60
60
60
60
60
60
60
60
60
60
60
60
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
60
60
60
60
Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs
60
Week in review: Cisco SD-WAN 0-day exploited, Patch Tuesday forecast
60
60
60
GitLab urges users to patch max severity path traversal flaw
GitLab urges self-managed users to immediately patch a maximum-severity path traversal flaw (CVE-2023-2825) enabling unauthenticated arbitrary file reads.
GitLab released patches in CE/EE versions 19.3.2, 19.2.6, and 19.1 for CVE-2023-2825, a maximum-severity path traversal vulnerability that lets unauthenticated attackers read arbitrary files from vulnerable servers under certain conditions. The flaw, reported by researcher s3ntago via HackerOne, stems from improper path confinement and missing authentication enforcement in the repository commits API. GitLab also patched CVE-2026-87719, an insecure deserialization flaw in the GraphQL subscription serializer affecting Enterprise Edition users with Duo Chat access, which could expose credentials and Advanced Search configurations. GitLab.com and Dedicated customers are already protected; the platform has over 30 million registered users and is used by more than 50% of Fortune 100 companies.
65
SAP Patches Critical Extended Passport Processing Vulnerability
SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.
CVE-2026-44756 is a CVSS 10.0 memory corruption flaw in Extended Passport (EPP) deserialization, triggered when a user session opens across web, SAP GUI, and RFC vectors. Exploitation yields command execution as the SAP OS account, database credential and password hash recovery, session reading, and data or binary modification; affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, and BW/4HANA. Three other criticals were patched: CVE-2026-58240 (S4GET, missing authentication affecting all S/4HANA 2025 and earlier releases), CVE-2026-76969 (CAP credential disclosure), and CVE-2026-66768 (NetWeaver access control). Onapsis and SAP report no indicators of in-the-wild exploitation.
80
60
60
60
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
60
60
60
Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited
60
60
Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs
60
60
Microsoft Patches 130 Vulnerabilities, Including Critical Flaws in SPNEGO and SQL Server
60
60
Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero
60
60
Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server
60
URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero
60
60