patch

Google “confirms” that exploited Chrome zero-day is actually in libwebp (CVE-2023-5129)

September 27, 2023

UPDATE (September 28, 2023, 03:15 a.m. ET): The CVE-2023-5129 ID has been either rejected or withdrawn by the CVE Numbering Authority (Google), since it’s a duplicate of …

Critical Trend Micro vulnerability exploited in the wild (CVE-2023-41179)

September 21, 2023

Trend Micro has fixed a critical zero-day vulnerability (CVE-2023-41179) in several of its endpoint security products for enterprises that has been spotted being exploited in …

Microsoft, Adobe fix zero-days exploited by attackers (CVE-2023-26369, CVE-2023-36761, CVE-2023-36802)

September 12, 2023

September 2023 Patch Tuesday is here, with fixes for actively exploited vulnerabilities in Adobe Acrobat and Reader (CVE-2023-26369), Microsoft Word (CVE-2023-36761), and …

VMware Aria Operations for Networks vulnerability exploited in the wild (CVE-2023-20887)

June 21, 2023

CVE-2023-20887, a pre-authentication command injection vulnerability in VMware Aria Operations for Networks (formerly vRealize Network Insight), has been spotted being …

Easily bypassed patch makes zero-click Outlook flaw exploitable again (CVE-2023-29324)

May 10, 2023

Among the vulnerabilities fixed by Microsoft on May 2023 Patch Tuesday is CVE-2023-29324, a bug in the Windows MSHTML platform that Microsoft rates as “important.” …

Easily exploitable flaw in Oracle Opera could spell trouble for hotel chains (CVE-2023-21932)

May 2, 2023

A recently patched vulnerability (CVE-2023-21932) in Oracle Opera, a property management system widely used in large hotel and resort chains, is more critical than Oracle says …

Veeam Backup & Replication admins, get patching! (CVE-2023-27532)

March 10, 2023

Veeam Software has patched CVE-2023-27532, a high-severity security hole in its widely-used Veeam Backup & Replication solution, and is urging customer to implement the …

Admins, patch your Cisco enterprise security solutions! (CVE-2023-20032)

February 17, 2023

Cisco has released security updates for several of its enterprise security and networking products, fixing (among other things): A critical vulnerability (CVE-2023-20032) in …

Pre-auth RCE in Oracle Fusion Middleware exploited in the wild (CVE-2021-35587)

November 29, 2022

A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has been fixed in January 2022 is being exploited by attackers in the wild, the …

Microsoft fixes many zero-days under attack

November 8, 2022

November 2022 Patch Tuesday is here, with fixes for many vulnerabilities actively exploited in the wild, including CVE-2022-41091, a Windows Mark of the Web bypass flaw, and …

The state of coordinated vulnerability disclosure policies in EU

April 19, 2022

The European Union Agency for Cybersecurity (ENISA) publishes a map of national coordinated vulnerability disclosure (CVD) policies in the EU Member States and makes …

Veeam fixes critical RCEs in backup solution (CVE-2022-26500, CVE-2022-26501)

March 15, 2022

Veeam Software has patched two critical vulnerabilities (CVE-2022-26500, CVE-2022-26501) affecting its popular Veeam Backup & Replication solution, which could be …