Vulnerabilities — Page 3
Japan's data leak surge points at mobile app APIs and unpatched Metabase
JPCERT/CC says attackers are hitting mobile app back ends and known software flaws. A fresh Metabase advisory names the kind of bug being abused.
Dell patches a critical flaw in its server update tool that hands attackers root
A path traversal bug in Dell System Update, rated 9.6, lets an unauthenticated attacker take over the machine. Dell says upgrade to 2.3.0.0 now.
Rapid7 Caught Hackers Hitting SonicWall Remote Access Boxes Before the Patch
A perfect-10 flaw in SonicWall's SMA1000 gateways was already under attack when the vendor shipped its July 14 hotfix. Here is what the filing actually says.
A single bad character can crash a vLLM server, and the fix is still pending
A moderate-severity flaw in the popular AI serving engine lets any logged-in user kill the whole process with one malformed request.
One flaw, eight Atlassian products, no login required
A critical file-access vulnerability published this month lets anyone on the internet read files inside Atlassian's most trusted enterprise tools without ever signing in.
A Fresh Citrix Zero-Day Is Already Being Exploited, and Federal Agencies Have Three Days to Fix It
CVE-2026-88779 hit live networks almost immediately after Citrix shipped patches for two earlier flaws, leaving IT teams scrambling again.
A 9.8-severity hole in industrial email code puts water and energy gear at risk
A buffer overflow in the lwIP SMTP client could let an unauthenticated attacker crash or hijack equipment running in energy and water systems. A patch is available.
Two Open-Source Bugs Force Patch for Hitachi Energy's REB500 Grid Relay
A pair of flaws in a widely used XML parser could let an insider knock Hitachi Energy's protection relay offline. The fix is version 8.3.4.0.
Langflow's Built-In Testing Tool Has No Password and Attackers Are Using It Right Now
Three critical flaws in the popular AI workflow builder let attackers run any code they like on your server, as root, without logging in. CISA ordered federal agencies to patch by May 26. Attackers are not waiting.
AI Is Cutting the Time Criminals Need to Turn a Known Bug Into a Working Attack
Exploitation of already-patched flaws is outpacing zero-days, CVE volumes are on track to hit 96,000 this year, and the window between public disclosure and first attack has shrunk to 80 days.
ShinyHunters Claims a Second PeopleSoft Zero-Day, and Oracle Has Said Nothing
A known criminal group says it used an unpatched Oracle flaw to break into FBI systems. The first PeopleSoft vulnerability is already being actively exploited. A possible second one has no patch, no CVE, and no vendor comment.
A Broken Cryptographic Check in SWIFT's Login Tool Handed Attackers Full PC Control
A homemade RSA verification routine in Thales Group's SConnect software left SWIFT banking access, Qatar's national identity system, and the Swedish Tax Agency open to silent drive-by attacks. The patch is out. Most users haven't moved.
Attackers Are Hunting a Rejetto HFS Flaw That an AI Model Found First
A session-cookie bug uncovered with Anthropic's Project Glasswing is now drawing live exploitation attempts against Rejetto's file server.
Citrix NetScaler Zero-Day Is Knocking Login Systems Offline
A memory flaw in NetScaler ADC and Gateway, now exploited in the wild, can crash the gateways many companies rely on for single sign-on. US federal agencies have three days to patch.
Fortinet FortiMail Has a Critical Zero-Day Being Exploited and No Patch Yet
A vulnerability scored 9.8 out of 10 in Fortinet FortiMail lets attackers write files to affected servers without logging in. Fixes are not out yet. US federal agencies had until 4 October 2026 to apply workarounds.