Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Debian LTS: DLA-3835-1: roundcube Security Advisory Updates
Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could allow a remote a…
Mageia 2024-0222: nss & firefox Security Advisory Updates
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…
Google Detects 4th Chrome Zero-Day in May Actively Under Attack - Update ASAP
Google on Thursday rolled out fixes to address a high-severity security flaw in its Chrome browser that it said has been exploited in the wild.Assigned the CVE…
Mageia 2024-0191: thunderbird Security Advisory Updates
Arbitrary JavaScript execution in PDF.js. (CVE-2024-4367) IndexedDB files retained in private browsing mode. (CVE-2024-4767) Potential permissions request bypa…
Mageia 2024-0189: nss & firefox Security Advisory Updates
Arbitrary JavaScript execution in PDF.js. (CVE-2024-4367) IndexedDB files retained in private browsing mode. (CVE-2024-4767) Potential permissions request bypa…
Google Patches Yet Another Actively Exploited Chrome Zero-Day Vulnerability
Google has rolled out fixes to address a set of nine security issues in its Chrome browser, including a new zero-day that has been exploited in the wild.Assign…
New Chrome Zero-Day Vulnerability CVE-2024-4761 Under Active Exploitation
Google on Monday shipped emergency fixes to address a new zero-day flaw in the Chrome web browser that has come under active exploitation in the wild.The high-…
Debian: DSA-5645-1: firefox-esr security update
Manfred Paul discovered a flaw in the Mozilla Firefox web browser, allowing an attacker to inject an event handler into a privileged object that would allow ar…
GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws
GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide t…
Malware Campaign Exploits Popup Builder WordPress Plugin to Infect 3,900+ Sites
A new malware campaign is leveraging a high-severity security flaw in the Popup Builder plugin for WordPress to inject malicious JavaScript code.According to S…
Zero-Day Alert: Update Chrome Now to Fix New Actively Exploited Vulnerability
Google on Tuesday released updates to fix four security issues in its Chrome browser, including an actively exploited zero-day flaw.The issue, tracked as CVE-2…
Zero-Day Alert: Google Issues Patch for New Chrome Vulnerability - Update Now!
Google on Monday released security updates to patch a high-severity flaw in its Chrome web browser that it said is being actively exploited in the wild.Tracked…
Mageia 2023-0155: php-smarty security update
Cross site scripting vulnerability in Javascript escaping. (CVE-2023-28447) Additional bug fixes included. See referenced release notes for details.
Mageia 2023-0147: thunderbird security update
Fullscreen notification obscured. (CVE-2023-29533) Double-free in libwebp. (MFSA-TMP-2023-0001) Potential Memory Corruption following Garbage Collector compact…
Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability
Google on Friday released out-of-band updates to resolve an actively exploited zero-day flaw in its Chrome web browser, making it the first such bug to be addr…
SciLinux: SLSA-2023-1791-1 Important: firefox on SL7.x x86_64
This update upgrades Firefox to version 102.10.0 ESR. * MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp * Mozilla: Fullscreen notification obscured (CVE-202…
Fedora 36: php-Smarty 2023-7490239652
## [3.1.48] - 2023-03-28 ### Security - Fixed Cross site scripting vulnerability in Javascript escaping. This addresses CVE-2023-28447. ### Fixed - Output buff…
Hackers Create Malicious Dota 2 Game Modes to Secretly Access Players' Systems
An unknown threat actor created malicious game modes for the Dota 2 multiplayer online battle arena (MOBA) video game that could have been exploited to establi…
Debian LTS: DLA-3289-1: dojo security update
Two vulnerabilities were found in dojo, a modular JavaScript toolkit, that could result in information disclosure. CVE-2020-4051
WordPress Security Alert: New Linux Malware Exploiting Over Two Dozen CMS Flaws
WordPress sites are being targeted by a previously unknown strain of Linux malware that exploits flaws in over two dozen plugins and themes to compromise vulne…
Debian LTS: DLA-3247-1: node-trim-newlines security update
It was discovered that there was a potential remote denial of service vulnerability in node-trim-newlines, a Javascript module to strip newlines from the start…
Two New Security Flaws Reported in Ghost CMS Blogging Software
Cybersecurity researchers have detailed two security flaws in the JavaScript-based blogging platform known asGhost, one of which could be abused to elevate pri…
Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability
Search giant Google on Friday released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser.The high-severity…
SciLinux: SLSA-2022-8555-1 Important: thunderbird on SL7.x x86_64
This update upgrades Thunderbird to version 102.5.0. * Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403) * Mozilla:…