Vulnerabilities

59: stories
OCT 20: latest

All Vulnerabilities · page 3

Fortinet Warns of Critical Flaw After FortiCloud SSO Exploitation

Fortinet is rolling out updates for CVE-2026-24858, with fixes for some versions available as of Tuesday, and others in releases that are upcoming at an unspecified date.

Decipher · 2 min

JAN 27

Microsoft

Cybercrime and APT Groups Exploiting WinRAR Bug

Exploitation of CVE-2025-8088 in the wild began before disclosure, with attacks confirmed as early as July 18, 2025.

Dennis Fisher · 4 min

JAN 26

Microsoft

Microsoft Releases Emergency Patch for CVE-2026-21509

The vulnerability (CVE-2026-21509) requires user interaction for an attack to succeed, with the most likely vector being an attacker sending a malicious Office file to a victim, who then opens it.

Dennis Fisher · 1 min

JAN 22

Cisco

Cisco Fixes Unified Communications RCE Flaw Under Attack

Threat actors are attempting to exploit the Cisco remote code execution flaw (CVE-2026-20045) in the wild, according to a new security advisory.

Decipher · 2 min

JAN 22

Fortinet

Fortinet FortiGate Devices Targeted in New Campaign

This activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-2025-59718 and CVE-2025-59719).

Dennis Fisher · 3 min

JAN 21

Linux

High-Risk Authentication Bypass Flaw Found in Telnetd

The flaw is in the way that the telnetd server handles some specific user-supplied data. An attacker who exploits this vulnerability would be able to bypass the authentication path and gain root privileges.

Dennis Fisher · 1 min

JAN 13

Podcast

‘We Fail a Lot’: How Two Security Pioneers Keep Innovating

From their roles as the driving forces behind pioneering web appsec firm WhiteHat Security to building out enterprise security programs to breaking large portions of the web, Jeremiah Grossman and Robert Hansen have unique viewpoints on what works and what doesn’t.

Dennis Fisher · 1 min

JAN 8

China

A New Chinese APT Takes the Stage

Active since at least 2022, UAT-7290 demonstrates a significant capacity for conducting deep-seated espionage while simultaneously functioning as an initial access group.

Dennis Fisher · 2 min

JAN 7

React2Shell

React2Shell Attacks Continue to Build

After a peak of more than 430,000 attack sessions in late December, daily volumes targeting React2Shell have stabilized in the 300,000 to 400,000 range.

Dennis Fisher · 1 min

JAN 6

IBM

IBM Warns of Critical Auth Bypass Bug in API Connect

IBM published updates for the affected versions of API Connect on Jan. 2., and urged organizations to update affected versions as soon as possible.

Dennis Fisher · 1 min

DEC 29

MongoDB

Serious MongoDB Flaw CVE-2025-14847 Under Exploitation

MongoDB disclosed the vulnerability (CVE-2025-14847) on Dec. 19 and a few days later, a public exploit for it appeared online.

Dennis Fisher · 1 min

DEC 3

React

Critical Flaw CVE-2025-55182 Affects React Server Components

All developers using React Server Components are urged to upgrade immediately, and some apps that don’t include React Server Function endpoints could be vulnerable, as well.

Dennis Fisher · 2 min

NOV 17

Fortinet

Fortinet CVE-2025-64446 Under Active Attack

That vulnerability (CVE-2025-64446) affects several versions of FortiWeb and CISA has added it to its Known Exploited Vulnerabilities catalog.

Dennis Fisher · 2 min

NOV 12

APT

APT Targets Cisco and Citrix Zero Days

The chain of discovery began with Amazon’s security honeypot service, MadPot, which detected exploitation attempts for the Citrix Bleed Two vulnerability (CVE-2025-5777) before its public disclosure

Dennis Fisher · 2 min

NOV 11

Microsoft