55
30
55
60
47
55
60
Tenable Fixes Three High
60
55
60
Zyxel Releases Patches for Firmware Vulnerabilities in EoL NAS Models
60
55
30
30
VU#889462: Casdoor authentication server is vulnerable to authorization bypass
Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.
CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.
60
30
60
60
Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.
Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, and Azure components, including two zero-days already exploited in the wild. CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, is flagged as an exploited zero-day. The release includes numerous remote code execution and information disclosure fixes for Microsoft Excel and Word, plus patches for the Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, and Azure CLI.
80
55
60
60
Top 10 Best Device Control & USB Security Tools in 2026
A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.
The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.
12
55
CISA adds 8 vulnerabilities to its Known Exploited Vulnerabilities Catalog
60
30
30
57
30
30
30
60
60
55
55
42
30
Microsoft Patch Tuesday for April 2026
60
30
60