Vulnerabilities fixed in Google Android and Samsung Mobile

Google has patched vulnerabilities in Android. Samsung has also addressed the vulnerabilities relevant to Samsung Mobile devices. The critical vulnerabilities include remote code execution capabilities and privilege escalation. This allows attackers to gain unauthorized access to system component...

Vulnerability fixed in WordPress Core

WordPress has addressed a vulnerability in WordPress Core versions 4.7 through 7.1.3. This vulnerability allows exploitation of a race condition known as Time-of-Check to Time-of-Use during full WordPress Core upgrades. As a result, an unauthenticated remote attacker can execute code on the serve...

Vulnerabilities fixed in Barracuda Email Security Gateway

Barracuda has patched vulnerabilities in the Barracuda Email Security Gateway. Barracuda identified two vulnerabilities across various Barracuda products: one related to authorization bypass CVE-2026-116606 and another related to command injection CVE-2026-111560. The first vulnerability involves...

ZeroDay vulnerabilities are exploited in Ivanti Connect Secure.

Ivanti has identified a vulnerability in Connect Secure. A malicious actor could exploit this vulnerability to execute arbitrary commands on the vulnerable system without any authentication. Ivanti reports being aware of reports that this vulnerability has been exploited as a ZeroDay vulnerabilit...

Vulnerability fixed in LXD by Canonical

Canonical has patched a vulnerability in LXD. The vulnerability CVE-2026-112816 stems from improper validation of certificate chains within Canonical’s LXD HTTPS API. It affects LXD versions prior to 4.0.15, 5.0.11, 5.21.9, and 6.10.1 within their respective release branches. As a result,...

Vulnerability fixed in Cisco Secure Firewall ASA and FTD Software

Cisco has addressed a critical vulnerability in the Cisco Secure Firewall Adaptive Security Appliance ASA and Cisco Secure Firewall Threat Defense FTD. Cisco confirms that this vulnerability is currently being actively exploited. This vulnerability, identified as CVE-2026-76418, carries a CVSS...

Vulnerabilities fixed in Juniper Networks Session Smart Router and Session Smart Conductor

Juniper has addressed multiple vulnerabilities in Juniper Networks Session Smart Router and Session Smart Conductor. These vulnerabilities affect various components within both products. - There are out-of-bounds read and write errors in the HTTP parser, TCP proxy, TCP header processing, and VRRP...

Vulnerabilities fixed in Linux kernel

Linux has patched vulnerabilities in the IPv4 TCP stack and the IPv4 networking subsystem of the Linux kernel. The first vulnerability involves a race condition in the IPv4 TCP stack that leads to a use-after-free of socket options during concurrent TCP SYN retransmissions or request socket...

Vulnerabilities fixed in Dell PowerProtect Data Domain

Dell has addressed multiple critical vulnerabilities in PowerProtect Data Domain, Data Domain Virtual Edition, and Data Domain Management Center. The critical vulnerabilities identified as CVE-2026-103780, CVE-2026-86384, CVE-2026-86397, and CVE-2026-86400 in Dell PowerProtect Data Domain carry a...

Vulnerabilities fixed in Apple MacOS

Apple has addressed multiple vulnerabilities in macOS, particularly in versions Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2, and Monterey 12.4. These vulnerabilities affect various aspects of macOS security, including insufficient validation of symbolic links, improper permission checks,...

Vulnerability fixed in Arista VeloCloud Orchestrator (VCO) on-premises

Arista has addressed a critical vulnerability in VeloCloud Orchestrator VCO On-Premises. The vulnerability, identified as CVE-2026-114625, carries a CVSS score of 9.9 and involves SQL injection. An authenticated malicious actor can exploit this vulnerability remotely to gain elevated privileges a...

Vulnerabilities have been addressed in Cisco Secure Firewall ASA, Threat Defense, and Management Center

Cisco has addressed vulnerabilities in the Secure Firewall ASA, Threat Defense, and Management Center software products. Cisco has categorized these vulnerabilities into eight distinct vulnerability classes CWE, assigning each a unique CVE identifier. The vulnerabilities involve various security...

Vulnerabilities fixed in Splunk Enterprise

Splunk has addressed multiple vulnerabilities in Splunk Enterprise. Various vulnerabilities exist in Splunk Enterprise versions prior to 10.4.4 and a few other specific versions. These include: - Improper validation in the Data Management REST API, allowing users with certain roles to create or...

Vulnerabilities fixed in Apple iOS and iPadOS

Apple has patched vulnerabilities in iOS and iPadOS. These vulnerabilities involve various security issues, including insufficient validation of symbolic links, improper permission checks, out-of-bounds read/write errors, use-after-free errors, integer overflows, race conditions, type confusion,...

Vulnerabilities in HPE Networking AOS

HPE has identified 72 vulnerabilities in HPE Networking’s AOS-8 and AOS-10 platforms, including Mobility Conductors, Mobility Controllers, Mobility Gateways, and Access Points. These vulnerabilities involve various security issues, such as authentication bypass, command and SQL injection, buffer...

Vulnerability in Google Brotli-decoder

Google has discovered a vulnerability in the Brotli decompression library. This library is used in Node.js. An unauthorized malicious actor can exploit this vulnerability to process specially crafted Brotli-compressed data remotely. Successful exploitation could lead to a denial-of-service attack...

vulnerabilities in the FreeBSD bhyve hypervisor

The FreeBSD community has addressed several vulnerabilities in the bhyve Hypervisor. These vulnerabilities involve race conditions, incorrect validation, and synchronization issues in various device models within the bhyve Hypervisor. A malicious guest virtual machine can exploit these errors to...

Vulnerabilities found in Cisco Expressway Series devices

Cisco has identified several vulnerabilities in the Cisco Expressway Series. These vulnerabilities involve insufficient authorization checks during Mobile and Remote Access provisioning, allowing unauthorized external attackers to gain access to sensitive information. Additionally, there is a...

Vulnerabilities in Snort 3 of Cisco

Cisco has addressed several vulnerabilities in Snort 3, the open-source intrusion detection and prevention system used in various Cisco products. These vulnerabilities reside in various components of the Snort 3 Detection Engine, including the SMTP MIME Decoder, NetFlow Detection Engine, GRE...

Several vulnerabilities exist in Oracle Java.

Oracle has identified several vulnerabilities in Oracle Java. In Oracle Java SE, JavaFX, and GraalVM Enterprise Edition, there are various vulnerabilities that can be exploited by unauthorized network attackers through exposed APIs or sandboxed Java applications. These vulnerabilities enable the...

Vulnerabilities in Oracle Fusion Middleware

Oracle has identified several vulnerabilities in various products, including the Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware including Helidon, and Oracle HTTP Server. These...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab has identified 12 vulnerabilities in the GitLab Community Edition and Enterprise Edition. One of these vulnerabilities is classified as critical. GitLab has addressed this vulnerability in both the GitLab Community Edition and Enterprise Edition, starting from version 7.0 up to certain 19....

Vulnerabilities in Oracle JD Edwards EnterpriseOne

Oracle has identified several vulnerabilities in Oracle JD Edwards EnterpriseOne Tools, specifically in versions 9.2.0.0 through 9.2.26.5. These vulnerabilities allow attackers to gain access to the system using various network protocols such as HTTP, HTTPS, and SMTP, either without authenticatio...

Vulnerabilities in Oracle Analytics

Oracle has identified 33 vulnerabilities in various Oracle Analytics products, including Oracle Business Intelligence Enterprise Edition and Oracle BI Publisher. The patch notes list these 33 vulnerabilities, among which 14 can be exploited remotely without the need for authentication. Depending ...

Vulnerabilities found in Oracle Communications

Oracle has identified 110 vulnerabilities in various Oracle Communications products, including Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Service Catalog and Design, and Oracle Communications Operations...

vulnerabilities handled in PHP

PHP has two critical vulnerabilities. These vulnerabilities can be exploited without authentication to execute arbitrary code. All PHP installations that process web requests are affected. The vulnerability with the identifier CVE-2026-109618 involves memory corruption during the handling of an...

vulnerabilities present in Oracle E-Business Suite

Oracle has identified 194 vulnerabilities in the Oracle E-Business Suite and related components, specifically for versions 12.2.3 through 12.2.15. Depending on the specific vulnerability, these can be exploited by an attacker with network access to obtain unauthorized access to data, or to modify...

vulnerabilities in Oracle MySQL

Oracle has identified vulnerabilities in various products, including Oracle MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors including Connector/ODBC, and MySQL Router. These vulnerabilities affect various components of Oracle products, such as MySQL Server, MySQL Cluster,...

Vulnerabilities are managed in Oracle Enterprise Manager

Oracle has identified several vulnerabilities in Oracle Enterprise Manager, including the Base Platform, Data Guard Management, Siebel, and Virtualization components. These vulnerabilities affect versions 13.5 and 24.1. The vulnerabilities in Oracle Enterprise Manager can lead to unauthorized...

Vulnerabilities in Oracle PeopleSoft Enterprise

Oracle has identified new vulnerabilities in Oracle PeopleSoft Enterprise. These vulnerabilities relate to various security risks, including unauthorized access to data, unauthorized modification of data, and disruption of system availability denial-of-service attacks. Depending on the specific...

Vulnerabilities present in Drupal Core and modules due to Drupal

Drupal has vulnerabilities in the Drupal Core Field UI module, Entity List module, Navigation module, Link module, and the Gin administration theme. These vulnerabilities affect multiple modules within Drupal. The Field UI module and the Entity List module contain a remote code execution...

Kwetsbaarheid verholpen in BeyondTrust Remote Support

BeyondTrust has discovered a critical vulnerability in BeyondTrust Remote Support. This vulnerability, identified as CVE-2026-102764, has a CVSS score of 9.3. It involves insufficient validation of the origin of messages within the product’s internal components. As a result, a malicious actor...

Vulnerabilities in Adobe Commerce

Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities involve stored Cross-Site Scripting XSS, where attackers can inject malicious JavaScript code into form fields within the application. This code is executed in the victim’s browser and can perform unauthorized...

Vulnerabilities in Adobe ColdFusion

Adobe has identified several vulnerabilities in Adobe ColdFusion. These vulnerabilities include Server-Side Request Forgery SSRF, incorrect authorization, improper input validation, code injection, XML External Entity XXE attacks, uncontrolled resource consumption, and path traversal. Attackers c...

Vulnerabilities handled in Fortinet FortiSIEM

Fortinet has identified vulnerabilities in FortiSIEM version 7.5.0. The first vulnerability involves a path traversal issue, where the system does not impose sufficient restrictions on pathnames leading to restricted directories. This allows unauthorized attackers to send specially crafted packet...

Vulnerabilities in IBM Guardium Data Protection

IBM has identified several vulnerabilities in the IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. These vulnerabilities include remote code execution through path traversal, multiple SQL injection issues, and various buffer overflow vulnerabilities heap-based, stack-based, and buffer...

Vulnerabilities in HPE Brocade Fabric OS

HPE has identified several security vulnerabilities in Brocade Fabric OS, particularly in versions prior to 10.0.1, as well as in the 9.2.x and 10.0.x release lines. These vulnerabilities include authentication bypasses, denial-of-service attacks, information leakage, privilege escalation, buffer...

Vulnerabilities found in IBM DataPower Gateway and its underlying components

IBM has addressed several security issues in DataPower Gateway versions 10.5 through 11.0, along with numerous underlying components. The vulnerabilities involve a wide range of problems, such as use-after-free bugs, race conditions, buffer overflows, null pointer dereferences, integer overflows,...

Vulnerabilities in Juniper Networks Junos OS

Juniper has identified several vulnerabilities in Junos OS. These vulnerabilities exist in various components of Junos OS, including the VXLAN Gateway Daemon vgd, kmd on MX Series routers, the SDK service with JDAF routing, the TWAMP client rmopd service, the gRPC library, the ipfd daemon on SRX...

Vulnerability exposure in Cisco Secure Email Gateway

Cisco has identified a vulnerability in Cisco Secure Email Gateway, specifically in the Advanced Malware Protection feature. The vulnerability lies in the way the Advanced Malware Protection feature processes email attachments when the file reputation service is enabled. An unauthenticated extern...

vulnerabilities in Fortinet FortiSandbox

Fortinet has identified vulnerabilities in FortiSandbox. The vulnerability with identifier CVE-2026-107656 has a CVSS score of 9.6 and involves an authentication bypass in the web management interface of FortiSandbox. An unauthorized malicious actor can bypass the authentication process through...

Vulnerabilities hidden in Ahsay AhsayCBS

Ahsay has fixed vulnerabilities in AhsayCBS up to version 10.3.2. The vulnerability with identifier CVE-2026-105133 has a CVSS score of 7.3 and involves insufficient authentication in the checkSysPwd function of the AhsayCBS API. An unauthorized malicious actor could exploit this vulnerability to...

vulnerabilities handled in Microsoft Developer Tools

Microsoft has identified vulnerabilities in various components of the Developer Tools, such as .NET and Visual Studio. Malicious actors can exploit these vulnerabilities, resulting in damages as described in the tables below. .NET: |------------------|------|-------------------------------------|...

Vulnerabilities in Microsoft System Center

Microsoft has identified vulnerabilities in Configuration Manager and Defender. A local malicious individual could exploit these vulnerabilities to gain elevated privileges and potentially access sensitive data. Microsoft Configuration Manager:...

Vulnerabilities in Microsoft Dynamics

Microsoft has addressed vulnerabilities in various Dynamics components. A malicious individual could exploit these vulnerabilities to execute attacks that can cause damage, as listed in the following tables: Microsoft Dataverse: | CVE-ID | CVSS | Impact | |--------|------|---------| |...

Vulnerabilities in Microsoft Windows

Microsoft has identified 1,159 vulnerabilities in Windows. It is too complex to list every vulnerability individually. The 53 most severe vulnerabilities, with a CVSS score of 9 or higher, are listed below. These vulnerabilities give malicious actors the ability to impersonate other users, gain...

vulnerabilities present in Microsoft Office

Microsoft has fixed xxx vulnerabilities in various Office products, such as Word, Excel, Access, Outlook, Visio, SharePoint, and PowerPoint, as well as subcomponents like Shell, Azure Key Vault, and Click-to-Run. A malicious actor could exploit these vulnerabilities to cause a denial-of, gain...

Vulnerabilities in Microsoft Azure

Microsoft has identified vulnerabilities in various Azure components, including Key Vault, DevOps, API Center, and Storage. Malicious actors could exploit these vulnerabilities to circumvent security measures, gain elevated privileges, execute arbitrary code, and access sensitive data. The...

Vulnerabilities in Microsoft SQL Server

Microsoft has identified vulnerabilities in SQL Server. Malicious actors could exploit these vulnerabilities to cause a denial-of-service attack, gain excessive privileges, execute arbitrary code, and potentially access sensitive data. Microsoft has provided updates that address these...

Vulnerabilities in Microsoft Exchange Server

Microsoft has addressed vulnerabilities in Exchange. A malicious individual could exploit these vulnerabilities to impersonate other users, gain elevated privileges, and execute arbitrary code with process rights. An out-of-band update was previously released for the vulnerability with identifier...