ROS-20260216-73-0037

A vulnerability in the AWT and JavaFX components of the Oracle Java SE software platform, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is associated with insufficient protection of proprietary data. Exploitation of the vulnerability could allow an attacker acting...

ROS-20260216-73-0024

A vulnerability in the Zabbix IT infrastructure monitoring system is related to insufficient server-side request validation. Exploitation of the vulnerability could allow an attacker acting remotely to gain read access to the data...

ROS-20260216-73-0023

A vulnerability in the Zabbix IT infrastructure monitoring system is related to insufficient server-side request validation. Exploitation of the vulnerability could allow an attacker acting remotely to gain read access to the data...

Vulnerability fixed in BeyondTrust Remote Support

BeyondTrust has fixed a vulnerability in BeyondTrust Remote Support and some older versions of Privileged Remote Access. The vulnerability is in the software's pre-authentication, which allows unauthenticated attackers to execute operating system commands by sending specially crafted requests to...

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability

Threat actors have started to exploit a recently disclosed critical security flaw impacting BeyondTrust Remote Support RS and Privileged Remote Access PRA products, according to watchTowr. "Overnight we observed first in-the-wild exploitation of BeyondTrust across our global sensors," Ryan...

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

BeyondTrust Remote Support RS and Privileged Remote Access PRAcontain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no...

CVE-2026-23856

Dell iDRAC Service Module (iSM) for Windows (<6.0.3.1) and Linux (

The vulnerability of the CS-Cart Multi-Vendor electronic shopping platform’s software lies in its ability to bypass authentication using a user-controlled key, allowing attackers to compromise the integrity and accessibility of protected information.

The vulnerability of the CS-Cart Multi-Vendor software for electronic shopping platforms relates to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely compromise the integrity and accessibility of protected information...

GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Store.Remoting.exe process, which listens on port 8018. The...

Dell iDRAC Service Module 访问控制错误漏洞

The Dell iDRAC Service Module is a lightweight software module developed by the American company Dell. It is designed to enhance the functionality of iDRAC Integrated Dell Remote Access Controller on Dell PowerEdge servers. There were access control vulnerabilities in versions of the Dell iDRAC...

The vulnerability of the CS-Cart Multi-Vendor electronic shopping platform’s software lies in its ability to bypass authentication using a user-controlled key, allowing attackers to compromise the integrity and accessibility of protected information.

The vulnerability of the CS-Cart Multi-Vendor software for electronic shopping platforms relates to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely compromise the integrity and accessibility of protected information...

CVE-2026-21525

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally...

CVE-2026-2315

Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian Entities

Indian defense sector and government-aligned organizations have been targeted by multiple campaigns that are designed to compromise Windows and Linux environments with remote access trojans capable of stealing sensitive data and ensuring continued access to infected machines. The campaigns are...

CVE-2025-30266 Qsync Central

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4...

CVE-2025-48724

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 2026/01/20 and...

Exploit for CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC...

The vulnerability of the Remote Access Connection Manager (RASMan) service on the Windows operating system allows a hacker to induce a service failure.

The vulnerability of the Remote Access Connection Manager RASMan service in the Windows operating system is related to pointer aliasing. Exploiting this vulnerability could allow an attacker to cause a service failure...

QNAP Qsync Central 安全漏洞

QNAP Qsync Central is a cloud-based file synchronization service for NAS devices provided by QNAP Technology Co., Ltd. Versions of QNAP Qsync Central prior to 5.0.0.4 contained security vulnerabilities. These vulnerabilities were caused by excessive pointer offsets, which could allow remote...

Patch Tuesday, February 2026 Edition

Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six "zero-day" vulnerabilities that attackers are already exploiting in the wild. Zero-day 1 this month is CVE-2026-21510, a security feature...