SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Check Point Patches Critical Root RCE Flaw in Management Servers
An unauthenticated attacker could exploit a buffer overflow in the login process of Check Point's Security Management and Log Servers to gain…
Google Patches Actively Exploited Pixel Modem Zero-Day, CISA Mandates Fix
A high-severity, zero-click flaw in the Pixel's cellular modem was exploited in targeted attacks before Google shipped a fix, prompting CISA to…
Windows 11 KB5124008 Update Breaks Domain Trust for Enterprise Devices
Microsoft is investigating reports that the KB5124008 security update severs the secure channel between domain-joined Windows 11 PCs and Active Directory, locking…
Windows Server 2022 Mainstream Support Ends October 13, 2026
Microsoft is reminding administrators that Windows Server 2022 exits mainstream support next month, shifting to extended security-only updates through October 2031.
Attackers Exploit WooCommerce Plugin Flaw to Plant PHP Web Shells
A critical unauthenticated file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin is being actively exploited to drop PHP backdoors on WordPress…
CenterPoint Energy Confirms Breach After Hacker Leaks 7.5M Customer Records
The Houston-based utility confirmed an unauthorized party accessed customer data through an external-facing system, days after a threat actor leaked an archive…
Japan’s Digital Agency: VPN Flaw Breach Exposed 246,000 Personnel Records
An attacker exploited a medium-severity, non-zero-day VPN vulnerability to access Japan's Government Solution Service, potentially exposing names, emails, phone numbers, and addresses…
Telus Notifies Customers of Account Takeovers Tied to Compromised Credentials
Canadian telecom giant Telus is warning consumer customers that attackers used stolen credentials to access accounts and personal data, then tried to…
CISA Confirms Active Exploitation of Max-Severity GitLab Flaw
Attackers are exploiting a critical unauthenticated path traversal bug in GitLab's repository commits API just days after a patch shipped, prompting CISA…
China-Linked Hackers Exploit Sogou Input Method Flaw to Drop GrayRabbit Backdoor
A one-click RCE bug in Tencent's Sogou Input Method for Windows let the UNC3569 threat group chain three flaws into full code…
Dutch NCSC Warns of Imminent Attacks on Critical Check Point VPN Flaws
Two unauthenticated remote code execution bugs in Check Point's VPN stack have patches available, and the Netherlands' national cyber agency says exploitation…
CISA Flags Active Exploits in JFrog and ConnectWise as GitLab Rushes Critical Patch
CISA added three actively exploited flaws in JFrog Artifactory and ConnectWise ScreenConnect to its KEV catalog, while GitLab pushed emergency fixes for…