SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Astrana Health Discloses Data Breach After Social Engineering Attack
Attackers impersonated Astrana Health staff and spoofed the company's phone number to trick employees, gaining access to servers and exfiltrating private and…
New RemControl Android Trojan Hijacks Banking Apps Across Europe and Canada
A new malware-as-a-service platform called RemControl is spreading through fake TVTap IPTV apps, using Accessibility Service abuse and AI-crafted phishing overlays to…
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Remote Code Execution
F5 has fixed a critical zero-day in BIG-IP Access Policy Manager that attackers used to achieve unauthenticated RCE, prompting CISA to order…
Sweden Fines Miljödata $183,000 Over Breach Hitting 2.2 Million Residents
Swedish regulator IMY says the HR software provider failed to vet new software installs and lacked real time intrusion monitoring ahead of…
CISA Orders Federal Agencies to Patch Exploited Zyxel Switch Flaw by Thursday
A stack-based buffer overflow in Zyxel GS1900 series switches is being actively exploited to steal data, prompting CISA to add the bug…
BigCommerce Merchants Hit by Data Breach Tied to Compromised Ribon App Keys
Attackers stole credentials for the third-party Ribon apps and used them to inject malicious scripts and access shopper data across multiple BigCommerce…
CISA: Three Linux Kernel Flaws Under Active Attack, One Critical
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, including a 14-year-old race condition and a critical TLS flaw,…
Critical Pre-Auth RCE in Orkes Conductor Exploited in the Wild
Fortinet warns that a critical unauthenticated remote code execution flaw in the Orkes Conductor workflow platform is being actively exploited, putting unpatched…
Maximum-Severity Cisco ISE Auth Bypass Added to CISA’s Exploited Vulnerability List
A perfect 10.0 CVSS flaw in Cisco Identity Services Engine is being actively exploited in the wild, prompting CISA to order federal…
Public Exploits Released for Four Linux Kernel Local Root Flaws
A researcher has published working exploit code for four separate Linux kernel vulnerabilities that allow a local user to escalate to root,…
Gyazo Breach Exposes 23.6 Million User Records After Server Flaw Exploited
Attackers exploited a vulnerability in Gyazo's image upload server to access a database containing tens of millions of user records and hundreds…
Cisco Patches Max-Severity ISE Zero-Day Under Active Exploitation
A CVSS 10.0 authentication bypass in Cisco Identity Services Engine and ISE-PIC is being actively exploited, letting unauthenticated attackers gain root-level access…