Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. McAfee Labs said it detected and blocked more than 6,300 attempts to access malicious sites, adding that it found lookalike...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

USN-8670-1: curl vulnerability

Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations...

USN-8670-1 curl vulnerability

Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-56684

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...

CVE-2026-55564

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the glyphcacheget function. By sending crafted glyph fragments, the server can cause the client to read beyond the intended memory buffer. This can lead to a client crash...

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On – OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...

CVE-2026-59567

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...

CVE-2026-59568

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

CVE-2026-59564

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal...

CVE-2026-59565

A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows...

CVE-2026-59566

A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS...

Sensitive Information Disclosure

Keycloak is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper authorization when retrieving rotated client secrets stored in a secure vault, which allows a delegated administrator with view-only permissions to obtain the actual secret instead of the vault...

CVE-2026-59568

CVE-2026-59568 covers multiple vulnerabilities in Zscaler Client Connector (ZCC) that allow an unauthenticated, unprivileged remote attacker to achieve remote code execution in the ZCC context. The CNA-assigned CVSS 3.1 score is 9.1 (CRITICAL) , with a network attack vector, low complexity, no pr...

EUVD-2026-64884

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

CVE-2026-59568 Remote Code Execution

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

CVE-2026-59568 Remote Code Execution

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...