Aggregator

A vulnerability categorized as critical has been discovered in Progress MOVEit Transfer up to 2025.0.6/2025.1.2. Affected by this vulnerability is an unknown functionality of the component Custom Reports Module. Executing a manipulation can lead to improper neutralization. The identification of this vulnerability is CVE-2026-8649. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in nats-io nats-server up to 2.12.11/2.14.2. It has been rated as problematic. Affected is an unknown function of the component MQTT Handler. Performing a manipulation results in uninitialized pointer. This vulnerability was named CVE-2026-58208. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in bitwarden Server 1.35.1/2026.4.0/2026.4.1/2026.5.0. It has been declared as critical. This impacts an unknown function of the file /auth-requests/admin-request of the component Admin Request Handler. Such manipulation of the argument email leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-60104. The attack can be launched remotely. No exploit exists.

A vulnerability was found in bytecodealliance wasmtime up to 24.0.10/36.0.11/45.0.2/46.0.0. It has been classified as problematic. This affects an unknown function of the component Filesystem Interface. This manipulation causes permission issues. This vulnerability is handled as CVE-2026-58494. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in nats-io nats-server up to 2.12.11/2.14.2 and classified as critical. The impacted element is an unknown function of the component Parser. The manipulation results in improper authentication. This vulnerability is known as CVE-2026-58211. It is possible to launch the attack remotely. No exploit is available.

A vulnerability has been found in httplib2 up to 0.31.x and classified as problematic. The affected element is the function _decompressContent of the file httplib2/init.py of the component Decompression. The manipulation leads to encoding error. This vulnerability is traded as CVE-2026-59939. It is possible to initiate the attack remotely. There is no exploit available.

Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university's network. [...]

A vulnerability, which was classified as critical, was found in Composer up to 2.2.28/2.10.1. Impacted is an unknown function of the component Dependency Resolution. Executing a manipulation of the argument package name can lead to path traversal. This vulnerability appears as CVE-2026-59948. The attack may be performed from remote. There is no available exploit.

The attacker exploited AI workflows, chained cloud weaknesses, and stolen credentials to extort a large Amazon customer.

Ubiquiti patched seven UniFi OS flaws, including critical CVE-2026-50746, which allows command injection in UniFi Connect Application. Ubiquiti released security updates for seven critical UniFi OS vulnerabilities, including a maximum-severity flaw, tracked as CVE-2026-50746 (CVSS score of 10.0), enabling command injection attacks. The issue affects UniFi Connect Application versions 3.4.16 and earlier, a platform used […]

The use of the spyware came to light in 2022, with traces of Predator found on dozens of phones. The scandal led to the resignation of Greece’s intelligence service chief and the prime minister’s chief of staff.

State attorneys general announced the bipartisan agreement with Block, Inc. on Wednesday, saying that the company incorrectly promised users that Cash App offered the same protections as a bank.

A vulnerability described as critical has been identified in yt-dlp up to 2026.7.3. This vulnerability affects unknown code of the file .desktop of the component Shortcut Files. The manipulation of the argument webpage_url/filename results in injection. This vulnerability is reported as CVE-2026-55404. The attack can be launched remotely. No exploit exists.

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications. [...]

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.33. Impacted is an unknown function of the component drm. The manipulation leads to improper initialization. This vulnerability is traded as CVE-2025-71315. Access to the local network is required for this attack to succeed. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability classified as critical has been found in Linux Kernel up to 6.18.26/7.0.3. This impacts the function init_section_page_ext of the component mm. This manipulation causes memory leak. This vulnerability is registered as CVE-2026-46279. The attack requires access to the local network. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.1-rc1. Affected by this vulnerability is the function amdgpu_ttm_init. Performing a manipulation results in denial of service. This vulnerability is reported as CVE-2026-46276. The attacker must have access to the local network to execute the attack. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.6.139/6.12.87/6.18.26/7.0.3 and classified as critical. This affects the function phylink_connect_phy of the file drivers/net/phy/phylink.c of the component net. The manipulation leads to improper locking. This vulnerability is traded as CVE-2026-46287. Access to the local network is required for this attack to succeed. There is no exploit available. The affected component should be upgraded.