Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,191 stories synthesized.
A critical SQL injection vulnerability (CVE-2026-67401) in cPanel's EmailTrack functionality allows authenticated attackers to gain root-level control of servers, enabling arbitrary file creation and code execution.
A new evaluation ranks the top 10 application control and allowlisting tools, highlighting their critical role in combating ransomware and unknown malware by enforcing strict execution policies.
A comprehensive review highlights the top 10 patch management software solutions for 2026, emphasizing Automox, Tanium, and Action1, while cautioning buyers about the inherent risks of the tools themselves.
Over 3,500 internet-facing Redis servers have been compromised and repurposed by attackers to mine Monero cryptocurrency, exploiting weak authentication configurations.
The latest Risky Business podcast episode covers a massive IDScan data breach, potential US government plans for private military hacking, and accusations of China distilling US AI models.
Tencent's Zhuque Lab has launched AI-Infra-Guard, an open-source security scanner designed to identify vulnerabilities and risks within artificial intelligence systems.
Key findings • Two critical heap-based buffer overflow vulnerabilities in image decoders (CVE-2026-21095, CVE-2026-21096) allow remote code execution. • Multiple vulnerabilities across system…
A critical integer overflow vulnerability in Oracle Outside In Technology's PDF parsing component allows remote code execution, tracked as CVE-2026-60392.
A denial-of-service vulnerability in Backblaze Personal Computer Backup allows local attackers with low-privileged code execution to overwrite arbitrary files and crash the service.
A critical remote code execution vulnerability (CVE-2026-70477) in the Flowise low-code LLM application builder allows unauthenticated attackers to execute arbitrary code.
A vulnerability in Oracle VirtualBox's VirtioSCSI implementation could allow local attackers to disclose sensitive information on a guest system.
Zero Day Initiative has disclosed a critical remote code execution vulnerability in GIMP, stemming from an integer overflow in its PSP file parsing component.
A heap-based buffer overflow in Oracle Outside In Technology's PostScript file parsing enables remote code execution, with a CVSS score of 7.8.
A critical vulnerability in NI LabVIEW allows remote attackers to disclose sensitive information through a flaw in VI file parsing, requiring user interaction to exploit.
A critical vulnerability in Progress Software's Kemp LoadMaster allows authenticated attackers to execute arbitrary code due to an uninitialized memory flaw.
A race condition in Oracle VirtualBox's VMSVGA component enables local privilege escalation within guest systems, requiring prior high-privileged code execution.
A critical use-after-free vulnerability in the Linux Kernel's IPv6 multicast routing functionality allows local privilege escalation, ZDI reports.
A critical vulnerability in Microsoft Azure Entra ID's OAuth Device Code Grant allows unauthenticated remote attackers to disclose sensitive organizational information.
Google Chrome 153 addresses 230 vulnerabilities, including CVE-2026-87491, a medium-severity out-of-bounds write in the V8 engine exploited in the wild.
Key findings • Eleven Huawei vulnerabilities disclosed on September 9, 2026, span graphics, input, and permission control modules. • High severity flaws include DoS in input device module (CV…
BleachBit 6.0.4 resolves a significant bug in its secure file deletion feature on Windows, ensuring that fragmented files are now completely overwritten.
Key findings • 16 vulnerabilities disclosed simultaneously in Tanium Comply on September 9, 2026. • Flaws include improper access controls, SQL injection, path traversal, and unauthorized cod…
Key findings • Google Chrome 153.0.8010.36 patches 25 vulnerabilities disclosed on September 9, 2026. • Batch includes critical flaws like buffer overflows, use-after-free, and out-of-bounds …
Key findings • 25 vulnerabilities in Chromium disclosed on September 9, 2026, patched in Chrome 153.0.8010.36. • Batch includes critical flaws like use-after-free, out-of-bounds writes, and t…