vulnerability

Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973)

May 8, 2026

Ivanti has released fixes for 5 high-severity vulnerabilities in its Endpoint Manager Mobile (EPMM) solution, one of which (CVE-2026-6973) has being exploited as a zero-day by …

One keypress is all it takes to compromise four AI coding tools

May 7, 2026

Developers clone unfamiliar repositories all the time. Open-source projects, work from teammates, sample code from a tutorial, a library someone recommended on a forum. The …

Unpatched flaws turn Ollama’s auto-updater into a persistent RCE vector, researchers say

May 5, 2026

Researchers at Striga have disclosed two vulnerabilities (CVE-2026-42248, CVE-2026-42249) in Ollama’s Windows auto-updater that, when chained together, may allow an …

Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670)

May 4, 2026

Progress Software has fixed a critical authentication bypass (CVE-2026-4670) and a privilege escalation (CVE-2026-5174) vulnerability in MOVEit Automation, exploitation of …

Multiple threat actors actively exploit cPanel vulnerability (CVE-2026-41940)

May 4, 2026

The situation around the critical cPanel authentication bypass vulnerability (CVE-2026-41940) has deteriorated significantly since our initial coverage. Exploratory probing …

Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)

April 30, 2026

Security researchers at Theori have disclosed a high-severity local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel. The flaw, nicknamed …

88% of self-hosted GitHub servers exposed to RCE, researchers warn (CVE-2026-3854)

April 29, 2026

When researchers at Wiz reported an easily exploitable GitHub remote code execution flaw (CVE-2026-3854) on March 4, the company confirmed it within 40 minutes and pushed a …

CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202)

April 29, 2026

Attackers are exploiting CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability that causes victims’ systems to authenticate the attacker’s server, CISA …

Apple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950)

April 23, 2026

Apple has rolled out security updates for iPhones and iPads that fix CVE-2026-28950, a logging issue in Notification Services that made devices unexpectedly retain …

Progress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876)

April 22, 2026

Progress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall …

Fortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808)

April 16, 2026

Two vulnerabilities (CVE-2026-39813, CVE-2026-39808) in FortiSandbox could be leveraged by unauthenticated attackers to bypass authentication and execute unauthorized code or …

Tails 7.6.2 patches vulnerability that could expose saved files