The Hacker News جمعه ۸ آبان ۱۴۰۵ · ۱۱:۱۵

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart

Vulnerabilities & Zero-Day

Read the full article at The Hacker News Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

SecurityWeek جمعه ۸ آبان ۱۴۰۵ · ۱۳:۰۲

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server. The post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.

Vulnerabilities & Zero-Day Operating Systems

Source

NCSC Netherlands جمعه ۸ آبان ۱۴۰۵ · ۱۲:۴۰

NCSC-2026-0460 [1.00] [M/H] Kwetsbaarheden verholpen in Dell PowerProtect Data Domain

Dell heeft meerdere kritieke kwetsbaarheden verholpen in PowerProtect Data Domain, Data Domain Virtual Edition en Data Domain Management Center. De kritieke wetsbaarheden met kenmerk CVE-2026-103780, CVE-2026-86384, CVE-2026-86397 en CVE-2026-86400 in Dell PowerProtect Data Domain, hebben een CVSS-score van 9.8. Een niet-geauthenticeerde kwaadwillende kan deze kwetsbaarheden op afstand misbruiken om willekeurige opdr…

Vulnerabilities & Zero-Day

Source

CSO Online جمعه ۸ آبان ۱۴۰۵ · ۱۲:۳۰

We are not ready for what AI has done to red teaming

Something shifted in offensive security over the last eighteen months that most organizations haven’t fully absorbed yet. It isn’t that attackers got smarter. It’s that the economics of attack changed entirely — and those of us who run red teams have had a front-row seat to the transformation. The conversation about AI in cybersecurity tends to fixate on defense: better anomaly detection, faster triage, and AI-assist…

Vulnerabilities & Zero-Day Phishing AI Security

Source

SecurityWeek جمعه ۸ آبان ۱۴۰۵ · ۱۲:۱۴

TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system. The post TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines appeared first on SecurityWeek.

Vulnerabilities & Zero-Day

Source