FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices

Key Takeaways FortiBleed refers to June 2026 public reporting of large-scale credential exposure and abuse targeting internet-reachable FortiGate management and SSL-VPN gateways driven by credential reuse and brute-force, not a single new zero-day. Risk is highest for internet-exposed FortiGate...

Important: Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

Red Hat Edge Manager Version 1.0.3 Security Update Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mode RHEL and container workloads that run on Podman/Docker or Kubernetes. RHEM is now available as a...

Important: Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

Red Hat Edge Manager Version 1.0.3 Security Update Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mode RHEL and container workloads that run on Podman/Docker or Kubernetes. RHEM is now available as a...

PT-2026-56911

Name of the Vulnerable Software and Affected Versions PAN-OS affected versions not specified Description An issue in the management web interface of PAN-OS software, affecting PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series, allows an unauthenticated attacker with netwo...

Why Unity Remains the Most Popular Engine for Mobile Games

Learn why Unity is still a trusted engine for mobile games, from faster prototyping and Android and iOS support to tools that help studios scale after releases...

PYSEC-2026-1326 ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

Summary An integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. Details The bounds check ptr + fieldlength end in components/api/proto.cpp can overflow when a malicious client sends a large fieldlength value. This affects all...

Malicious code in nonexistent-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9393b3fc67ac5c169de7089d2f5100b5cb49af4e2b747b46726660bebc2bf66a No a static rule matches and no traced behavioral findings were produced for this package version. Nothing in the analyzed artifacts indicates...

Malicious code in chai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9192d163b3814064c95a23cb11e218732346628f3109517aab7697c2dcb6d016 On require, index.js spawns a detached background node process that runs lib/initializeCaller.js. That module axios.gets a base64-obfuscated URL...

EUVD-2026-42048

A stored cross-site scripting XSS vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the...

CVE-2026-12948 Stored Cross-Site Scripting (XSS)

A stored cross-site scripting XSS vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the...

SEIKO EPSON printers and scanners Web Config vulnerable to cross-site request forgery

Overview Web Config embedded in multiple printers and scanners provided by SEIKO EPSON CORPORATION contains the following vulnerability. Cross-site request forgery CWE-352 - CVE-2026-58315 Kentaro Ishii of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated...

SUSE CVE-2026-13912

Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Pixel Update Bulletin—July 2026Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2026-07-05 or later address all issues in this bulletin and all issues in the July 2026 Android Securit...

VulnCheck KEV: CVE-2020-22653

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 SCG200 before 3.6.2.0.795, SmartZone 100 SZ-100 before 3.6.2.0.795, SmartZone 300 SZ300 before 3.6.2.0.795, Virtua...

VulnCheck KEV: CVE-2020-22658

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 SCG200 before 3.6.2.0.795, SmartZone 100 SZ-100 before 3.6.2.0.795, SmartZone 300 SZ300 before 3.6.2.0.795, Virtua...

GHSA-H444-6J9X-P8VH mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

When moving directories across filesystems, uutils mv dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a etclink - /etc inside the source becomes a full copy of /etc at the destination...

MAL-2026-6871 Malicious code in renderctx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbdcdb9e0c6002d228035d5d746f734a23c224429a18e078a44e5fa65db495f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6872 Malicious code in rma-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fcbaad039ecd69789daa0857a674926917f7a439656144587a9fc441968e97c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6832 Malicious code in competion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7977f7cd8dcf35f17c8745de465b35f920055be22dbb883dda7abf2e978ef0e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-scroller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57d21e3f2b10a543d5deb6a3999b78e5414b55ad958ff7811d802cb42386fc8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...