All security alerts
29 alerts published · A daily watch on web application security
Servers FreeBSD: a confidentiality flaw to fix quickly
CERT-FR warns of a vulnerability in FreeBSD that could compromise data confidentiality. Patch to be applied quickly.
Read the article
Frameworks MediaWiki fixes XSS flaws and data leakage
Debian has released a MediaWiki fix for several flaws that could lead to XSS and information disclosure on exposed wikis.
Read the article
Servers Debian fixes critical Linux kernel flaws to watch
Debian has released DSA-6355-1 to fix several Linux kernel flaws that could lead to privilege escalation, denial of service, or information leakage.
Read the article
Servers FFmpeg fixes PixelSmash, an RCE threatening Jellyfin
FFmpeg fixes PixelSmash, a flaw that could lead to remote code execution on Jellyfin via video decoding. Update recommended.
Read the article
Frameworks Moodle fixes several security flaws that need to be addressed quickly
CERT-FR warns of several vulnerabilities in Moodle that could cause denial of service, information disclosure, and other impacts depending on the versions.
Read the article
CVE Cisco Unified CM: CVE-2026-20230 SSRF already exploited
Cisco Unified CM fixes CVE-2026-20230, a high-severity SSRF flaw already being exploited that could expose internal services.
Read the article
Browsers Chrome fixes critical flaws in the desktop stable channel
Google has released a security update for Chrome desktop stable that fixes several vulnerabilities that could lead to a crash or code execution.
Read the article
Servers PHP 8.4 fixes several server-side risk vulnerabilities
Debian has released a security fix for PHP 8.4. Several vulnerabilities may affect confidentiality, integrity, and availability.
Read the article
Servers OpenVPN fixes a critical server-side flaw
OpenVPN receives a server-side security fix via Debian. A flaw can expose VPN infrastructures and requires a rapid update.
Read the article
Servers Lantronix EDS5000: critical flaw exploited, CISA warns
CISA is warning about a critically severe flaw being actively exploited in Lantronix EDS5000, with a risk of code execution and device compromise.
Read the article
Servers cURL and libcurl: multiple vulnerabilities to fix on the server side
CERT-FR warns of several vulnerabilities in cURL and libcurl that could cause denial of service, information disclosure, or other security issues.
Read the article
Servers cpp-httplib: HTTP header injection to fix on the server side
A flaw in cpp-httplib allows HTTP header injection via percent-decoding. Exposed C++ servers and tools should be updated.
Read the article
Servers xrdp fixes critical remote pre-auth flaws
xrdp fixes several pre-authentication flaws that could lead to code execution or denial of service on Linux servers exposed over RDP.
Read the article
CVE PTC Windchill: critical RCE exploited, CISA mandates patching
CISA is warning about a critical PTC Windchill RCE flaw already being exploited via web shells. Exposed servers must be patched without delay.
Read the article
CVE FatFs: 7 flaws affect millions of embedded devices
Seven vulnerabilities in FatFs expose millions of embedded devices to memory corruption, crashes, and possible code execution.
Read the article
Servers Bad Epoll: CVE-2026-46242 gives root on Linux
The Linux flaw CVE-2026-46242 allows a local unprivileged user to obtain root privileges on Linux servers and Android devices.
Read the article
Servers Tenable Nessus: SQLi flaws to fix without delay
CERT-FR warns of several vulnerabilities in Tenable Nessus, including SQL injections that could compromise the platform’s integrity.
Read the article
Frameworks Amazon Q Developer: booby-trapped repository, code execution, and AWS theft
A flaw in Amazon Q Developer allowed a malicious repository to execute commands and steal cloud credentials via booby-trapped MCP configs.
Read the article
Servers Linux: CVE-2026-46331 opens the way to local root
The CVE-2026-46331 flaw in the Linux kernel allows an unprivileged local user to obtain root privileges on affected systems.
Read the article
Best practices Booby-trapped GitHub repository: AI agents execute malware
An apparently healthy GitHub repository can push AI coding agents to execute malware during setup, with a risk of secret theft and CI/CD compromise.
Read the article
CVE libssh2 CVE-2026-55200: Public PoC for a Critical Flaw
A public PoC targets libssh2 via a malicious SSH server and can trigger client-side memory corruption. Update quickly.
Read the article
Servers nghttp2/nghttpx: an HTTP/1.1 flaw can bring down the proxy
A flaw in nghttp2/nghttpx allows a remote attacker to cause a denial of service via improperly handled HTTP/1.1 Upgrade requests.
Read the article
CVE SharePoint: May RCE now actively exploited
CISA warns that a Microsoft SharePoint RCE flaw, patched in May, is now being actively exploited. Admins and CISOs should verify exposure and apply the patch.
Read the article
CVE Oracle E-Business Suite: CVE-2026-46817 actively exploited
Oracle E-Business Suite is targeted by CVE-2026-46817, a critical flaw actively exploited that could compromise the financial application.
Read the article
Servers LoadMaster: Critical pre-auth root RCE to patch urgently
A critical flaw in Progress Kemp LoadMaster could allow unauthenticated root command execution on the appliance.
Read the article
Servers Citrix NetScaler fixes 6 critical flaws in ADC and Gateway
Citrix has released fixes for six flaws in NetScaler ADC and Gateway, including file read and denial-of-service issues on exposed appliances.
Read the article
Frameworks Adobe ColdFusion: 7 critical vulnerabilities to patch urgently
Adobe fixes seven maximum-severity flaws in ColdFusion and Campaign Classic, with risk of code execution and server compromise.
Read the article
CVE SharePoint CVE-2026-45659: Active RCE, CISA Sounds the Alarm
The RCE flaw CVE-2026-45659 in Microsoft SharePoint Server is now being actively exploited. Admins and CISOs must patch without delay.
Read the article
Servers Argo CD: an unpatched flaw threatens Kubernetes clusters
An unpatched flaw in the Argo CD repo-server could let an unauthenticated attacker compromise Kubernetes clusters.
Read the article