397 matches found
August Microsoft Patch Tuesday
August Microsoft Patch Tuesday. A total of 401 vulnerabilities were addressed - 170 fewer than in July. One of the vulnerabilities is known to be actively exploited in the wild: π» EoP - Windows Ancillary Function Driver for WinSock CVE-2026-68820. A local attacker can exploit this vulnerability t...
About Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) vulnerability
About Remote Code Execution - Microsoft SharePoint CVE-2026-58644 vulnerability. Information about this vulnerability was published on July 14 as part of the July Microsoft Patch Tuesday. The vulnerability in Microsoft SharePoint Server, caused by a deserialization flaw CWE-502, allows an attacke...
About Elevation of Privilege - Microsoft SharePoint (CVE-2026-56164) vulnerability.
About Elevation of Privilege - Microsoft SharePoint CVE-2026-56164 vulnerability. The vulnerability was disclosed in the July Microsoft Patch Tuesday release on July 14. The vulnerability, related to missing authentication for a critical function CWE-306, allows an unauthenticated attacker to...
About Elevation of Privilege - NT OS Kernel (CVE-2026-42980) vulnerability
About Elevation of Privilege - NT OS Kernel CVE-2026-42980 vulnerability. Information about this vulnerability was disclosed as part of the June Microsoft Patch Tuesday on June 9. The vulnerability was not specifically highlighted in Microsoft Patch Tuesday reviews published by VM vendors. This...
About Remote Code Execution - ViPNet Client (BDU:2026-09885) vulnerability
About Remote Code Execution - ViPNet Client BDU:2026-09885 vulnerability. The ViPNet Client software suite is designed to protect corporate users' workstations by providing secure data exchange over IP networks, controlling the network activity of applications and operating system components, and...
ΠΡΠ»ΡΡΠΊΠΈΠΉ Linux Patch Wednesday
July Linux Patch Wednesday. A total of 2,017 vulnerabilities were addressed 539 in the Linux kernel and 504 in Chromium. For comparison, there were 1,888 vulnerabilities in June. Once again, a new record. Moreover, next month will most likely set another record, as 1,704 vulnerabilities have...
July Microsoft Patch Tuesday
July Microsoft Patch Tuesday. In the second week of July, I was on vacation in St. Petersburg. After that, I got caught up with a bunch of other tasks, so I'm only publishing this roundup now. Better late than never, especially considering how unusual this MSPT turned out to be. π In total, 571...
July "In the Trend of VM" (#29): Microsoft Exchange Server vulnerability
July "In the Trend of VM" 29: Microsoft Exchange Server vulnerability. Here is my traditional monthly roundup of trending vulnerabilities, according to Positive Technologies. The previous June edition featured four vulnerabilities. This time, there's only one. π Post on Habr rus π Digest on the P...
About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability
About Cross Site Scripting - Microsoft Exchange CVE-2026-42897 vulnerability. The vulnerability was fixed on May 14 outside the regular Microsoft Patch Tuesday cycle. Improper neutralization of input during web page generation CWE-79, XSS in Microsoft Exchange Server allows an unauthorized attack...
June Linux Patch Wednesday
June Linux Patch Wednesday. A total of 1,888 vulnerabilities 324 in the Linux kernel, and a whopping 728 in Chromium βοΈ. For comparison, there were 1,638 vulnerabilities in May. The increase isn't as dramatic as it was from April to May, but it's still a new record. One of the vulnerabilities has...
June Microsoft Patch Tuesday
June Microsoft Patch Tuesday. Last week I was on vacation in Veliky Novgorod, so I'm publishing this overview only now. A total of 202 vulnerabilities were addressed, approximately twice as many as in May. There are currently no vulnerabilities marked as exploited in the wild. However, there are...
June "In the Trend of VM" (#28): Linux kernel, Microsoft Defender, and Palo Alto Networks device vulnerabilities
June "In the Trend of VM" 28: Linux kernel, Microsoft Defender, and Palo Alto Networks device vulnerabilities. Presenting the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. In the previous May edition, we covered four vulnerabilities. This time, there...
About Elevation of Privilege - Microsoft Defender "RedSun" (CVE-2026-41091) vulnerability
About Elevation of Privilege - Microsoft Defender "RedSun" CVE-2026-41091 vulnerability. Microsoft Defender is a built-in security solution developed by Microsoft to protect the Windows operating system and user data from viruses, malware, and other cyber threats in real time. An improper link...
About Remote Code Execution - PAN-OS (CVE-2026-0300) vulnerability
About Remote Code Execution - PAN-OS CVE-2026-0300 vulnerability. PAN-OS is an operating system for Palo Alto Networks firewalls and security platforms. User-IDβ’ Authentication Portal also known as Captive Portal is a non-default PAN-OS feature used to map IP addresses to usernames. By exploiting...
May Linux Patch Wednesday
May Linux Patch Wednesday. A total of 1,638 vulnerabilities 474 in the Linux kernel. For comparison, in April there were 1,035 vulnerabilities a record!. And this time it turns out to be a record again, more than one and a half times higher! The acceleration is both impressive and alarming. But w...
About Elevation of Privilege - Linux Kernel "Fragnesia" (CVE-2026-46300) vulnerability
About Elevation of Privilege - Linux Kernel "Fragnesia" CVE-2026-46300 vulnerability. The vulnerability was discovered by researcher William Bowling together with the V12 team. Fragnesia belongs to the class of Dirty Frag vulnerabilities. It is an error in the ESP/XFRM subsystem, distinct from...
May "In the Trend of VM" (#27): high-profile vulnerabilities in Linux, ActiveMQ, SharePoint, and Adobe Acrobat Reader
May "In the Trend of VM" 27: high-profile vulnerabilities in Linux, ActiveMQ, SharePoint, and Adobe Acrobat Reader. Presenting the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. While the previous April edition featured only one vulnerability, this one...
May Microsoft Patch Tuesday
May Microsoft Patch Tuesday. A total of 119 vulnerabilities, approximately 1.5 times fewer than in April. There are currently no vulnerabilities marked as actively exploited in the wild. However, there is one vulnerability with a public exploit: πΈ EoP - Windows Kernel CVE-2026-40369. A detailed...
About Remote Code Execution - Apache ActiveMQ (CVE-2026-34197) vulnerability
About Remote Code Execution - Apache ActiveMQ CVE-2026-34197 vulnerability. Apache ActiveMQ is a popular open-source message broker written in Java. Its main purpose is to send messages between different services, systems, and microservices without a direct connection between them. This...
ΠΡΠΎ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΡ Spoofing - Microsoft SharePoint Server (CVE-2026-32201)
About Spoofing - Microsoft SharePoint Server CVE-2026-32201 vulnerability. A vulnerability from the April Microsoft Patch Tuesday. The description provided by Microsoft experts is extremely vague: "Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform...
About Elevation of Privilege vulnerability - Linux Kernel "Dirty Frag" (CVE-2026-43284, CVE-2026-43500) vulnerability
About Elevation of Privilege vulnerability - Linux Kernel "Dirty Frag" CVE-2026-43284, CVE-2026-43500 vulnerability. According to information from researcher Hyunwoo Kim @v4bel, Dirty Frag is a vulnerability a class of vulnerabilities that allows a local unprivileged attacker to obtain root...
About Elevation of Privilege - Linux Kernel "Copy Fail" (CVE-2026-31431) vulnerability
About Elevation of Privilege - Linux Kernel "Copy Fail" CVE-2026-31431 vulnerability. A local privilege escalation vulnerability in the Linux kernel AFALG component, which is caused by a memory handling flaw, allows an unprivileged user to escalate privileges to root. By exploiting this...
April "In the Trend of VM" (#26): one Microsoft SharePoint vulnerability
April "In the Trend of VM" 26: one Microsoft SharePoint vulnerability. Presenting the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. Once again, it is single-vendor, Microsoft-related, and this time it could not be more compact. While the previous Marc...
April Linux Patch Wednesday
April Linux Patch Wednesday. In April, Linux vendors addressed 1,035 vulnerabilities - nearly twice as many as in March. One might assume that most of these would again be Linux Kernel vulnerabilities, but that's not the case! Linux Kernel vulnerabilities were relatively few - just 209. The...
April Microsoft Patch Tuesday
April Microsoft Patch Tuesday. A total of 167 vulnerabilities, about twice as many as in March. There is one vulnerability already being exploited in the wild: π» Spoofing - Microsoft SharePoint Server CVE-2026-32201. ZDI experts say "Spoofing bugs in SharePoint often manifest as cross-site...
About Remote Code Execution - Adobe Reader (CVE-2026-34621) vulnerability
About Remote Code Execution - Adobe Reader CVE-2026-34621 vulnerability. Adobe Acrobat Reader from 2003 to 2015, "Adobe Reader" is a free PDF viewer developed by Adobe. Versions are available for Windows, macOS, Android, and iOS. The remote code execution vulnerability in Adobe Acrobat for Window...
About Remote Code Execution - Microsoft SharePoint (CVE-2026-20963) vulnerability
About Remote Code Execution - Microsoft SharePoint CVE-2026-20963 vulnerability. This vulnerability was fixed in the January MSPT. At the time of the MSPT release on January 13, VM vendors did not highlight this vulnerability in their reviews, and Microsoft reported no evidence of exploitation in...
March Linux Patch Wednesday
MarchLinux Patch Wednesday. In March, Linux vendors began addressing 575 vulnerabilities, which is 57 fewer than in February. Of these, 93 are in the Linux Kernel β¬οΈ a significant decrease - there were 305 in February. There are two vulnerabilities with signs of in-the-wild exploitation: π» RCE -...
March "In the Trend of VM" (#25): once again, vulnerabilities are only in Microsoft products
March "In the Trend of VM" 25: once again, vulnerabilities are only in Microsoft products. I present the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. As in February, it turned out to be quite compact and focused on a single vendor. π Post on Habr rus...
About the Remote Code Execution Vulnerability - n8n (CVE-2025-68613)
About Remote Code Execution Vulnerability - n8n CVE-2025-68613. n8n is a workflow automation platform available under a fair-code license. Improper Control of Dynamically-Managed Code Resources CWE-913 in the n8n workflow expression evaluation system allows a remote authenticated attacker without...
About Elevation of Privilege - Desktop Window Manager (CVE-2026-21519) vulnerability
About Elevation of Privilege - Desktop Window Manager CVE-2026-21519 vulnerability. The vulnerability is from the February Microsoft Patch Tuesday. Desktop Window Manager is a compositing window manager included in Windows starting with Windows Vista. A Type Confusion error CWE-843 in Desktop...
About Elevation of Privilege - Windows RDS (CVE-2026-21533) vulnerability
About Elevation of Privilege - Windows RDS CVE-2026-21533 vulnerability. The vulnerability is from the February Microsoft Patch Tuesday. Remote Desktop Services RDS is a component of Microsoft Windows that allows a user to initiate and control an interactive session on a remote computer or virtua...
March Microsoft Patch Tuesday
March Microsoft Patch Tuesday. A total of 79 vulnerabilities, about one and a half times more than in February. What's truly unusual is that this time there were no vulnerabilities with signs of exploitation in the wild or a public exploit! π€ At least not yet. π The following vulnerabilities can ...
About Remote Code Execution β Windows Shell (CVE-2026-21510) vulnerability
About Remote Code Execution - Windows Shell CVE-2026-21510 vulnerability. A vulnerability from the February Microsoft Patch Tuesday. The Windows Shell is the primary interface through which users interact with the Windows operating system. It includes visible elements such as the Desktop, Taskbar...
About Remote Code Execution β Microsoft Word (CVE-2026-21514) vulnerability
About Remote Code Execution - Microsoft Word CVE-2026-21514 vulnerability. This vulnerability is from February Microsoft Patch Tuesday. Reliance on Untrusted Inputs in a Security Decision CWE-807 in Microsoft Office Word allows an unauthenticated attacker to bypass OLE security features when...
February Linux Patch Wednesday
FebruaryLinux Patch Wednesday. In February, Linux vendors addressed 632 vulnerabilities - 1.5Γ fewer than in January, including 305 in the Linux Kernel. Two vulnerabilities show signs of in-the-wild exploitation: π» RCE - Chromium CVE-2026-2441 π» InfDisc - MongoDB "MongoBleed" CVE-2025-14847 Publi...
February βIn the Trend of VMβ (#24): vulnerabilities in Microsoft products
February "In the Trend of VM" 24: vulnerabilities in Microsoft products. A traditional monthly roundup of trending vulnerabilities. This time, compact and all-Microsoft. π Post on Habr rus π Digest on the PT website rus In total, two vulnerabilities: π» RCE - Microsoft Office CVE-2026-21509 π»...
February Microsoft Patch Tuesday
February Microsoft Patch Tuesday. A total of 55 vulnerabilities, half as many as in January. There are as many as six βοΈ vulnerabilities being exploited in the wild: π» SFB/RCE - Windows Shell CVE-2026-21510 π» SFB/RCE - Microsoft Word CVE-2026-21514 π» SFB - MSHTML Framework CVE-2026-21513 π» EoP -...
I released Vulristics 1.0.11: added Server-Side Request Forgery (SSRF) as a distinct vulnerability type
I releasedVulristics 1.0.11: added Server-Side Request Forgery SSRF as a distinct vulnerability type. I try to use a very small set of base vulnerability types around 20 in Vulristics and map everything else to them. With a few exceptions, these are the same types Microsoft uses - and Microsoft...
About Remote Code Execution β Microsoft Office (CVE-2026-21509) vulnerability
About Remote Code Execution - Microsoft Office CVE-2026-21509 vulnerability. The vulnerability was urgently fixed on January 26, outside the regular Microsoft Patch Tuesday. Microsoft classified it as a Security Feature Bypass, but in fact, it is more of a Remote Code Execution. The vulnerability...
January βIn the Trend of VMβ (#23): vulnerabilities in Windows, React and MongoDB
January "In the Trend of VM" 23: vulnerabilities in Windows, React and MongoDB. Traditional monthly roundup of trending vulnerabilities. Launching the 2026 season. π π Post on Habr rus π Digest on the PT website rus In total, three vulnerabilities: π» EoP - Windows Cloud Files Mini Filter Driver...
January Linux Patch Wednesday
JanuaryLinux Patch Wednesday. In January, Linux vendors started fixing 918 vulnerabilities, one and a half times more than in December. Of these, 616 are in the Linux Kernel. Three show signs of exploitation in the wild: π» AuthBypass - GNU Inetutils telnetd CVE-2026-24061 π» RCE - Safari...
Our PR team awarded me the βThe Best Positive Speaker 2025β metal pin for public speaking, articles, and media commentary
Our PR team awarded me the βThe Best Positive Speaker 2025β metal pin for public speaking, articles, and media commentary. Huge thanks to my colleagues for this! Iβm very pleased. π The collection is growing. π This time, the pin is styled like the Friends sitcom logo. Itβs made of metal, coated...
About Information Disclosure β Desktop Window Manager (CVE-2026-20805) vulnerability
About Information Disclosure - Desktop Window Manager CVE-2026-20805 vulnerability. Desktop Window Manager is a compositing window manager that has been part of Windows since Windows Vista. Exploitation of the vulnerability, which was addressed in the January Microsoft Patch Tuesday, allows a loc...
About Authentication Bypass β GNU Inetutils (CVE-2026-24061) vulnerability
About Authentication Bypass - GNU Inetutils CVE-2026-24061 vulnerability. GNU Inetutils is a collection of common network programs, including, among other things, a Telnet server telnetd. A vulnerability in GNU Inetutils telnetd allows a remote attacker to obtain a root shell on the host without...
About Information Disclosure β MongoDB βMongoBleedβ (CVE-2025-14847) vulnerability
About Information Disclosure - MongoDB "MongoBleed" CVE-2025-14847 vulnerability. MongoDB is a popular NoSQL database that stores data as JSON-like documents with an optional schema. The project is licensed under the SSPL. A flaw in MongoDBβs handling of the data length parameter during zlib...
About SQL Injection β Django (CVE-2025-64459) vulnerability
About SQL Injection - Django CVE-2025-64459 vulnerability. Django is a free and open-source high-level Python web framework. The vulnerability allows attackers to manipulate database query logic by injecting internal query parameters connector and negated when applications pass user-controlled...
November Linux Patch Wednesday
NovemberLinux Patch Wednesday. In November, Linux vendors began fixing 516 vulnerabilities, one and a half times fewer than in October. Of these, 232 are in the Linux Kernel. One vulnerability is exploited in the wild: MemCor - Chromium CVE-2025-13223. Added to CISA KEV on November 19. For 64 mor...
November βIn the Trend of VMβ (#21): vulnerabilities in Windows, SharePoint, Redis, XWiki, Zimbra Collaboration, and Linux
November "In the Trend of VM" 21: vulnerabilities in Windows, SharePoint, Redis, XWiki, Zimbra Collaboration, and Linux. The usual monthly roundup. After several months, here's a big one. Post on Habr rus Post on SecurityLab rus Digest on the PT website rus A total of nine vulnerabilities: RCE -...
November Microsoft Patch Tuesday
November Microsoft Patch Tuesday. A total of 65 vulnerabilities. I'm not comparing this with the October report because I've decided to cover only MSPT-day vulnerabilities. The thing is, Microsoft has started massively adding Linux-product vulnerabilities to their official website, and these...