🟡VulnerabilitiesMEDIUM
Adobe Patches 123 Vulnerabilities
Adobe patched 123 vulnerabilities across 11 products; ColdFusion and Campaign Classic flaws are priority 1 (expected exploitation). Most are XSS issues in Experience Manager.
🟡Vulnerabilities2120 stories · page 41 of 71
Vulnerabilities
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
🟡VulnerabilitiesMEDIUM
Microsoft Patches 200 Vulnerabilities
**Summary:** Microsoft patched 200 vulnerabilities in June, including three pre-disclosed threats: a Windows DoS, BitLocker bypass, and privilege escalation. All rated "exploitation more likely" requiring urgent action.
🟡VulnerabilitiesMEDIUM
Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs
Two Russian threat groups exploit patched WinRAR flaw (CVE-2025-8088) against Ukrainian military targets. Despite a July 2025 patch, they continue generating new attack samples as of April 2026.
🟡VulnerabilitiesMEDIUM
Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address
Microsoft Exchange's 'Ghost-Sender' vulnerability allows unauthenticated email spoofing in hybrid environments, bypassing SPF/DKIM/DMARC security controls. Attackers can impersonate any user for CEO fraud or invoice scams. Active exploitation confirmed.
🟡VulnerabilitiesCRITICAL
Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code
Veeam RCE (CVE-2026-44963, CVSS 9.4) allows authenticated users to execute code with backup privileges. Low entry barrier, catastrophic impact: backup takeover, ransomware deployment, data loss.
🟡VulnerabilitiesMEDIUM
Microsoft releases Windows 10 KB5094127 extended security update
KB5094127 patches June Windows 10 vulnerabilities while managing Secure Boot certificate expiration—preventing boot failures that could affect millions of enterprise systems.
🟡VulnerabilitiesCRITICAL
SAP fixes critical flaws in NetWeaver and Commerce Cloud
SAP released critical patches (June 11) for 15 vulnerabilities affecting NetWeaver and Commerce Cloud. A critical unauthenticated remote code execution flaw in NetWeaver poses immediate risk to unpatched deployments; enterprises should patch urgently.
🟡VulnerabilitiesMEDIUM
Meta to Use Off-Site Business Data for Feed and AI Personalization
Meta is expanding its use of off-site business data from targeted ads to Feed personalization and AI responses. This broadens privacy concerns as regulators scrutinize the company.
🟡VulnerabilitiesMEDIUM
XBOW tests Anthropic's Mythos Preview for offensive security
Mythos Preview significantly improves vulnerability detection in source code analysis, but independent testing by security firm XBOW shows it still requires human expertise and live validation to identify real exploits.
🟡VulnerabilitiesMEDIUM
Windows 11 KB5094126 & KB5093998 cumulative updates released
Microsoft's June 9, 2026 Windows 11 Patch Tuesday updates deliver security fixes and new features like Bluetooth LE audio sharing across versions 25H2, 24H2, and 23H2. Install immediately via Settings > Windows Update; updates are mandatory and require a restart.
🟡VulnerabilitiesCRITICAL
Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws
Microsoft patched 200 vulnerabilities in June 2026, including 33 Critical-severity flaws and three publicly disclosed zero-days. While currently unexloited, the public disclosure accelerates attack timelines, making urgent patching essential to prevent widespread exploitation.
🟡VulnerabilitiesHIGH
Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation
Claude Mythos creates working exploits for known vulnerabilities in hours, outpacing typical patch timelines. This AI-accelerated exploit development collapses the traditional security response window, leaving defenders exposed.
🟡VulnerabilitiesCRITICAL
New Veeam vulnerability exposes backup servers to RCE attacks
Critical Veeam Backup RCE (CVE-2026-44963) affects v12.x; authenticated users can execute code on backup servers. Urgent patching needed; v13.x unaffected. Backup infrastructure is a key ransomware target.
🟡VulnerabilitiesHIGH
Will AI Kill the Bug Bounty Industry?
AI automation is collapsing vulnerability discovery scarcity, upending bug bounty economics. Anthropic's Mythos shows AI can accelerate security research to machine speed, forcing industry transformation.
🟡VulnerabilitiesHIGH
New Platform Uses Cryptographic Invisibility to Protect AI-Built Applications
Atsign's AI Architect uses cryptographic invisibility to protect AI agents from identity-based attacks by making application credentials undiscoverable and unexploitable.
🟡VulnerabilitiesCRITICAL
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now
Google patched CVE-2026-11645, a critical V8 vulnerability (CVSS 8.8) under active exploitation in the wild. The out-of-bounds memory flaw enables attackers to escape Chrome's sandbox and execute arbitrary code with user privileges.
🟡VulnerabilitiesHIGH
WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine
Russian-aligned hackers exploit a patched WinRAR flaw (CVE-2025-8088) to deliver stealing malware to Ukrainian targets through malicious RAR files—nearly a year after patches became available.
🟡VulnerabilitiesCRITICAL
SAP Patches Critical NetWeaver, Commerce Vulnerabilities
SAP patched four critical vulnerabilities in its NetWeaver ERP platform affecting financial services, manufacturing, and healthcare enterprises. Flaws enable identity spoofing via XML signature manipulation and unauthenticated remote code execution through memory corruption, requiring immediate ente
🟡VulnerabilitiesMEDIUM
New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing
FROST exploits SSD timing variations through JavaScript to track which websites and apps you visit, achieving 89-96% accuracy on macOS and Linux with no permissions or traces. This passive browser-based side-channel attack could remotely target millions of users simultaneously.
🟡VulnerabilitiesCRITICAL
CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day
CISA ordered federal agencies to patch a critical Check Point VPN vulnerability within 72 hours. The CVSS 9.8 flaw enables authentication bypass, and Qilin ransomware actively exploits it for network access.
🟡VulnerabilitiesCRITICAL
Google patches new Chrome zero-day flaw exploited in the wild
Google released an emergency patch for CVE-2026-XXXXX, a critical Chrome zero-day actively exploited in targeted attacks against government officials and security researchers. The use-after-free vulnerability in Chrome's rendering engine enables remote code execution across Windows, macOS, and Linux
🟡VulnerabilitiesHIGH
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
CVE-2026-42271 is a critical command injection flaw in LiteLLM now actively exploited. Authenticated attackers can execute arbitrary code via unsanitized input. The 10M-download library is widely used in AI/ML pipelines.
🟡VulnerabilitiesCRITICAL
Google Patches 5th Chrome Zero-Day Exploited in 2026
Google released Chrome 149 to patch CVE-2026-11645, a critical V8 vulnerability actively exploited in the wild. This marks the fifth zero-day discovered in 2026, reflecting an accelerating threat landscape as attackers chain memory vulnerabilities with sandbox escapes for full system compromise.
🟡VulnerabilitiesHIGH
Check Point VPN Flaw Exploited Since Early May
Check Point VPN critical flaw (CVE-2026-50751) bypasses authentication and is actively exploited by ransomware attackers to breach corporate networks. IKEv1 users must patch immediately.
🟡VulnerabilitiesHIGH
One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public
CVE-2026-23111, a one-character Linux kernel bug in nf_tables, enables unprivileged root escalation. Public exploits are now available; despite February patches, many systems remain vulnerable.
🟡VulnerabilitiesMEDIUM
Everybody Is Vibe Coding But Nobody Told the Security Team
AI-generated code outpaces traditional security review, leaving organizations flying blind. As developers embrace rapid "vibe coding" workflows, security gatekeeping mechanisms designed for slower development cycles fail to catch risks—including outdated cryptographic standards and unapproved depend
🟡VulnerabilitiesMEDIUM
A Security Raises $37 Million for Autonomous Offensive Security Platform
A Security raised $37M Series A funding to automate vulnerability discovery and remediation using autonomous agents. The startup simulates AI-driven attacks to identify and fix vulnerabilities before attackers can exploit them, addressing the growing complexity of enterprise threat defense.
🟡VulnerabilitiesMEDIUM
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud
"Hades" campaign compromises 37 PyPI wheels using Shai-Hulud malware to steal developer credentials and establish persistent supply chain footholds, marking an escalation from one-time injections to self-sustaining threats in the open-source ecosystem.
🟡VulnerabilitiesCRITICAL
Gogs patches critical zero-day enabling remote code execution
Gogs patched a critical RCE vulnerability after Rapid7 disclosure. An argument injection flaw exploits default settings enabling unauthenticated users to escalate privileges and compromise instances.
🟡VulnerabilitiesCRITICAL
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups
Critical Check Point VPN bypass (CVE-2026-50751) allows unauthenticated access via IKEv1 certificate validation flaw. Qilin ransomware group actively exploiting dozens of organizations globally since May 2026, downloading malicious payloads post-breach.