Kiteworks Calls for Six-Hour Server Blackout After Warning of a Possible Imminent Attack
Kiteworks urged customers to shut down servers for six hours on Sept. 26 after law enforcement warned of a possible imminent attack. No breach confirmed.
Vulnerabilities
More news
Page 11 / 39 · 347 articles
Elementor CSRF Flaw Can Turn One Administrator Click Into Full WordPress Control
Elementor 4.3.0-4.3.1 CSRF flaw lets attackers hijack admin sessions with one click to create rogue admins. Update to 4.3.2 immediately.
Active Roundcube Attacks Put Pre-Login SQL Injection at the Top of Patch Queues
Attackers exploit CVE-2026-48842, a pre-auth Roundcube SQL injection. Learn affected versions 1.6.x, 1.7.x and how to patch now.
CISA Adds Two Exploited Flaws to KEV and Gives Federal Agencies Three Days to Patch
CISA added CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) to KEV with Sept 27 patch deadline amid active exploitation.
Malicious Graphics Files Put Siemens Desigo CC Clients at Risk of Code Execution
CVE-2026-34223 lets malicious Desigo CC graphics execute scripts, write files to clients, risking workstation compromise and lateral movement.
Exploited TeamCity RCE Puts Build Servers in the Ransomware Crosshairs
Critical TeamCity flaw CVE-2026-63077 allows pre-auth RCE and is exploited in ransomware attacks. Learn affected versions, risks, and patch guidance.
CISA Withdraws Critical Mendix Runtime Alert After Siemens Finds No Vulnerability
Siemens found the reported Mendix Runtime behavior was expected, not a vulnerability. CISA withdrew the alert and rejected CVE-2026-7891.
Roundcube Servers Face Active Attacks Through Pre-Login Database Injection
Roundcube CVE-2026-48842 is under active exploit, enabling pre-login SQL injection via virtuser_query. Patch to 1.6.16 or 1.7.1 immediately.
Three SolarWinds RCE Flaws Expose Monitoring and Access-Control Deployments
SolarWinds fixed three unauthenticated RCE flaws in Observability Self-Hosted and Access Rights Manager, including CVE-2026-28324. No exploits observed.