SeverityCritical briefings
Only the stories rated critical: the flaws to patch first.
ICS Patch Tuesday: Siemens, Schneider, Rockwell Fix Critical Flaws in July 2026
Siemens leads July's ICS Patch Tuesday with a maximum-severity authentication bypass in Opencenter X, while Rockwell and Schneider Electric address critical and…
SAP Patches Critical CVSS 9.9 NetWeaver Flaw Among 16 July Fixes
SAP's July 2026 patch batch closes three critical vulnerabilities in NetWeaver, Approuter, and Commerce Cloud, headlined by a near-maximum-severity memory corruption bug…
SonicWall SMA1000 Zero-Days Under Active Attack, CISA Sets Federal Patch Deadline
SonicWall confirms two SMA1000 vulnerabilities, including a maximum-severity SSRF flaw, are being exploited in the wild. CISA has added both to its…
Microsoft’s July Patch Tuesday Sets Record With 622 Fixes, Two Zero-Days Under Attack
Microsoft's largest security update on record addresses 622 vulnerabilities this month, including actively exploited flaws in Active Directory Federation Services and SharePoint…
Critical Joomla Extension Flaws Under Active Exploitation, CISA Adds to KEV
Unauthenticated file upload vulnerabilities in the Balbooa Forms and iCagenda Joomla extensions, both scoring a maximum CVSS of 10, are being exploited…
Attackers Exploit Critical Auth Bypass in Gitea’s Official Docker Image
A misconfigured default in Gitea's Docker image lets unauthenticated attackers impersonate any user, including admins, and exploitation began before public disclosure.
Critical Zimbra Classic Web Client Flaw Lets Emails Execute Malicious Code
Zimbra is pushing urgent updates for a critical stored XSS vulnerability in its Classic Web Client that lets specially crafted emails run…
Zimbra Patches Critical XSS Flaw in Classic Web Client After Google TAG Report
Zimbra has released version 10.1.19 to fix a critical stored XSS vulnerability in its Classic Web Client, flagged by Google's Threat Analysis…
Injective Labs npm SDK Backdoored to Steal Crypto Wallet Keys
Attackers compromised a contributor's GitHub account to publish a malicious version of the @injectivelabs/sdk-ts package, silently harvesting private keys and seed phrases…
GigaWiper Backdoor Combines Disk Wiping, Fake Ransomware, and Spyware
Microsoft has analyzed a modular Windows backdoor called GigaWiper that fuses three distinct destructive capabilities into a single operator-controlled toolkit.
Chrome 150 Patches 27 Vulnerabilities, Including Two Critical Flaws
Google's Chrome 150 update addresses 27 security vulnerabilities, with two critical use-after-free bugs in the Ozone and Views components leading the list.…
Prompt Injection Flaw in GitHub Agentic Workflows Can Expose Private Repos
A vulnerability dubbed GitLost allows unauthenticated attackers to leak private repository contents by hiding malicious instructions inside a public GitHub Issue, requiring…