60
60
Week in review: Sudo local privilege escalation flaws fixed, Google patches actively exploited Chrome
60
Week in review: Veeam Backup & Replication RCE could soon be exploited, Microsoft fixes 4 0-days
60
Week in review: PolKit vulnerability, fake tax apps pushing malware, EU's bug bounty for open source
60
Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs
60
60
60
60
Week in review: KeePass vulnerability, Apple fixes exploited WebKit 0-days
60
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
60
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
60
60
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60
60
60
60
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
60
60
60
60
60
Week in review: 300k+ Plex Media Server instances still vulnerable to attack, exploited Git RCE flaw
60
60
60
Microsoft Patches 570 CVEs in Record Patch Tuesday
60
60
60
60
60
60
60
Critical ArangoDB Bugs Expose Entire Databases and Enable Remote Code Execution as Root
Two critical ArangoDB flaws (CVSS 9.8/9.9) allow unauthenticated API access and root-level code execution; fixed in 3.12.11.
Remedio researchers reported two critical ArangoDB flaws on August 23, 2026: an authentication bypass via URL-encoded underscores (%5f) in path parsing (GHSA-rrgq-978q-36mq, CVSS 9.8) and a task-execution flaw where a client-controlled isSystem flag lets JavaScript run in the internal context (GHSA-rvhw-4hpw-9vrx, CVSS 9.9). Chained, they allow unauthenticated database access, theft of root password hashes, and root-level code execution when arangod runs as root, such as in the official container image. Patches shipped August 31 in ArangoDB 3.12.11, with GitHub Security Advisories published September 6; CVE identifiers were pending at disclosure time.
72
60
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
60
60