SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Drupal Commerce Core Flaw Under Active Exploitation, Patch Now
A highly critical access bypass in Drupal's Commerce Core module is being exploited against online stores, letting unauthenticated attackers manipulate orders on…
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall Flaws to KEV
CISA has flagged a maximum-severity GitLab integer overflow vulnerability and a Cisco firewall denial-of-service flaw as actively exploited, ordering federal agencies to…
Sony’s Japanese ISP So-net Breached, 2.6 Million Subscriber Records Stolen
Attackers broke into the So-net member database in mid-October, exposing personal details of current and former So-net and Plala subscribers along with…
Microsoft Fixes Remote Desktop Failures Tied to Administrator Protection
A known issue that blocked non-admin users from Remote Desktop connections when Administrator protection was enabled has been resolved in the October…
Cisco Patches Second Exploited ASA/FTD VPN Zero-Day Since August
Cisco has fixed an actively exploited, unauthenticated denial-of-service flaw in Secure Firewall ASA and FTD's SSL VPN service, the second such zero-day…
GoAhead Web Server TLS Bugs Let Revoked Certificates Still Authenticate
Embedded web server GoAhead loaded certificate revocation lists in its OpenSSL backend but never enforced them, letting revoked mutual-TLS client certificates pass…
Microsoft Sets Final Countdown on SMS and Voice Auth for Entra ID
Microsoft is again urging Entra ID admins to move users off SMS and voice MFA before Microsoft-provided telecom delivery for those methods…
Microsoft Ships Emergency Windows Updates to Distrust eMudhra CA Certificates
Out-of-band patches KB5134133 and KB5134125 strip trust from seven eMudhra-linked certificates after weak intermediate CA keys were found recoverable in seconds.
Genesys Confirms Breach of Internal Systems, Customer Business Data Exposed
Customer experience software vendor Genesys says attackers accessed its internal learning management and CRM systems, exposing business contact and account data, though…
Critical Wasmtime Flaws Could Let WebAssembly Modules Break Out of Their Sandbox
Wasmtime maintainers have patched two critical vulnerabilities that could allow a malicious WebAssembly module to escape the runtime's sandbox, with one flaw…
Siemens Patches Path Traversal, Password Leak in S7 Webserver API Library
Two vulnerabilities in Siemens' .NET Client Library for SIMATIC S7 Webserver API could let attackers write files outside intended directories or recover…
eMudhra to Quit Global SSL/TLS Market After Guessable CA Keys Found
Indian certificate authority eMudhra will exit the global SSL/TLS certificate business after a researcher recovered private keys for eight of its intermediate…