همهٔ اخبار

CVE-2026-0315 GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (Severity: MEDIUM)

CVE-2026-0314 GlobalProtect App: Local Denial of Service (DoS) on Windows (Severity: MEDIUM)

حرکت تحسین‌برانگیز اپیک گیمز؛ بازی فورتنایت به لینوکس می‌آید

اپیک گیمز با بازطراحی بنیادین سامانه‌ی ضدتقلب، مسیر ورود فورتنایت به سیستم‌عامل لینوکس و تعامل با SteamOS را هموار می‌کند.

قدرت‌نمایی هوش مصنوعی؛ لانچر اپیک گیمز با وایب‌کدینگ بازطراحی شد

اپیک گیمز نسخه‌ی پیش‌نمایش لانچر بازی خود را با هوش مصنوعی و پشتیبانی از لینوکس رونمایی کرد.

CVE-2026-85870 Windows Common Log File System Driver Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-84019 Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-77499 Windows DHCP Server Denial of Service Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-72937 Windows Storage Port Driver Information Disclosure Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-70584 Windows Core Messaging Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-69620 Windows DHCP Server Remote Code Execution Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-69366 Windows Kernel Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-69351 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-69334 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-68825 Windows Bind Filter Driver Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-62697 Windows Push Notifications Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

CVE-2026-102188 Windows Storage Port Driver Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws

This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble's global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS). The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from n…

From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it.During a broader assessment of Zimbra Collaboration Suite (ZCS), Rapid7 reported more than 80 vulnerabilities spanning authentication, mailbox author…

Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server. The vulnerability, scored as CVSSv3…

[UPDATE] [hoch] CUPS: Schwachstelle ermöglicht Privilegieneskalation

Ein lokaler Angreifer kann eine Schwachstelle in CUPS, wie es z.B. in Red Hat Enterprise Linux und Fedora Linux verwendet wird, ausnutzen, um seine Privilegien zu erhöhen.

[UPDATE] [mittel] Red Hat Enterprise Linux (OpenEXR): Schwachstelle ermöglicht Codeausführung und Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (OpenEXR) ausnutzen, um beliebigen Programmcode auszuführen, und um einen Denial of Service Angriff durchzuführen.

[NEU] [mittel] Red Hat Enterprise Linux (OpenEXR): Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.

[NEU] [hoch] Microsoft SystemCenter (Defender und Configuration Manager): Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Microsoft Defender, Microsoft Configuration Manager und Microsoft Windows Defender ausnutzen, um Administratorrechte zu erlangenoder vertrauliche Informationen offenzulegen.

[UPDATE] [hoch] Red Hat Enterprise Linux (Flatpak): Mehrere Schwachstellen

Ein authentisierter Angreifer kann mehrere Schwachstellen im Flatpak Paket von Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen und um Dateien zu löschen.

[UPDATE] [mittel] Red Hat Enterprise Linux (flatpak): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

[UPDATE] [hoch] Red Hat Enterprise Linux (Flatpak): Schwachstelle ermöglicht Codeausführung

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.

[UPDATE] [hoch] Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.

Update Windows: Record Patch Tuesday fixes flaw already under attack

Microsoft’s October updates address a record 1,413 vulnerabilities, including a Windows flaw attackers are already exploiting and two other zero-days.

Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $