and Emails Exposed for Anyone to Grab
A basic security blunder on the Catholic Church's official Click to Pray app meant that anyone with a browser could pull the personal details of every registered user, no hacking skills required.
Certighost: New Exploit Turns Ordinary Windows Users Into Domain Controllers
A public proof-of-concept lets any low-privileged Active Directory account impersonate a domain controller and retrieve the master key to every user's login on the network.
Three Security Stories You May Have Missed: Industrial Switches, Russian Email Spying, and a Rail Ransomware Shakedown
Flaws in Siemens industrial network hardware, a Russian espionage campaign targeting Zimbra webmail servers, and a ransomware extortion attempt against Swiss train maker Stadler Rail.
A Weaponised SVG File Let Researchers Run Commands on Bing's Own Servers
Security testers at XBOW uploaded a booby-trapped image to Bing's image search and ended up with full control over Microsoft's image-processing machines. Two critical patches followed.
Redis Patches Four Code-Execution Bugs After AI Agent Finds Zero-Days
Seven security releases went out on July 23 after researchers used Moonshot AI's Kimi K3 agents to uncover authenticated remote code execution chains in stock Redis builds.
AI Scanner Finds Eight Serious Bugs in NodeBB Forum Software
Aikido Security's automated code review turned up admin takeover and private-message flaws in six hours. All eight are patched in version 4.14.2.
CISA orders three-day fix as Clop hits PTC Windchill flaw
A critical bug in PTC's product design software, CVE-2026-12569, is being used by the Clop extortion crew to steal corporate data. Regulators in the US and Germany moved fast.
Check Point's Admin Console Has a Critical Flaw That Hands Attackers the Keys to Everything
A security hole in Check Point's management software lets criminals log in without a password and rewrite the rules of an entire network. Ten organisations have already been hit.
A Hidden Linux Flaw Lets Any Local User Seize Full Control of a Machine
A race condition buried in the Linux XFS filesystem since 2017 can hand a regular user complete administrative control. Patches are out. Reboots are required.
Can You Still Patch Your Way to Safety? Why the Old Playbook Is Breaking Down
Artificial intelligence can now turn a published vulnerability description into a working attack faster than most IT teams run their patch cycles. That changes the math for every organisation still relying on traditional schedules.