Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
This release fixes CVE-2026-111253 (dnf5daemon-server: missing session-owner check allows foreign D-Bus callers to replace another client's resolved transactio…
This release rejects YAML files which decompress to much (CVE-2026-92823), rejects YAML documents with YAML tree deeper than 64 (CVE-2026-92822), fixes iterati…
This release rejects YAML files which decompress to much (CVE-2026-92823), rejects YAML documents with YAML tree deeper than 64 (CVE-2026-92822), fixes iterati…
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not th…
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint s…
A flaw in APT, the tool that installs software on Debian and Ubuntu, could let an attacker replace a package after it passed a security check.
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The atta…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catal…
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerabili…
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox breakout, incomplete certificate check…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli…
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox bypass, incomplete certificate checks …
It was discovered that incorrect parsing of packets with compression pointers in the PowerDNS DNS server could result in denial of service. For the stable dist…
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to …
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thoug…
- Fixes: CVE-2026-14612 - potential buffer overflow in ipa-otpd - Fix potential buffer overvlow in ipa-join - Fix potential NUL pointer dereference in ipa-kdb
- Fixes: CVE-2026-14612 - potential buffer overflow in ipa-otpd - Fix potential buffer overvlow in ipa-join - Fix potential NUL pointer dereference in ipa-kdb
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under…
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance…
An attacker could log in as another user without passing the password or signature checks meant to stop them.
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web she…
If you’re evaluating an agentic pentesting solution right now, you’ve probably heard the same pitch more than once: point it at a target, and it discovers, val…
xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806)
Update to upstream (bz#2453492) check_icmp: host-count overflow leads to heap buffer overflow (bz#2513957) Update 0012-fix-perl-ntp-ipv6.patch to allow upperca…
