همهٔ اخبار

[NEU] [hoch] Kong Gateway: Schwachstelle ermöglicht SQL-Injection

Ein Angreifer aus einem angrenzenden Netzwerk kann eine Schwachstelle in Kong Gateway ausnutzen, um eine SQL-Injection durchzuführen.

[NEU] [hoch] SuiteCRM: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in SuiteCRM ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Vulnerability in Payload CMS software

SQL Injection vulnerability (CVE-2026-63316) has been found in Payload CMS software.

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. Affected

SQL command injection in webmail

CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00

Multiple Arbitrary File Read/Write via SQL Injection

CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on 2026-10-13 00:00:00

Playing It SFAPE: Code Execution in Isolated User Mode

It is tempting to think of Windows in terms of a simple model: user mode and kernel mode. If a bug lets a user-mode process gain control of the kernel, it’s game over. Well, for a long time it used to be like that. Protected processes, SMEP, PatchGuard and other mitigations surely raised the bar, but it was Virtualization-Based Security that added another dimension to that model and made the whole design a lot more c…

Filter, reshape, and redact logs before export with Transformers

Logpush now supports Transformers, allowing teams to filter, redact, and reshape log streams using SQL before export. Powered by Apache DataFusion and Apache Arrow, Transformers apply those changes directly to log data before it reaches the destination.

These ARE the droids you’re looking for

There’s an old leadership fantasy that goes something like this: The CISO surveys a sprawling technology estate, discovers 11 tools doing the work of four, calculates the licensing savings, selects a shiny new strategic platform and declares that consolidation has begun. Six months later, all 11 tools are still running. The new platform is now number 12. I’ve seen variations of this throughout my career, from financi…

[UPDATE] [mittel] Red Hat Enterprise Linux (PyMySQL): Schwachstelle ermöglicht SQL Injection

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um eine SQL Injection durchzuführen.

Multiples vulnérabilités dans PostgreSQL JDBC (12 octobre 2026)

De multiples vulnérabilités ont été découvertes dans PostgreSQL JDBC. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Multiples vulnérabilités dans MongoDB (12 octobre 2026)

De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Elles permettent à un attaquant de provoquer un déni de service à distance et un problème de sécurité non spécifié par l'éditeur.

Resisting the Menace of Federal Data Consolidation

In the past two years, the federal government has unlawfully consolidated data exposing our private information. This consolidation has been chaotic but generally came in three rolling waves: It started with DOGE, moved to agency-to-agency data sharing with ICE, and then attempted data-driven purges of state voter rolls. We all deserve to live in a world where the data we use to pay our taxes, receive benefits, and v…

CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

MongoDB security advisory (AV26-1024)

برترین گوشی شیائومی برای بازار جهانی با Snapdragon 8 Elite Extreme Gen 6 می‌آید

[NEU] [hoch] JHipster: Mehrere Schwachstellen

[NEU] [hoch] MariaDB Connector/Node.js: Mehrere Schwachstellen

[NEU] [hoch] MongoDB Treiber: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Treibern ausnutzen, um einen Denial of Service Angriff durchzuführen und um Daten zu manipulieren.

NCSC-2026-0412 [1.00] [M/H] Kwetsbaarheden verholpen in Splunk Enterprise

Splunk Patches 22 Vulnerabilities, Including Critical Flaw With CVSS 9.8

Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

[NEU] [mittel] PostgreSQL JDBC Driver: Mehrere Schwachstellen

[UPDATE] [mittel] Broadcom Brocade SANnav: Mehrere Schwachstellen

[NEU] [hoch] Splunk Enterprise: Mehrere Schwachstellen

[NEU] [hoch] Cisco License On-Prem: Mehrere Schwachstellen

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

NCSC-2026-0408 [1.00] [M/H] Kwetsbaarheden verholpen in Kiteworks

Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn

GitHub adds AI to catch passwords before a code push