آرشیو ۹۰ روزه
جستوجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Sicherheitsmechanismen zu umgehen, sowie einen Denial of Service Angriff oder andere nicht spezifizierte Angriffe durchzuführen.
[Update] October 27, 2026: PHP Ships Windows Builds With Brotli Fix The Node2Shell Brotli flaw (CVE-2026-111497), disclosed alongside Node.js fixes on October 21, 2026, also reaches Python through the PyPI Brotli and brotlicffi packages. Both compile Google’s vulnerable Brotli C decoder, and popular HTTP clients such as requests, httpx and aiohttp use them to decompress […]
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um einen Denial of Service Angriff zu erzeugen und Daten zu manipulieren.
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen, seine Privilegien eskalieren oder einen nicht näher spezifizierten Angriff durchzuführen.
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Pivotal Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in expat ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Angriff durchzuführen.
Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein Angreifer kann mehrere Schwachstellen in Synacor Zimbra ausnutzen, um sich erweiterte Berechtigungen – einschließlich Root-Rechte – zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuführen, sensible Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
Ein Angreifer kann mehrere Schwachstellen in RabbitMQ ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.
Ein Angreifer kann mehrere Schwachstellen in PJSIP ausnutzen, um einen Denial of Service Angriff durchzuführen und um Daten zu manipulieren.
SOCRadar Dark Web Team identified several underground posts, including an alleged Finaxis.cloud data sale involving 400GB of information, a resurfaced WoWInstaller database containing historical user credentials, and an alleged Argentine Moodle platform data leak. Other posts advertised an alleged MyHairCare Australia customer database and an alleged HT Médica database containing 2.2 million records. Alleged Finaxis.…
uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof […]
Two leading AI developers have released fresh evidence of a problem that researchers have long anticipated: advanced models searching for ways around the limits imposed on them. New disclosures from OpenAI and Anthropic detail how frontier systems exploited weaknesses in their environments or exceeded the intended scope of assigned tasks. OpenAI is now tightening internet access in its internal model-training environ…
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on
مرسدس بنز با ثبت پتنتی جدید قصد دارد با سنجش میزان استرس راننده، زمانبندی بهروزرسانیهای نرمافزاری را به تعویق بیندازد.
Quest Diagnostics says a breach affected personal information and patient records. Here’s what patients need to know and what to do now.
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first see the shape of an intrusion
DreamHost has reset passwords for some email and FTP/SFTP users after an incident affected its File Manager and webmail services. The company is now requiring account owners to set new credentials before affected users can regain access. The disruption began on October 23 and remained active in the company’s latest update, posted October 25 at … The post DreamHost forces password resets amid ongoing service disruptio…
Interesting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it. One word tilts the code against Americans. Ask for the app “for a US defense contr…
Booking.com's systems were never breached. Its name was. Storm-1865 spent months borrowing Booking.com's identity to get into hotel computers, and every step of that borrowing left traces on the open internet. The open internet is exactly where Cyble Brand Intelligence & Protection works. Walk through the campaign one step at a time, and at each step there is a point where it could have spotted the attacker, cut the…
Japanese companies are starting to compensate customers after a run of cyberattacks disrupted internet services and stirred concerns about economic stability. GMO Internet is the latest to do so, pledging payouts after hackers breached its foreign exchange trading service. In a blog post on Oct 25, chief executive Masatoshi Kumagai said customers would be compensated for losses caused by unauthorized access, and each…
Malicious instruction files planted in a computer’s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer’s machine and demonstrating similar techniques against OpenAI’s Codex and Anthropic’s Claude Code. In its research report, the firm said it discovered a malicious AGENTS.md file in a custome…
An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. The post Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages appeared first on SecurityWeek.
Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry
