Vulnerabilities — Page 25
Russian Hackers Are Reading Your Email Just by Sending You One: Zimbra Zero-Day Explained
A Kremlin-linked crew tracked as LAUNDRY BEAR is exploiting CVE-2025-66376 in Zimbra webmail to steal 90 days of email the moment a victim opens a booby-trapped message.
Old Linux Bug 'RefluXFS' Hands Root to Anyone With a Shell on Default Red Hat Servers
A nine-year-old flaw in how Linux handles the XFS filesystem lets any local user become the all-powerful root account on default installs of Red Hat, Fedora and Amazon Linux.
Hackers Are Actively Exploiting a Flaw in Check Point Security Software
A newly discovered hole in Check Point's network management tools let attackers log in as administrators without a password. Real attacks were already happening before the patch arrived.
Check Point Rushes Fix for SmartConsole Flaw Already Being Exploited
A critical authentication bypass in Check Point's management console let attackers walk past the login screen. The vendor confirms real-world attacks are already happening.
What is a CVE and how does vulnerability scoring work?
CVEs are the universal ID system for software flaws, and CVSS scores tell you how bad each one actually is.
What is a zero-day vulnerability? A plain-English guide
Zero-days are unpatched security flaws the software vendor doesn't know about yet, making them among the most dangerous bugs in existence.
Microsoft Wants You to Patch in Three Days. Security Teams Say That's Not How It Works.
Microsoft is telling IT administrators to apply security fixes within 72 hours, citing AI tools that find and exploit software flaws faster than ever. Experts agree on the threat. They disagree, sharply, on whether three days is workable.
Fake Bahrain Alert App Spreads Android Surveillance Malware
A fake emergency alert app is exploiting Gulf tensions to plant a four-stage spyware platform on Android devices.
Critical Ubuntu Flaw Allows Local Users Full Control
Security researchers reveal a serious vulnerability in Ubuntu's snap-confine that could let local users gain root access on default desktop installs.
Oracle's Largest Patch Update Fixes Hundreds of Vulnerabilities
Oracle's July 2026 Critical Patch Update is its biggest ever, with ten perfect-10 flaws in Fusion Middleware and a 9.9-scored hole in the flagship database product.
Eclypsium launches InfraTrust to flag the infrastructure flaws no one is patching
A new knowledge base and monthly report from firmware security firm Eclypsium aims to tell defenders which router, firewall and server bugs to fix first.
A Browser Extension Installed 300 Million Times Had a Flaw That Let Attackers Steal Your WhatsApp Messages
A security hole in Adobe's widely used browser extension meant that simply visiting the wrong website could hand criminals your private messages and contacts.
Windmill Path Traversal Flaw Under Active Attack, VulnCheck Warns
CVE-2026-29059 lets unauthenticated attackers read files from servers running the open-source developer platform. Patch guidance and exploitation details below.
Adobe's Acrobat Chrome extension leaked WhatsApp Web chats to any website you visited
Researchers at Guardio Labs found a chain of flaws, tracked as CVE-2026-48294, that let any web page silently read messages, contacts and chat lists from WhatsApp Web. Adobe patched the extension within two days.
US government orders emergency fix for Langflow AI tool after hackers exploit it in the wild
CVE-2026-0770 lets attackers take over Langflow servers without a password. Federal agencies have until Friday to patch.