#vulnerability

oss-security3h ago

CVE-2026-124312: VVdeC/vvdecapp: Heap Out-of-Bounds Read in CodingStructure::getColInfo with a Smaller Collocated Picture

oss-security3h ago

CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont

Canadian Centre for Cyber Security26d ago

BMC Helix security advisory (AV26-1059)

Canada's Cyber Centre says BMC Helix Network Management before 26.3.01 is vulnerable and urges updates.

oss-security26d ago

CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env

Apache Kylin CVE-2026-68572 allows unauthorized SQL execution in the Spark SQL environment.

Wordfence27d agohigh

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.

Canadian Centre for Cyber Security27d ago

SonicWall security advisory (AV26-1048)

Canada’s Cyber Centre urges patches for multiple flaws in SonicWall NSM On-Prem 4.3.1 and earlier.

Full Disclosure27d ago

[0day-rubbish] Abyss Web Server X1 2.16.22.0 first-run console credential takeover to configuration-write log-as-CGI command execution (7.5)

Researchers disclosed a command-execution chain in Aprelium Abyss Web Server X1 2.16.22.0 before console password setup.

The Hacker News28d agohigh

Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

XBOW researchers used GPT-5.6 Sol to chain three Chrome bugs into remote code execution, now patched.

Canadian Centre for Cyber Security29d agohigh

Ivanti security advisory (AV26-1035)

Canada flags Ivanti flaws after CISA added Connect Secure CVE-2026-104935 to the KEV catalog.

Canadian Centre for Cyber Security29d ago

JetBrains security advisory (AV26-1032)

Canada's Cyber Centre says JetBrains Exposed before 1.5.1 is vulnerable and should be updated.

Canadian Centre for Cyber Security29d ago

Progress security advisory (AV26-1031)

Canada's Cyber Centre warns Progress MarkLogic before 11.3.7 and 12.1.0 needs security updates.

ZDI Published Advisories29d ago

ZDI-26-755: (0Day) Genesis World glTF Server-Side Request Forgery Vulnerability

ZDI disclosed an unpatched Genesis World glTF SSRF flaw rated CVSS 6.1.

CERT-EU AdvisoriesOct 12, 2026high

2026-016: Critical Vulnerability in GitLab CE and EE

GitLab patches critical CVE-2026-97229 (CVSS 10.0) allowing unauthenticated RCE via CI/CD regex compiler, plus 23 other security issues in CE/EE versions.

GBHackersOct 12, 2026high

Critical Google DevSite Flaw Allowed Attackers to Execute Remote Code Without Authentication

Researcher Simon Köck found an unauthenticated RCE chain in Google DevSite via Flask session cookie forgery and unsafe pickle deserialization, earning $90,000.

SOCRadarOct 9, 2026high

Critical Cisco NX-OS Flaws Threaten Nexus Switches

Cisco patched five critical NX-OS flaws that let unauthenticated attackers hit Nexus 3000 and 9000 switches.

GBHackersOct 9, 2026high

Critical Citrix NetScaler Vulnerability Allows Remote Code Execution Attacks – CVSS 9.5

Citrix disclosed CVE-2026-107406, a CVSS 9.5 NetScaler memory overflow that can allow remote code execution.

Cyber Security NewsOct 8, 2026high

Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges

Cisco fixed three critical unauthenticated NX-OS flaws that can give root on Nexus 3000 and 9000 switches.

SOCRadarOct 8, 2026high

CVE-2026-21589: Critical Atlassian File Access

Atlassian disclosed CVE-2026-21589, a critical unauthenticated file-access flaw in eight self-hosted products.

Cyber Security NewsOct 8, 2026high

Elastic Fixes 14 Security Flaws Including One That Lets Attackers Intercept Other Users’ Data

Elastic patched 14 flaws, including a CVSS 8.8 Kibana bug letting Fleet users intercept other tenants' data.

Cisco Security AdvisoriesOct 7, 2026

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

Admin-authenticated attackers can inject API commands and run them as root on Cisco APIC.

Cisco Security AdvisoriesOct 7, 2026high

Cisco License (Smart Software Manager) On-Prem Vulnerabilities

Cisco patched Smart Software Manager On-Prem flaws enabling remote access, data exposure, denial of service, or privilege escalation.

Cisco Security AdvisoriesOct 7, 2026high

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

Unauthenticated attackers can gain root code execution on Cisco NX-OS through crafted NX-API HTTP requests.

Cisco Security AdvisoriesOct 7, 2026

Cisco Finesse Server-Side Request Forgery Vulnerability

Unauthenticated attackers can abuse a Cisco Finesse SSRF flaw to obtain limited sensitive information.

Canadian Centre for Cyber SecurityOct 7, 2026

Veeam security advisory (AV26-1009)

Canada’s Cyber Centre urges updates for vulnerabilities in Veeam Backup & Replication.