Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20093 | A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass… | 9.8 | <1% | ||
| CVE-2026-21643 | Unauthenticated SQL Injection to Code Execution in Fortinet FortiClient EMS 7.4.4 | 9.8 | 98% | KEVPoC | KEV |
| CVE-2026-3502 | Arbitrary Code Execution via Unverified Updates in TrueConf Client | 7.8 | 6% | KEV | KEV |
| CVE-2026-35616 | Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6 | 9.8 | 94% | KEVPoC | KEV |
| CVE-2026-5281 | Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution | 8.8 | 14% | KEV | KEV |
From the original article
9 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Financial groups lay out a plan to fight AI identity attacks Generative AI tools have brought the cost of deepfake production low enough that criminals and state-sponsored actors now use them routinely against financial institutions.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.