News
Four New IBM Aspera Flaws: Faspex 5 and Desktop App, CVE-2026-14958
SecurityInfrastructure
IBM disclosed two critical buffer overflow vulnerabilities in Aspera High-Speed Transfer Server and Endpoint on May 21, 2026: CVE-2026-8175 (heap BOF, CVSS 9.8, unauthenticated) and CVE-2026-8179 (stack BOF, CVSS 8.8, authenticated). Used by broadcasters, media, and large enterprises worldwide.
2026.05.2896 views
Lab
CISA KEV Dashboard in Japanese — Browse the Actively Exploited Catalog
InfrastructureSecurity
Browse CISA's Known Exploited Vulnerabilities catalog (1,603 entries) in a Japanese-localized dashboard: full-text search, vendor filtering, Japan-market vendor filter, and ransomware-related extraction. Free, browser-only, no signup. Each CVE deep-links to NVD and our incident articles.
2026.05.2761 views
News
IBM products hit by unauthenticated takeover flaws: webMethods, HMC, App Connect, Langflow in late July
Global CompaniesSecurityInfrastructure
A continuously updated roundup of critical IBM WebSphere-family vulnerabilities. The most severe is CVE-2026-8633 (CVSS 9.8), an unauthenticated server takeover. On top of June's four RCE flaws, June 30 – July 1, 2026 added three admin-console XSS issues (CVE-2026-11708 and others) and a Liberty SSRF, with a version-by-patch table to prioritize fixes.
2026.05.27148 views
News
LiteSpeed cPanel plugin: two takeover bugs, fully fixed only in v2.4.8+
InfrastructureSecurityGlobal Companies
CVE-2026-48172, a CVSS 10 privilege escalation flaw in the LiteSpeed User-End cPanel plugin, is being actively exploited in 2026. Any cPanel user (including a compromised tenant on shared hosting) can run arbitrary scripts as root. CISA added it to the Known Exploited Vulnerabilities catalog. Mirai botnet variants and a ransomware strain are reportedly being dropped via the bug. Patch to plugin v2.4.7 or WHM plugin v5.3.1.0 immediately.
2026.05.2749 views
News
SGLang CVE-2026-5760 and 3 more RCE flaws hit AI inference server (3 unpatched)
InfrastructureSecurityAI
Four critical RCE vulnerabilities disclosed in SGLang, the AI inference server used by xAI, AMD, NVIDIA, and major cloud providers. CVSS 9.8, no auth required, three remain unpatched as of May 26, 2026. JPCERT/CC issued an advisory.
2026.05.2684 views
News
NEC Aterm Router Vulnerabilities: Fixed Firmware Versions for All 11 Affected Models
InfrastructureSecurityJapanese Companies
NEC Platforms disclosed two more vulnerabilities in its Aterm router line on May 25, 2026 — a cross-site scripting flaw across nine popular Wi-Fi 6/6E/7 home models and an OS command injection in two business-grade LTE routers. The advisories follow a much larger March 2026 disclosure that affected 21 models and included an undocumented telnet backdoor.
2026.05.25104 views
News
Drupal Core Flaw Lets Anyone Hijack PostgreSQL Sites Without a Login
InfrastructureSecurityDevelopment
The U.S. CISA gave federal agencies just five days to patch CVE-2026-9082, a highly critical SQL injection in Drupal core that lets anonymous attackers take over PostgreSQL-backed sites. Imperva already counts 15,000 attack attempts against 6,000 sites across 65 countries, including Drupal-powered government and university portals in Japan.
2026.05.2365 views
News
UniFi hit by 25 flaws at once: cameras, door locks and routers
InfrastructureSecurity
On July 2, 2026, networking brand UniFi disclosed 15 new vulnerabilities. Security cameras, door-access control, and routers are all in scope, and 6 can be exploited with no login. Earlier holes are already used in real attacks; we lay out the fixed version per product and the update steps to do first.
2026.05.22342 views
News
Apex One Hit by 14 Vulnerabilities; Console Hijack Could Reach All Company PCs
InfrastructureSecurityJapanese Companies
Trend Micro has disclosed 14 vulnerabilities in its enterprise antivirus Apex One. Two of them are rated at the maximum severity tier, letting attackers hijack the management console without login and push malware to every PC in the company. With past zero-day exploitation on record, immediate patching is advised.
2026.05.2287 views
News
GUARDIANWALL MailSuite Vulnerability: Affected Versions and How to Respond
SecurityInfrastructureJapanese Companies
A critical CVSS 9.8 vulnerability in Canon ITS's GUARDIANWALL MailSuite lets attackers run code without login. Used by 4,000+ Japanese organizations (5.8M users), exploitation is already confirmed. Here is how to identify your edition and apply the patch.
2026.05.2163 views
News
Docomo phones won't connect: morning outage reports, carrier says "not equipment failure"
InfrastructureMobileJapanese Companies
NTT Docomo acknowledged on the morning of May 19 that social-media complaints about mobile service difficulties have been increasing. Users report being out of service since before 4 a.m. and unable to connect for more than eight hours. Docomo says no equipment failure has been confirmed and is still investigating as of 11:30 a.m. Cause and recovery timeline are unknown.
2026.05.19161 views
News
NGINX Rift (CVE-2026-42945): Affected versions, how to check, and workaround
InfrastructureSecurity
A critical 18-year-old vulnerability (CVE-2026-42945, codenamed NGINX Rift, CVSS 9.2) has been disclosed in the NGINX rewrite module. Unauthenticated remote code execution is possible and a PoC is public. This article covers affected products, how to check your environment, the patch procedure, and a workaround.
2026.05.15418 views
