نبض سایبری اخبار امنیت سایبری، با ذکر منبع
EN

آرشیو ۹۰ روزه

همه اخبار

جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.

دسته: آسیب‌پذیری و روز صفر پاک کردن فیلترها

۲۱۹۲ خبر

صفحه ۲۸ از ۷۴
Cyble

The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws

This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble's global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS). The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from n…

بدافزار و آلودگی آسیب‌پذیری و روز صفر فیشینگ
منبع
NCSC Netherlands

NCSC-2026-0427 [1.00] [M/H] Kwetsbaarheden verholpen in Ahsay AhsayCBS

Ahsay heeft kwetsbaarheden verholpen in AhsayCBS tot en met versie 10.3.2. De kwetsbaarheid met kenmerk CVE-2026-105133 heeft een CVSS-score van 7,3 en betreft onvoldoende authenticatie in de functie checkSysPwd van de AhsayCBS API. Een niet-geauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken om de authenticatie te omzeilen. De kwetsbaarheid met kenmerk CVE-2026-105134 heeft een CVSS-score van 1…

آسیب‌پذیری و روز صفر
منبع
Ubuntu Security Notices

USN-8929-1: Bind vulnerabilities

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain reco…

آسیب‌پذیری و روز صفر بات‌نت و DDoS شبکه و اینترنت
منبع
CSO Online

How Claude Code’s 256KB blind spot put developers’ secrets in the preview pane

Simply asking Anthropic’s Claude Code to review an HTML file could hand attackers access to a developer’s machine, cloud credentials and software development environment, according to a new Noma Security finding. Noma’s researchers found a vulnerability affecting Anthropic’s Claude Code Desktop app that could allow malicious JavaScript embedded in an HTML file to execute without further user interaction, potentially…

آسیب‌پذیری و روز صفر نشت داده امنیت ابری
منبع
Rapid7 Blog

From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it.During a broader assessment of Zimbra Collaboration Suite (ZCS), Rapid7 reported more than 80 vulnerabilities spanning authentication, mailbox author…

آسیب‌پذیری و روز صفر فیشینگ توسعه وب
منبع
Censys Research

5 Key Takeaways From Censys’ State of the Internet Report

New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed. The report examines the Internet from five angles: AI exposures, ICS exposures, vulnerability response, threat infrastructure, and the Internet at large. Across these perspectives, one thing remains clear: the Internet is […] The post 5 Key Takeaway…

آسیب‌پذیری و روز صفر امنیت اینترنت اشیا و صنعتی
منبع
Rapid7 Blog

Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server. The vulnerability, scored as CVSSv3…

آسیب‌پذیری و روز صفر پایگاه داده سیستم‌عامل
منبع
CERT/CC Vulnerability Notes

VU#166125: Bisheng has authentication bypass vulnerabilities

Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. Together, these flaws…

آسیب‌پذیری و روز صفر نشت داده امنیت هوش مصنوعی
منبع
The Hacker News

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS

آسیب‌پذیری و روز صفر امنیت اینترنت اشیا و صنعتی امنیت هویت و دسترسی
منبع
زومیت

مدیرعامل بلو: امنیت از طراحی محصول آغاز می‌شود؛ گزارش دادن آسیب‌پذیری نوعی سرمایه‌گذاری است

دومین رویداد باگ‌بانتی بلوبانک پس از رقابت آنلاین بیش از ۱۴۰۰ نفر، با حضور ۸۰ متخصص و ثبت ۱۹ گزارش معتبر امنیتی به پایان رسید.

آسیب‌پذیری و روز صفر حریم خصوصی
منبع
Ubuntu Security Notices

USN-8928-1: OpenSSH vulnerabilities

It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could possibly use this issue to write files to unintended locations. (CVE-2026-106552) It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across authentication attempts. An attacker could possibly use this is…

آسیب‌پذیری و روز صفر بات‌نت و DDoS امنیت هویت و دسترسی
منبع
CISA Advisories

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability The…

آسیب‌پذیری و روز صفر امنیت هویت و دسترسی
منبع
Ubuntu Security Notices

USN-8927-1: curl vulnerabilities

It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause connections to go out…

آسیب‌پذیری و روز صفر بات‌نت و DDoS رایانش ابری
منبع
CSO Online

Hackers abuse the Ivanti Connect Secure bug to gain access without accounts

Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran arbitrary commands on the appliances. “Ivanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0,“ the vendor said in a security advisory.…

آسیب‌پذیری و روز صفر سخت‌افزار و تراشه امنیت هویت و دسترسی
منبع
Trail of Bits

Package managers have an integrity problem

I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed1, fewer than half used lockfiles that checked for tampering by default, a…

بدافزار و آلودگی آسیب‌پذیری و روز صفر امنیت ابری
منبع
CyberInsider

Google pays $250K bounty for AI-assisted Chrome exploit built in six days

XBOW has disclosed an AI-assisted Chrome exploit that could let attackers run code on a Windows computer simply by getting its user to visit a malicious webpage. Google has fixed all three vulnerabilities used in the chain and awarded the researchers a $250,000 bounty. The company published its findings on October 13, describing how researcher … The post Google pays $250K bounty for AI-assisted Chrome exploit built i…

آسیب‌پذیری و روز صفر سیستم‌عامل
منبع
Help Net Security

Chainguard Harness uses frontier AI to test running applications for vulnerabilities

Chainguard has announced Chainguard Harness, a new cyber harness that uses frontier AI models like Anthropic’s Claude Mythos 5.1 to find and fix exploitable vulnerabilities in an organization’s application code. Harness builds an application from an organization’s source code in an isolated microVM, instructs a frontier model to hunt for exploitable vulnerabilities in a live, running instance, and reproduces every fi…

آسیب‌پذیری و روز صفر
منبع
Security Affairs

Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities

Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained […]

آسیب‌پذیری و روز صفر امنیت هوش مصنوعی هوش مصنوعی و یادگیری ماشین
منبع