Tag: path traversal
22 articles
Fortinet Flaw Exposes Unauthenticated Remote Code Execution Risk
A critical flaw in Fortinet FortiSIEM leaves it vulnerable to unauthenticated remote code execution, allowing attackers to wreak havoc with just a few clicks. This severe vulnerability, tracked as CVE-2026-106173, scores a 9.4 on the CVSS scale, highlighting the urgent need for a fix.
Cisco Disrupts Zero-Day Attacks on Secure Email Gateway
Cisco is taking swift action to stop zero-day attacks on its Secure Email Gateway, recently discovering a vulnerability that allowed hackers to write arbitrary files and execute commands with root privileges. This critical flaw, tracked as CVE-2026-76519, was triggered by a simple malicious email attachment, making swift patching a top priority.
Atlassian Flaw Exposes File Data Across Multiple Products
A critical security flaw, rated 9.3 out of 10, has been discovered in multiple Atlassian products, allowing unauthenticated attackers to access sensitive files. This vulnerability, known as CVE-2026-21589, poses a significant risk to self-hosted Data Center products if exploited.
Dell Flaw Exposes Root Privileges to Hackers
Dell's System Update tool has a critical flaw that could let hackers gain total control of your system - and all it takes is remote access to get started. This vulnerability, tracked as CVE-2026-86360, is a serious threat that could allow attackers to execute code with root privileges.
Fortinet FortiMail Zero-Day Flaw Exploited in Attacks
A critical Fortinet FortiMail flaw, rated CVSS 9.8, is being actively exploited by attackers, allowing them to write arbitrary files to vulnerable systems without needing authentication. This severe vulnerability combines a path traversal and a NULL-byte handling error, making it a high-risk threat.
Fortinet Warns of Zero-Day Attacks Exploiting Critical FortiMail Flaw
Fortinet has issued a critical warning about zero-day attacks exploiting a severe vulnerability in its FortiMail appliances, with a CVSS score of 9.8 that allows unauthenticated attackers to write arbitrary files on the system. This flaw, tracked as CVE-2026-104286, is under active exploitation, putting FortiMail users at risk.
ShinyHunters Exploits Grav CMS Flaw to Breach Clop Leak Site
The Grav CMS flaw, tracked as CVE-2026-42608, was exploited by ShinyHunters to breach the Clop gang's leak site, and the vulnerability has since been patched in Grav's 2.0 and 1.7 branches. Grav confirmed the legitimacy of the flaw and the threat actor's description, and has implemented a fix to prevent further attacks.
CISA Flags WSO2, Adobe Commerce Flaws as Actively Exploited
Stay ahead of cyber threats: Federal agencies must patch WSO2 and Adobe Commerce flaws by September 27, 2026, to avoid exploitation, as CISA flags these vulnerabilities as actively exploited. The high-severity bugs, including a path traversal flaw and an authorization issue, can lead to remote code execution and unrestricted file uploads.
Check Point Discloses Zero-Day Flaw in Management Server Exploited in Targeted Attacks
A high-severity zero-day flaw in Check Point's Security Management Server was exploited in targeted attacks on July 23, allowing hackers to upload and execute scripts without logging in. This critical vulnerability, scored 9.8 out of 10 on the CVSS scale, highlights the urgent need for patching and protection.
Check Point Discloses Zero-Day Exploited in Management Server Attacks
A critical zero-day vulnerability in Check Point's Security Management Server has been exploited in the wild, allowing attackers to upload and run malicious scripts with ease. This flaw, tracked as CVE-2026-93616, has already been used to target a handful of customers, prompting Check Point to release emergency hotfixes.
GitLab Flaw Exploited After Patch Release
A newly patched GitLab flaw, rated a perfect 10.0 in severity, is being exploited by attackers, who can use it to read arbitrary files from vulnerable servers without needing to log in. This path traversal bug in GitLab's repository commits API is especially concerning since it often stores sensitive source code, configuration files, and credentials.
GitLab Flaw Exploited in Wild, Prompting Urgent Patch Push
A critical GitLab bug, CVE-2026-85706, is under active exploitation, putting sensitive files at risk of exposure due to a path traversal vulnerability that allows unauthenticated users to access arbitrary files. GitLab has urgently pushed a patch to fix the flaw, affecting versions CE/EE 18.7 to 19.3.2.
Hackers Exploit GitLab Flaw in Active Attacks
Hackers are actively exploiting a critical GitLab flaw, CVE-2026-85706, that allows them to read sensitive information like credentials and secrets with just a single HTTP request. This vulnerability enables attackers to access arbitrary files, potentially exposing long-lived secrets and confidential data.
GitLab Warns Users to Patch Path Traversal Flaw
GitLab is urging users to upgrade immediately to patch a critical path traversal flaw, CVE-2026-85706, that could expose sensitive files to unauthenticated attackers. This maximum-severity vulnerability requires prompt action to protect self-managed GitLab installations.
Unitree Humanoid Robot Flaws Expose Root Code Execution Risk
A security researcher has uncovered two critical vulnerabilities in the Unitree G1 EDU robot, allowing hackers to remotely execute code with root access, potentially putting users and systems at risk. These flaws, tracked as CVE-2026-76639 and CVE-2026-76640, highlight the importance of robust security measures in robotics and AI technology.
Next.js Patches Flaws Enabling Unauthenticated Remote Code Execution
If your Next.js application is hosted on Windows, upgrade immediately to patch a critical vulnerability that allows unauthenticated remote code execution. This flaw, tracked as CVE-2026-75604, affects apps using both Pages Router and App Router without Cache Components.
Progress Resumes ShareFile Storage Zones After Patching Vulnerability Exploit
Progress Software swiftly responded to a credible security threat, suspending ShareFile Storage Zones Controller for four days to safeguard customer data, before resuming service on July 14. The brief outage ensured the protection of its flagship enterprise file-sharing service and private data storage.
Adobe ColdFusion Flaw Exploited in Targeted Attacks
With 775 exposed ColdFusion instances online, a newly patched flaw is being exploited by attackers, putting countless systems at risk. Adobe has urgently warned customers to apply updates immediately to protect against this and 10 other critical vulnerabilities.
Fortinet Sandbox Flaws Under Active Exploitation
Critical Fortinet Sandbox vulnerabilities are under active attack, with hackers exploiting flaws like CVE-2026-39813, a severe path traversal bug that allows authentication bypass. Fortinet patched these bugs in April, but users must upgrade ASAP to avoid being compromised.
Attackers Exploit Langflow Path Traversal Flaw in Active Attacks
A single, unauthenticated request is all it takes to exploit a high-severity flaw in Langflow, a popular AI development platform, allowing attackers to write arbitrary files to its filesystem. This is made possible by a path traversal vulnerability, CVE-2026-5027, which can be easily triggered due to Langflow's default unauthenticated auto-login feature.
Langflow Vulnerability Exploited for Unauthenticated Remote Code Execution
A single, unauthenticated request is all it takes to exploit a high-severity flaw in Langflow, allowing attackers to execute remote code without needing any login credentials. This vulnerability, tracked as CVE-2026-5027, enables malicious actors to write files to any location on a host filesystem.
Ubiquiti Fixes Maximum-Severity UniFi OS Flaws
Ubiquiti has patched three critical vulnerabilities in UniFi OS that left nearly 100,000 Internet-exposed endpoints, including 50,000 in the US, open to remote attacks without requiring login credentials. The fixes address severe flaws that could allow unauthorized system changes, file access, and even command injection.