Search: “A Security”

49 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Advisory 82 Exploit / PoC 65 Vulnerability 62 Industry 57 AI safety & security 47 Research 44 Tools 35 Malware 33 Data breach 33 AI industry 26 Threat actor 25 Policy & legal 20 Phishing & fraud 16 AI policy 11

SeverityAll critical 38 high 146 medium 111 low 22 info 257

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputerupdated 00:29 UTC · 8h agofirst Sep 16, 20:39 UTC · 12h agoVulnerability 2 sources

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).

Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.

Tenable BlogSep 15, 21:00 UTC · 1d agoVulnerability

Jenkins Patches 20 Plugin Flaws Leading to RCE, XSS and Credential Theft

Jenkins patched 20 vulnerabilities across 13 plugins, including Groovy sandbox bypasses enabling remote code execution on CI/CD controllers.

Jenkins released security updates on September 16, 2026 for 20 vulnerabilities across 13 plugins, including nine fixes in the Script Security Plugin for Groovy sandbox bypasses. CVE-2026-92127 (classpath abuse) and CVE-2026-92128 (TOCTOU race on remote JAR loading) could allow arbitrary code execution in the controller JVM, exposing build secrets, credentials, and downstream deployment environments. Other flaws include stored XSS in the Warnings, Coverage, OWASP Dependency-Check and Gitee plugins, SSRF in the Gradle and Bitbucket plugins enabling credential capture, credential exposure via CVE-2026-92130, arbitrary file write via CVE-2026-92137, OAuth token theft, and an open redirect in the Keycloak Authentication Plugin. No exploitation is reported; fixes include Script Security Plugin 1422.v06869826dd9b_.

GBHackers06:21 UTC · 2h agoVulnerability CVE-2026-92122 CVE-2026-92123 CVE-2026-92124+17 CVEs

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security NewsSep 15, 15:51 UTC · 1d agoVulnerability CVE-2026-65414 CVE-2026-84607 CVE-2026-64752+7 CVEs1

Critical Check Point Vulnerability Allows Remote Root Code Execution Without Authentication

Check Point patched CVE-2026-91843 (CVSS 9.8), an unauthenticated stack overflow enabling remote root code execution on Security Management and Log Servers.

Check Point issued a high-severity alert for CVE-2026-91843, a critical stack overflow (CVSS 9.8, solution sk1000155) in the unauthenticated login workflow of Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. Successful exploitation grants an unauthenticated remote attacker root-level code execution. Affected releases span R80 through R82.20 with Jumbo Hotfix takes at or below specified levels (e.g., R82.20 Take 44, R81.20 Take 166), with several older versions end of support. A LivePatch is available and offline urgent bundles (R81.20-R82.20 Takes 28-29) were released; Smart-1 Cloud is already protected.

GBHackers05:23 UTC · 3h agoVulnerability 9 sources CVE-2026-918431

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.

Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.

Cyber Security NewsSep 16, 03:01 UTC · 1d agoVulnerability CVE-2026-91721 CVE-2026-91749 CVE-2026-91726+27 CVEs1

Homebrew 7.0.0 is out, here’s what changed for security

Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.

Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.

Help Net SecuritySep 15, 00:47 UTC · 2d agoVulnerability

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · securitySep 16, 22:19 UTC · 10h agoVulnerability 3 sources HN 35↑ · 3 comments CVE-2021-1905 CVE-2018-9568

Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls

Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.

Apache Syncope, an open-source identity management and access governance platform, disclosed CVE-2026-82232, a stacked-query SQL injection in the Task search sort parameter; CVE-2026-77147, a Groovy sandbox escape via malicious Command classes; and CVE-2026-73178, retrieval of signed JWT access tokens via REST enabling impersonation of more privileged users. All three flaws require administrator-level entitlements to exploit and affect Syncope 3.0, 4.0, and 4.1 releases. Fixes shipped in versions 4.0.8 and 4.1.3, with researchers Alon Galili and n0mi1k credited.

Cyber Security NewsSep 16, 13:21 UTC · 19h agoVulnerability 3 sources CVE-2026-82232 CVE-2026-77147 CVE-2026-73178

ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-20242, an unauthenticated deserialization flaw in Cisco Secure Firewall Management Center enabling remote code execution (CVSS 8.1).

ZDI published advisory ZDI-26-709 describing deserialization of untrusted data in Cisco Secure Firewall Management Center's CommandSinkRmi component, tracked as CVE-2026-20242 with CVSS 8.1. Remote attackers can execute arbitrary code on affected installations without authentication. The advisory does not indicate whether exploitation has been observed in the wild.

ZDI Published AdvisoriesSep 16, 05:00 UTC · 1d agoVulnerability 11 sources CVE-2026-20242

We got admin access to Baseten's production GitHub in 25 minutes

Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.

Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.

Hacker News · AISep 15, 18:11 UTC · 1d agoVulnerability HN 51↑ · 12 comments1

Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

Apple patched a record 200+ vulnerabilities in iOS 27 and macOS Golden Gate 27, including 20 kernel flaws; none exploited in the wild.

Apple's iOS 27 and iPadOS 27 releases fix roughly 126 security flaws, 20 of them in the kernel, while macOS Golden Gate 27 addresses 210 vulnerabilities, about 100 shared with the mobile release. macOS Tahoe 26.7 patches 153 unique CVEs, including 26 kernel defects that could cause memory corruption, privilege escalation, system termination, and information leaks. Notable fixes include CVE-2026-64752, a CoreMedia memory corruption flaw allowing iPhone compromise via a malicious image, and CVE-2022-3437, a heap buffer overflow in Heimdal Samba enabling denial-of-service. Apple states none of the patched flaws are known to be exploited in the wild.

SecurityWeekSep 15, 11:06 UTC · 1d agoVulnerability CVE-2022-3437 CVE-2026-647521· 1 read

Cisco Secure Email Gateway SQL Injection Vulnerability

Unauthenticated SQL injection in Cisco Secure Email Gateway email parsing enables root command execution via crafted messages; patches released.

A vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Insufficient validation in the email parsing logic lets a crafted email containing malicious SQL statements achieve arbitrary SQL execution and root command execution. Cisco has released software updates, and the companion September 2026 hardening advisory states this flaw is actively exploited.

Cisco Security AdvisoriesSep 14, 16:00 UTC · 2d agoVulnerability in the wild

The Apple Security Update Review for September 2026

Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.

ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.

Zero Day Initiative BlogSep 16, 19:58 UTC · 13h agoVulnerability in the wildCVE-2026-65400 CVE-2026-65414 CVE-2026-43692+27 CVEs

Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access

WSO2 discloses CVE-2026-5430 (CVSS 10.0), an unauthenticated JWT authentication bypass allowing admin account takeover across its API management products.

WSO2 disclosed CVE-2026-5430, a critical authentication bypass (CVSS 10.0; 9.8 for single-tenant deployments) in advisory WSO2-2026-5328. The flaw stems from insecure JWT processing: tokens signed with unsupported algorithms bypass authentication checks, potentially granting unauthenticated attackers administrative access. Affected products include WSO2 API Control Plane 4.5.0-4.6.0, API Manager 4.1.0-4.6.0, Traffic Manager 4.5.0-4.6.0, and Universal Gateway 4.5.0-4.6.0. Fixes are available via update levels such as API Manager 4.6.0 update 21 or by migrating to unaffected releases.

Cyber Security NewsSep 16, 15:05 UTC · 18h agoVulnerability 3 sources CVE-2026-5430

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security NewsSep 16, 07:45 UTC · 1d agoVulnerability in the wildCVE-2026-627211

Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.

Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.

GBHackersSep 16, 05:00 UTC · 1d agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749+27 CVEs1

Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise

HPE patched critical EdgeConnect SD-WAN flaws, including CVSS 9.8 unauthenticated API bypass and gateway RCE, enabling full system compromise.

HPE Security Bulletin HPESBNW05135 covers critical flaws in EdgeConnect SD-WAN Orchestrator and Gateways: CVE-2026-76669 and CVE-2026-76670 (CVSS 9.9 authorization bypass/privilege escalation), CVE-2026-76672 (CVSS 9.9, leaks third-party API tokens and credentials), CVE-2026-76673 (CVSS 9.8, unauthenticated Orchestrator API authentication bypass granting administrative privileges), and CVE-2026-76674 (CVSS 9.8, unauthenticated buffer overflow enabling arbitrary code execution on gateways). Fixes are available in ECOS 9.7.1.0/9.6.4.0/9.5.9.0/9.4.9.0 and Orchestrator 9.7.1/9.6.4/9.5.9/9.4.11 or later. HPE reported no public exploit code or active exploitation at publication and recommends isolating management interfaces on a dedicated VLAN.

Cyber Security NewsSep 16, 13:14 UTC · 20h agoVulnerability CVE-2026-76669 CVE-2026-76670 CVE-2026-76672+2 CVEs

Chrome, Firefox Updates Patch 115 Vulnerabilities

Google and Mozilla patch 115 vulnerabilities across Chrome 153 and Firefox 156, including three critical Chrome bugs; no exploitation reported.

Google's Chrome 153 (153.0.8010.47/.48 for Windows/macOS) fixes 42 flaws, including three critical: CVE-2026-91726, an out-of-bounds read in WebGL, and use-after-free bugs CVE-2026-91721 and CVE-2026-91749 in Internals and Workers. Mozilla's Firefox 156 resolves 73 vulnerabilities, including 29 high-severity use-after-free and privilege escalation issues, with related fixes in Thunderbird and Firefox ESR branches. Neither vendor reports any of the defects being exploited in the wild.

SecurityWeekSep 16, 10:28 UTC · 22h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749

The GNU C Library security advisories update for 2026-09-14

glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.

The GNU C Library published security advisories including GLIBC-SA-2026-0017, a buffer overflow in strfmon and strfmon_l. Calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc 2.38 to 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters.

oss-securityupdated Sep 16, 20:12 UTC · 13h agofirst Sep 14, 19:54 UTC · 2d agoVulnerability 15 sources1

Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files

Docker fixed two symlink-race flaws in Docker Sandboxes, CVE-2026-77179 and CVE-2026-79994, letting malicious guests escape the workspace and read host files; fixed in 0.42.0.

Docker patched CVE-2026-77179 (Critical) and CVE-2026-79994 (High) in Docker Sandboxes 0.42.0, released September 7. Both are time-of-check-to-time-of-use symlink races: CVE-2026-77179 in the macOS virtio-fs host server (versions 0.28.0 to before 0.42.0) can allow a malicious guest to read or modify arbitrary host files and potentially achieve code execution, while CVE-2026-79994 in the guest-to-host Unix socket relay (0.37.0 to before 0.42.0) can redirect host connections to arbitrary AF_UNIX sockets. Docker recommends upgrading and, as interim mitigation, using clone mode and avoiding read-write host mounts.

GBHackers07:17 UTC · 1h agoVulnerability CVE-2026-77179 CVE-2026-79994 CVE-2026-17106+5 CVEs

Oracle’s September patches put Fusion Middleware back in the hot seat

Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.

Oracle's September 2026 Critical Security Patch Update delivers 673 patches across 17 product families, led by E-Business Suite with 159 fixes and Fusion Middleware with 153. Six CVSS 10.0 vulnerabilities in Access Manager, Forms, Internet Directory, Platform Security for Java, WebLogic Server, and Hyperion are remotely exploitable without authentication, and Oracle reports none exploited in the wild. Now patching monthly, Oracle urged immediate deployment and warned that unsupported releases are not tested for these flaws.

CSO OnlineSep 16, 15:54 UTC · 17h agoVulnerability CVE-2026-71133 CVE-2026-83099 CVE-2026-83059+16 CVEs

TP-Link Cameras 0-Day Vulnerabilities Allow Attackers to Spy on Users

Two zero-day flaws in TP-Link Tapo C200 cameras allowed authentication bypass and denial-of-service; fixed in firmware V5_1.4.6.

OPSWAT researchers Khoi Tran and Thai Do found CVE-2026-15315, an authentication bypass in the Tapo C200's local HTTPS interface that lets network-adjacent attackers replay an authentication value to gain administrator access, and CVE-2026-15316, an unauthenticated denial-of-service in the Wi-Fi onboarding process that crashes the camera's HTTPS service. TP-Link was notified on April 16, 2026, confirmed the flaws on July 10, and released patches on August 18, 2026 in firmware V5_1.4.6. Exploitation requires local network access but no valid account, existing session, or user interaction, exposing live feeds and stored recordings to surveillance risk.

Cyber Security NewsSep 16, 13:27 UTC · 19h agoVulnerability 3 sources CVE-2026-15315 CVE-2026-15316

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security NewsSep 15, 13:52 UTC · 1d agoVulnerability

Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

David Wheeler notes a rosbridge_library quadratic CPU cost flaw was publicly disclosed on oss-security without prior coordination.

In an oss-security reply, David A. Wheeler pointed out that a poster had just publicly disclosed details of a quadratic CPU cost issue in rosbridge_library's Protocol.incoming() JSON fallback path. Wheeler referenced the mailing list's stated norms encouraging public discussion of open-source security flaws. The reply itself contains no fix, CVE, or exploitation details.

oss-securitySep 14, 19:53 UTC · 2d agoVulnerability 3 sources

AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions

Critical SSRF flaw in AWS SSM Agent (CVE-2026-89049) lets authenticated users bypass link-local denylists and reach EC2 Instance Metadata Service for IAM credentials.

CVE-2026-89049 (Critical, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) affects Amazon SSM Agent versions earlier than 3.3.4851.0, with the fix shipping in 3.3.4851.0. The remote-host port-forwarding feature's denylist for link-local addresses can be bypassed because equivalent address representations are not validated, enabling SSRF to restricted endpoints such as the EC2 Instance Metadata Service at 169.254.169.254. An attacker with authenticated AWS access and ssm:StartSession permission could retrieve instance profile IAM credentials and pivot to S3, Secrets Manager, Lambda, or other cloud resources depending on role permissions.

Cyber Security NewsSep 14, 15:14 UTC · 2d agoVulnerability CVE-2026-89049

Re: Retrospective by 'gpg.fail' authors

oss-security follow-up to a gpg.fail authors' retrospective argues that GnuPG's unmaintained, forgotten code is a security liability and should be deleted.

On the oss-security mailing list, Soatok Dreamseeker responds to a retrospective published by the gpg.fail authors, asking why unmaintained code is retained and stating that forgotten, unmaintained code is a liability and effectively unmaintained by definition. The visible reply addresses Werner Koch and concerns GnuPG code maintenance. No specific CVE, flaw, or exploitation is described in this snippet.

oss-securityupdated 03:19 UTC · 5h agofirst Sep 16, 17:16 UTC · 15h agoVulnerability 9 sources1

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.

Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.

SecurityWeekSep 16, 11:32 UTC · 21h agoVulnerability 3 sources CVE-2026-78159 CVE-2026-78006

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security Newsupdated Sep 16, 13:14 UTC · 20h agofirst Sep 16, 09:24 UTC · 23h agoVulnerability 4 sources CVE-2026-90894

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.

Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.

The Register · SecuritySep 15, 21:38 UTC · 1d agoVulnerability CVE-2026-65410 CVE-2026-65409 CVE-2026-43689+10 CVEs

$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.

Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.

SecurityWeekSep 15, 16:00 UTC · 1d agoVulnerability2

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.

A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.

The Hacker Newsupdated Sep 15, 12:19 UTC · 1d agofirst Sep 15, 06:52 UTC · 2d agoVulnerability 2 sources CVE-2026-48172 CVE-2026-54420

Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink

Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.

Stan Ulbrych disclosed CVE-2026-82049 on the Python security-announce list, forwarded to oss-security by Alan Coopersmith. The flaw affects CPython's tarfile extraction filters, which can allow file modification and content disclosure when archives contain a hard link to a symlink. Extraction-filter misuse can therefore bypass intended protections during archive unpacking.

oss-securitySep 14, 18:00 UTC · 2d agoVulnerability CVE-2026-820491

Nintendo Switch Vulnerability Allows Attackers to Run Unauthorized Code on Your Console

Nintendo patched CVE-2026-82079, a CVSS 7.0 stack buffer overflow in original Switch local wireless allowing nearby code execution via QR-code workflows.

Nintendo patched CVE-2026-82079 (CVSS 4.0 base score 7.0, High), a stack-based buffer overflow in the original Switch's local wireless networking affecting firmware earlier than 23.0.0. An adjacent attacker must scan a QR code displayed by the console, via the Album "Send to Smartphone" feature or Mario Kart Live: Home Circuit, before crafted packets can corrupt memory and enable return-oriented programming for arbitrary code execution. EPSS is approximately 0.16%, Switch 2 is not affected, and Nintendo's advisory was published September 10, 2026.

Cyber Security Newsupdated Sep 15, 06:19 UTC · 2d agofirst Sep 14, 16:23 UTC · 2d agoVulnerability 2 sources CVE-2026-82079

New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks

ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.

CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.

Cyber Security NewsSep 14, 13:29 UTC · 2d agoVulnerability CVE-2026-43502

Multiple vulnerabilities in Jenkins plugins

Jenkins releases security fixes for multiple plugins including Bitbucket, GitLab, Gitee, Coverage, and Gradle integrations.

Jenkins published security updates for several plugins, including Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, GitLab Plugin 1.2152.veec0897048b_0, and the Gradle Plugin. The announcement is a routine open-source security release notice without exploit details.

oss-securitySep 16, 15:09 UTC · 18h agoVulnerability 2 sources1

The skb that wasn't freed - the Fragnesia primitive via Open vSwitchnew

Doyensec details CVE-2026-90049 in Open vSwitch, enabling deterministic Linux kernel local privilege escalation on default major distribution installs.

Doyensec reports that the Open vSwitch datapath strips the SKBFL_SHARED_FRAG flag from packets it is still forwarding, allowing an in-place decrypt to write attacker-chosen bytes into root-owned page cache — a Dirty COW-class primitive that re-opens the Fragnesia bug family. The issues are tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977, and were reported to the kernel security team with fixes coordinated alongside OVS maintainers. A deterministic local privilege escalation works on default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL where unprivileged user namespaces and openvswitch auto-loading are enabled; the fix landed in mainline and shipped in stable on 09/04/2026. The write technique builds on the earlier Fragnesia and Dirty Frag bugs, including CVE-2026-43284 and CVE-2026-43500.

Lobsters · security08:39 UTC · 36m agoVulnerability CVE-2026-90049 CVE-2026-89487 CVE-2026-80977+2 CVEs

datasette 0.65.5

Datasette 0.65.5 patches a permission bypass where a trailing newline in a table name could expose private rows (GHSA-h547-rmjf-5m2m).

Datasette 0.65.5 fixes a security issue tracked as GHSA-h547-rmjf-5m2m in which a trailing newline in a requested table name bypassed table permission checks and exposed private rows. The flaw was reported by dpfkdlemtp. The same fix is included in the 1.0a40 alpha release.

Simon WillisonSep 16, 23:51 UTC · 9h agoVulnerability 5 sources

Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories

Stored XSS in Telegram Desktop HTML chat exports (CVSS 8.2) could let attacker-controlled inline keyboard buttons steal full chat histories.

ExPatch researchers Denis and Aleksander Rostilov found a stored XSS in Telegram Desktop's HTML chat export pipeline affecting builds before Beta 6.9.4 and Stable 7.0.1. Unsanitized inline keyboard button text becomes executable JavaScript when a user exports a chat and opens the HTML file in a browser, exposing messages, metadata, and local file paths, and enabling phishing overlays. Telegram patched the issue in commit 8457d13a during July 2026; no CVE had been assigned at disclosure time.

GBHackersSep 15, 10:11 UTC · 1d agoVulnerability

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.

SANS Internet Storm CenterSep 14, 18:33 UTC · 2d agoVulnerability CVE-2022-3437 CVE-2026-20683 CVE-2026-28899+27 CVEs