SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Chrome 150 Patches 27 Vulnerabilities, Including Two Critical Flaws
Google's Chrome 150 update addresses 27 security vulnerabilities, with two critical use-after-free bugs in the Ozone and Views components leading the list.…
CISA Orders Federal Agencies to Patch Actively Exploited Langflow Auth Bypass
CISA has added a Langflow authorization bypass flaw to its KEV catalog and given federal civilian agencies until Friday to apply patches,…
Critical Gitea Auth Bypass Flaw Under Active Exploitation
A critical vulnerability in Gitea's Docker images allows attackers to impersonate any user with a single HTTP header. Exploitation began just 13…
Januscape: 16-Year-Old Linux KVM Flaw Enables VM Escape on Intel and AMD
A use-after-free bug in the Linux kernel's KVM shadow MMU lets an attacker with guest root access execute code on the host,…
Hidden Backdoor in Tenda Router Firmware Grants Admin Access
A hardcoded secondary authentication mechanism in multiple Tenda router firmware versions allows any attacker who knows the backdoor password to gain full…
BeyondTrust Patches Critical Auth Bypass Flaws in RS and PRA Software
BeyondTrust has disclosed two critical authentication bypass vulnerabilities in its Remote Support and Privileged Remote Access products, urging self-hosted customers to apply…
PoC Exploit Released for Linux ‘Bad Epoll’ Root Privilege Escalation Bug
A public proof-of-concept exploit now targets a race-condition use-after-free flaw in the Linux kernel's epoll subsystem, enabling unprivileged local attackers to gain…
Exploit Attempts Hit Gitea Docker Flaw CVE-2026-20896 Within Two Weeks of Patch
Threat actors are actively probing a critical Gitea Docker vulnerability that allows unauthenticated clients to gain elevated access by spoofing a trusted…
16-Year-Old Linux KVM Flaw Allows Guest VMs to Escape to Host
A use-after-free vulnerability in Linux's KVM hypervisor, present in shared shadow MMU code for both Intel and AMD x86 systems, can be…
Opera GX Flaw Allowed Malicious Sites to Silently Install Data-Stealing Mods
A vulnerability in the gaming-focused Opera GX browser let attacker-controlled websites auto-install a browser add-on and extract data from pages the victim…
Google Project Zero Found Nine Bypasses in Windows Administrator Protection
A Google Project Zero researcher identified nine separate vulnerabilities in Windows 11's new Administrator Protection feature before its release, all of which…
ABB Freelance Security Lock Flaw Lets Attackers Bypass ICS User Management
A keyboard shortcut weakness in ABB Freelance Security Lock allows local attackers to sidestep the Freelance Operations kiosk layer and reach underlying…