This vulnerability allows remote attackers to disclose sensitive information on affected installations of PublicCMS. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2.
The machine emulator has been abused in at least two different campaigns distributing ransomware and remote access tools. The post Hackers Abuse QEMU for Defense Evasion appeared first on SecurityWeek .
The remote code execution vulnerability tracked as CVE-2026-34197 came to light in early April. The post Recent Apache ActiveMQ Vulnerability Exploited in the Wild appeared first on SecurityWeek .
An indirect prompt injection could be chained with a sandbox bypass and Cursor’s remote tunnel feature for shell access to machines. The post Cursor AI Vulnerability Exposed Developer Devices appeared first on SecurityWeek .
The flaw allows low-privileged users to upload files to a temporary directory to achieve remote code execution. The post Splunk Enterprise Update Patches Code Execution Vulnerability appeared first on SecurityWeek .
The flaws can be exploited remotely to impersonate users or execute arbitrary commands on the underlying OS. The post Cisco Patches Critical Vulnerabilities in Webex, ISE appeared first on SecurityWeek .
Hackers are exploiting CVE-2026-33032, a critical remote takeover vulnerability in the Nginx UI management tool. The post Exploited Vulnerability Exposes Nginx Servers to Hacking appeared first on SecurityWeek .
The flaws could allow a remote attacker to maintain access after their account has been disabled and to access information from other user sessions. The post Two Vulnerabilities Patched in Ivanti Neurons for ITSM appeared first on SecurityWeek .
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Olive. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Microsoft Qlib. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-2050.
A directory traversal vulnerability in DriveLock's web service allows remote attackers to disclose sensitive information without authentication. The flaw is due to improper validation of user-supplied paths used in file operations on the service listening on TCP port 4568. DriveLock has issued an update to fix this vulnerability.
A directory traversal vulnerability in DriveLock's web service allows remote attackers to disclose sensitive information without authentication. The flaw is due to improper validation of user-supplied paths used in file operations on the service listening on TCP port 4568. DriveLock has issued an update to fix this vulnerability. The CVSS score assigned by ZDI is 5.3, indicating a low severity impact focused on confidentiality.
A SQL injection vulnerability in DriveLock's web service allows authenticated remote attackers to escalate privileges. The flaw is due to improper validation of user-supplied input used in SQL queries on the service listening on TCP port 4568. DriveLock has issued an update to fix this issue. Exploitation requires authentication but can lead to full compromise of protected resources.
A directory traversal vulnerability in DriveLock's web service allows remote attackers to disclose sensitive information without authentication. The flaw is due to improper validation of user-supplied paths in file operations on the service listening on TCP port 6067. DriveLock has issued an update to fix this vulnerability.
A directory traversal vulnerability in DriveLock's web service allows remote authenticated attackers to disclose sensitive information. The flaw is due to improper validation of user-supplied paths used in file operations. Exploitation requires authentication and targets the service listening on TCP port 4568. DriveLock has issued an update to address this issue.
Microsoft released security updates addressing 167 vulnerabilities in Windows and related software, including a SharePoint Server zero-day (CVE-2026-32201) actively exploited in the wild and a Windows Defender privilege escalation flaw known as BlueHammer (CVE-2026-33825). Google Chrome and Adobe Reader also patched critical zero-day vulnerabilities with evidence of active exploitation. The SharePoint vulnerability allows attackers to spoof trusted content, increasing risks of phishing and social engineering. The BlueHammer exploit code was publicly released but is mitigated by the latest patches. This Patch Tuesday represents one of the largest update cycles for Microsoft, driven in part by AI-assisted vulnerability discovery. Users are advised to apply updates promptly and restart affected software to ensure protection.
The security defects allow attackers to escalate privileges and execute arbitrary code remotely. The post Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities appeared first on SecurityWeek .
A critical-severity flaw could be exploited remotely, without authentication, to take over a vulnerable device. The post Juniper Networks Patches Dozens of Junos OS Vulnerabilities appeared first on SecurityWeek .