Search: “file read”

990 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 5052 Vulnerability 3204 Ransomware 2240 Exploit / PoC 1383 Threat actor 1015 Data breach 1004 Phishing & fraud 481 Policy & legal 473 Industry 242 AI safety & security 156 Research 99 Advisory 78 AI tools & infra 73 Tools 64

SeverityAll critical 4710 high 6748 medium 3030 low 902 info 255

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.

CERT/CC disclosed two unpatched flaws in Kaltura's mwEmbed HTML5 player library, both rooted in unsafe deserialization in mwEmbedLoader.php and exploitable without authentication. CVE-2026-19913 (reporter-scored 9.1) reflects local file contents back via the ServiceUrl parameter, exposing secrets in local.ini; CVE-2026-19912 (reporter-scored 10.0) achieves PHP code execution by writing attacker-controlled objects into web-accessible directories via the uiconf_id parameter. No patch exists and CERT/CC could not reach Kaltura; affected releases include html5lib v2.45, v2.103 and earlier, with the shared multi-tenant CDN hosts also impacted. No exploitation or KEV listing was reported as of August 25, 2026.

The Hacker NewsAug 26, 11:55 UTC · 21d agoVulnerability CVE-2026-19913 CVE-2026-199121

Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs

The Hacker NewsJan 21, 16:08 UTC · Jan 21, 2026Vulnerability CVE-2026-22218 CVE-2026-22219

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GBHackersSep 11, 10:13 UTC · 5d agoVulnerability CVE-2026-85706 CVE-2026-87719 CVE-2026-88765+15 CVEs1

Libbiosig, Tenda, SAIL, PDF XChange, Foxit vulnerabilities

Cisco TalosAug 27, 18:07 UTC · Aug 27, 2025Vulnerability CVE-2025-53518 CVE-2025-52581 CVE-2025-54480+21 CVEs

Vulnerability Spotlight: WAGO products contain remote code execution, other vulnerabilities

Cisco TalosMar 9, 14:47 UTC · Mar 9, 2020Vulnerability CVE-2019-5107 CVE-2019-5134 CVE-2019-5135+9 CVEs

Vulnerability Spotlight: Multiple remote code execution bugs in NitroPDF

Cisco TalosOct 9, 14:10 UTC · Oct 9, 2019Vulnerability in the wildCVE-2019-5045 CVE-2019-5050 CVE-2019-5048+3 CVEs

GitLab’s critical flaw is already drawing internet-wide probes

GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.

GitLab released emergency patches for two high-severity flaws in Community and Enterprise Editions, urging self-managed operators to upgrade immediately while saying its hosted and Dedicated offerings are fixed or unaffected. CVE-2026-85706 (CVSS 10.0) is a path traversal in the repository commits interface that lets unauthenticated attackers read any file on the server and affects releases 18.7 through 19.1.8 plus the 19.2 and 19.3 lines before patching. CVE-2026-87719 (CVSS 9.9, Enterprise Edition only) lets a logged-in Duo Chat user hide a command in a request that triggers Advanced Search settings and password disclosure. WatchTowr Labs reported it is already watching probes that can trigger the path traversal flaw in a single HTTP request, though CISA had not added either issue to the KEV list as of Friday afternoon.

CyberScoopupdated Sep 15, 00:52 UTC · 2d agofirst Sep 11, 18:41 UTC · 5d agoVulnerability in the wild 18 sources CVE-2026-85706 CVE-2026-87719

Fuzzing µCOS protocol stacks, Part 2: Handling multiple requests per test case

Cisco TalosAug 28, 16:00 UTC · Aug 28, 2024Vulnerability in the wild

CVE-2020-3452 flaw in Cisco ASA/FTD exploited within hours after the disclosure

Security AffairsJul 24, 12:51 UTC · Jul 24, 2020Vulnerability in the wildCVE-2020-3452

Vulnerability Spotlight: Two remote code execution vulnerabilities in Investintech Able2Extract

Cisco TalosNov 4, 14:57 UTC · Nov 4, 2019Vulnerability in the wildCVE-2019-5088

Python URL parsing function flaw can enable command execution

Security AffairsAug 12, 16:40 UTC · Aug 12, 2023Vulnerability CVE-2023-243291

U.S. Cybersecurity Agency Lists 2021's Top 15 Most Exploited Software Vulnerabilities

The Hacker NewsMay 9, 02:55 UTC · May 9, 2022Vulnerability CVE-2020-0688 CVE-2019-11510 CVE-2018-13379

Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation

The Hacker NewsNov 11, 10:11 UTC · Nov 11, 2024Vulnerability CVE-2024-7340 CVE-2024-6507 CVE-2024-5565+4 CVEs1

OPC UA security analysis

Kaspersky SecurelistMay 10, 10:00 UTC · May 10, 2018Vulnerability

Vulnerability Spotlight: Multiple vulnerabilities in Pixar OpenUSD affects some versions of macOS

Cisco TalosNov 12, 20:15 UTC · Nov 12, 2020Vulnerability CVE-2020-6155 CVE-2020-13494 CVE-2020-13495+5 CVEs

APT group ToddyCat exploits a vulnerability in ESET for DLL proxying

Kaspersky SecurelistApr 7, 10:01 UTC · Apr 7, 2025Vulnerability CVE-2024-11859 CVE-2021-36276

Vulnerability Spotlight: Pidgin Vulnerabilities

Cisco TalosJun 21, 19:37 UTC · Jun 21, 2016Vulnerability CVE-2016-2365 CVE-2016-2366 CVE-2016-2367+13 CVEs

Cisco released security patches for High

Security AffairsSep 11, 18:56 UTC · Sep 11, 2021Vulnerability CVE-2021-34720 CVE-2021-34718 CVE-2021-34719+2 CVEs

Vulnerability Spotlight: Walt Disney Per-Face Texture Mapping faceInfoSize Code Execution Vulnerability

Cisco TalosJan 26, 16:00 UTC · Jan 26, 2018Vulnerability in the wildCVE-2018-3835

Vulnerability Spotlight: Multiple local vulnerabilities in Pixar Renderman

Cisco TalosMar 7, 14:14 UTC · Mar 7, 2019Vulnerability in the wildCVE-2018-4054 CVE-2018-4055 CVE-2019-5015

Researcher Uncovers 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

The Hacker NewsDec 15, 00:00 UTC · Dec 15, 2025Vulnerability CVE-2025-49150 CVE-2025-53097 CVE-2025-58335+8 CVEs1

Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability CVE-2026-44112 CVE-2026-44113 CVE-2026-44115+1 CVEs

CISA Warns Patched Pulse Secure VPNs Could Still Expose Organizations to Hackers

The Hacker NewsApr 17, 11:20 UTC · Apr 17, 2020Vulnerability CVE-2019-11510

⚡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More

The Hacker NewsDec 2, 05:36 UTC · Dec 2, 2025Vulnerability CVE-2025-59287 CVE-2025-12972 CVE-2025-12970+17 CVEs1

Vulnerability Spotlight: Oracle's Outside In Technology, Turned Inside

Cisco TalosJul 20, 18:40 UTC · Jul 20, 2016Vulnerability CVE-2016-3575 CVE-2016-3581 CVE-2016-3582+1 CVEs

Critical ArangoDB Bugs Expose Entire Databases and Enable Remote Code Execution as Root

Two critical ArangoDB flaws (CVSS 9.8/9.9) allow unauthenticated API access and root-level code execution; fixed in 3.12.11.

Remedio researchers reported two critical ArangoDB flaws on August 23, 2026: an authentication bypass via URL-encoded underscores (%5f) in path parsing (GHSA-rrgq-978q-36mq, CVSS 9.8) and a task-execution flaw where a client-controlled isSystem flag lets JavaScript run in the internal context (GHSA-rvhw-4hpw-9vrx, CVSS 9.9). Chained, they allow unauthenticated database access, theft of root password hashes, and root-level code execution when arangod runs as root, such as in the official container image. Patches shipped August 31 in ArangoDB 3.12.11, with GitHub Security Advisories published September 6; CVE identifiers were pending at disclosure time.

GBHackersSep 9, 12:28 UTC · 7d agoVulnerability1