Tag: vulnerability management
549 articles
BeyondTrust Fixes Auth Bypass Flaws in Remote Support Software
BeyondTrust has patched critical flaws in its Remote Support and Privileged Remote Access software that could let hackers take control of affected systems - but you can safeguard yours with a simple update to version 25.3.3 or higher.
Threat Actors Probe Gitea Docker Flaw Just 13 Days After Patch
Security researchers have spotted threat actors probing a critical Gitea Docker flaw just 13 days after it was patched, highlighting the urgent need for users to update their systems. This highly vulnerable flaw, scoring 9.8, allows attackers to exploit a default setting that trusts user headers from any source IP address.
Vulnerabilities in FatFs Filesystem Expose Millions of Embedded Devices to Code Execution
Millions of embedded devices are at risk of code execution due to seven vulnerabilities in the widely-used FatFs filesystem, which can be easily exploited with physical access, effectively leading to a jailbreak. This set of flaws, ranging from medium to high severity, poses a significant threat to device security.
CISA Warns of Active Exploits of Microsoft SharePoint Flaw
Microsoft warns that a critical flaw in SharePoint, tracked as CVE-2026-45659, is being actively exploited, allowing even low-privilege attackers to execute arbitrary code remotely with ease. This deserialization vulnerability lets authenticated attackers run code on vulnerable servers without needing admin privileges.
Oracle Exploit Spotted in Wild Ahead of Proof-of-Concepts
A critical Oracle vulnerability, CVE-2026-46817, with a 9.8 severity rating is being exploited in the wild, just days before a proof-of-concept was expected to be released. The attacks, detected by threat intelligence firm Defused, appear to be more like reconnaissance tests than targeted campaigns, with six attempts logged from a single IP address within a two-hour window.
Schneider Electric Software Vulnerability Exposes Industrial Facilities to Risk
A newly discovered vulnerability in Schneider Electric's Floating License Manager could put industrial facilities at risk, allowing attackers to exploit a weakness in the FlexNet Publisher component. This security gap stems from a hardcoded OpenSSL configuration path that can be manipulated to load malicious DLLs.
OpenClaw Ecosystem Exposes Users to Growing Security Risks
With around 530 vulnerabilities discovered in under two years, the OpenClaw ecosystem poses a growing security threat to its users, putting their sensitive data at risk. Its design, while user-friendly, may be inadvertently leaving users exposed.
Adobe Fixes CVSS 10.0 Flaws in ColdFusion and Campaign Classic
Adobe is racing against the clock to keep you safe, with emergency updates for ColdFusion and Campaign Classic that squash critical flaws allowing hackers to wreak havoc. The timely patches fix vulnerabilities that could lead to devastating attacks, from code execution to security breaches.
Adobe Fixes Seven High-Risk Flaws in ColdFusion, Campaign Platforms
Adobe is urging administrators to act fast and install a critical security update within 72 hours to patch seven high-risk vulnerabilities in its ColdFusion and Campaign Classic platforms that are being targeted by hackers. This update fixes maximum-severity flaws that could put your systems at risk if left unaddressed.
Citrix Discloses High-Severity NetScaler Flaw with CitrixBleed Echoes
Citrix has uncovered a high-severity flaw in its NetScaler appliances, adding to concerns about the trend of fragile memory management in these systems, which can lead to sensitive data leaks with just a misconfiguration. This latest vulnerability, CVE-2026-8451, was discovered by watchTowr researchers and is part of six newly disclosed vulnerabilities in Citrix's NetScaler ADC and Gateway appliances.
Citrix Fixes Flaws in NetScaler Software Exposing Users to File Reads and DoS Attacks
Citrix has patched six high-risk vulnerabilities in its NetScaler software, including flaws that could expose users to file reads and devastating denial-of-service attacks. These critical updates address issues with CVSS scores as high as 8.8, emphasizing the urgent need for users to apply the fixes.
Infosec Pros Ditch Automated Pentesting Tools Amid AI Vulnerability Failures
Infosec pros are ditching automated pentesting tools as they fail to detect AI-driven vulnerabilities, with 78% of practitioners experiencing critical false negatives. Humans are needed to outsmart AI-era flaws that automated scanners miss.
Threat Management Fails to Keep Pace with Visibility Gains
Most organizations are drowning in threat intelligence, with an average of 14 distinct feeds, yet struggle to turn that visibility into action, with 61% unable to identify which vulnerabilities are most likely to be exploited. As a result, security teams waste 42% of their time on low-priority risks, highlighting a critical gap between threat awareness and effective management.
Oracle E-Business Suite Flaw CVE-2026-46817 Sees Active Exploitation
A critical flaw in Oracle Payments, known as CVE-2026-46817, is being actively exploited by hackers, allowing them to easily take control of vulnerable Oracle E-Business Suite instances. This easily exploitable vulnerability has a near-perfect CVSS score of 9.8, making it a high-risk threat to organizations using Oracle Payments.
AI Exposes Thousands of Open-Source Vulnerabilities
This summer is shaping up to be a wild ride, with thousands of open-source vulnerabilities exposed and a new coalition, Athena, stepping in to save the day with AI-powered solutions. Led by Chainguard, Athena brings together over two dozen major companies to tackle the problem head-on.
Amazon AI Coding Tool Exposes Cloud Credentials to Malicious Git Repos
A security vulnerability in Amazon's AI coding assistant, tracked as CVE-2026-12957, allowed malicious Git repositories to access sensitive cloud credentials, raising concerns about informed consent and user security. The flaw enabled automatic execution of commands with no user prompt required.
Confidence in Automated AI Vulnerability Scanning Plummets
Confidence in automated AI vulnerability scanning has taken a nosedive, with a recent survey revealing a dramatic drop from 29% to 9% in organizations relying solely on AI for testing. Instead, nearly half are turning to a hybrid approach, combining AI with human expertise for more reliable results.
Mandiant Exposes Cisco SD-WAN Zero-Day Attacks' Root Access Methods
Cisco's SD-WAN system was exploited in active attacks using a high-severity flaw, allowing hackers to create a rogue root account and take full control of targeted devices. This vulnerability, tracked as CVE-2026-20245, was triggered through a simple tenant-upload feature in the command-line interface.
Governments Struggle to Secure Open-Source Software
The alarming reality is that years of underinvestment in open-source software security are catching up with us, with a new supply chain compromise emerging almost every week. A recent scan by Project Glasswing found over 6,000 high-risk vulnerabilities in popular open-source projects, but only a tiny fraction have been patched.
OpenAI Targets Faster Patching with Expanded Cyber-Defense Program
OpenAI's new GPT-5.5-Cyber model has achieved a record 85.6% score on CyberGym's vulnerability test, outperforming its standard counterpart and paving the way for faster patching with cutting-edge tooling and partnerships. This major breakthrough enables verified defenders to accelerate vulnerability fixes with enhanced security capabilities.
GitHub Bolsters Supply Chain Security by Blocking Pwn Request Patterns
GitHub is stepping up its game to protect your code by blocking common attack patterns on pull requests, helping to prevent security vulnerabilities from untrusted code. As of June 18, 2026, its actions/checkout v7 will refuse risky fork checkouts by default, keeping your workflows safer from attacker-controlled code.
Vulnerability Management Faces AI-Driven Time Crunch
The time it takes for hackers to exploit a newly discovered vulnerability has dramatically shrunk from 53 days to just 8 hours, thanks to AI-driven automation that accelerates the process of finding and weaponizing weaknesses. This alarming trend makes it increasingly challenging for organizations to keep pace with patching and remediation efforts.
Tool Exposes Stale AI Overrides in JavaScript Ecosystem
Discover how a simple oversight in your JavaScript ecosystem can leave you vulnerable to security threats, and learn how the CVE Lite CLI tool can help you identify and fix stale AI overrides. This free, OWASP-endorsed dependency scanner provides actionable vulnerability fixes and keeps your projects secure.
OpenAI Bolsters Cybersecurity Push with GPT-5.5-Cyber Update
OpenAI just unveiled its latest game-changer: GPT-5.5-Cyber, a powerhouse model that supercharges vulnerability detection and patching, while retaining its impressive general-purpose intelligence. This cutting-edge update is part of a broader push to revolutionize software security.