90-day archive
Search by headline, summary or source name. Every item links to its own original page.
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and […]
Critical infrastructure faces mounting threats from nation-state groups and AI-driven attacks. In the latest installment of our Cybersecurity Awareness Month blog series, learn how leading cybersecurity agencies, such as CISA, are advising critical infrastructure organizations on ways to protect themselves and the essential services they provide.Key takeawaysCritical infrastructure organizations often struggle with a…
Blueberry Medical has disclosed a data breach in which an attacker exploited a Metabase vulnerability to steal patient information, including children’s medical records and health insurance details. The healthcare provider discovered the unauthorized access on August 22, 2026. A separate public statement places the initial intrusion on August 10, when the attacker gained administrator access … The post Blueberry Pedi…
Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications. Key Takeaways Check Point Research d…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2.0.22 (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) CVSS Vendor Equipment v3 6.2 Swann Communications SWIFI-SE2KIC firmware 1 Vulnerability Missing Authentication for Critica…
A security platform can tell you that a storage bucket is public, that a container image carries a critical CVE, or that a role has overly permissive cloud identities . What it can’t tell you on its own is who owns the problem, how fast your policy says it has to be fixed, or whether […]
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-96951 Microsoft Windows Command Injection Vulnerability CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enter…
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much
GitLab just fixed a max-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on its servers. The company released a fix on Monday, alongside patches for five other high-severity flaws affecting its source code management and continuous integration and delivery (CI/CD) platform. The vulnerability, tracked as CVE-2026-97229, was fixed in versions 19.4.2, 19.3.5, and 19.2.8 of its…
OverviewOn October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the vulnerability a CVSSv3.1 score of 10.0. Under certain conditions, a remote attacker can execute arbitrary code on an affected GitLab server through a speci…
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware
SQL Injection vulnerability (CVE-2026-63316) has been found in Payload CMS software.
A flaw in npm’s Trusted Publishing mechanism could allow attackers to hijack legitimate software packages by reclaiming abandoned GitHub repository names, potentially exposing millions of package downloads to supply-chain attacks. Researchers at Bloom Security identified more than 1500 potentially vulnerable npm packages, including security scanners, authentication tools, and cryptographic packages. The vulnerability…
CVE-2026-97229: Critical GitLab RCE GitLab has issued an urgent patch for CVE-2026-97229, a maximum severity integer overflow vulnerability residing in its CI/CD Regular Expression Compiler. Left unaddressed, the securit
GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE), specifiek in versies voorafgaand aan 19.2.8, 19.3.5 en 19.4.2. De kwetsbaarheden zijn aanwezig in verschillende onderdelen van GitLab, waaronder de CI/CD pipelineomgeving, autorisatiemechanismen, API, Kubernetes-integratie en package registry. Kwaadwillenden kunnen de kwetsbaarheden misbruiken voor het uitvoeren van wil…
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers. About CVE-2026-97229 CVE-2026-97229 is an integer overflow vulnerability in GitLab’s CI/CD Regular Expression Compiler, and it affects both GitLab Community Edition (CE) and Enterprise Edition (EE). G…
Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind. Bloom counted more than 1,500 npm packages exposed this way, and GitHub, which owns npm, says it has shipped fixes. The exposed packages have more than 10 million d…
در یکی از عجیبترین اتفاقات امنیت سایبری از فرانسه خبر میرسد که هکرها در این کشور با دستکاری از راه دور سامانههای تبرید سوپرمارکتهای شهرهای مختلف، دمای یخچالها و فریزرها را تا ۵۰ درجه سانتیگراد بالا برده و باعث فساد مواد غذایی در صدها فروشگاه شدند. در این هک عظیم، از آسیبپذیری تجهیزات قدیمی شرکت فعال در حوزه تبرید موسوم به Danfoss استفاده شده و خسارات بزرگی را به بار آورده است.
Singapore opened SICW 2026 with a blunt message: no government, company or country can see the full picture of today's cyber threats, and artificial intelligence is now raising the stakes for defenders and attackers alike. Speaking at the opening ceremony of the 11th Singapore International Cyber Week on 13 October 2026, Gwenda Fong, Commissioner of Cybersecurity and Chief Executive of the Cyber Security Agency of Si…
CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key. Revised o…
CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on 2026-10-13 00:00:00
CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on 2026-10-13 00:00:00
CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00
