News
Self-hosted Git "Gitea" hit by admin-takeover flaw: CVE-2026-20896 and 8 more, update to 1.26.4
SecurityInfrastructureDevelopment
Gitea, the self-hosted source-code tool, was patched for nine security flaws in version 1.26.4. The worst lets an attacker impersonate the admin with no password on Docker instances using a specific setting. If you self-host Gitea, update now.
2026.07.04148 views
News
On-Prem SharePoint Takeover With No Login — CVE-2026-50522 & More, Patch Now
SecurityInfrastructure
Microsoft's on-premises SharePoint Server has a flaw (CVE-2026-45659) that lets even a low-privilege user run code on the server. CISA confirms exploitation. Editions 2016/2019/Subscription are affected; SharePoint Online is not. The fix is out — patch unpatched servers now.
2026.07.0259 views
News
CVE-2025-62593: One Web Page Can Hijack a Ray Developer's Laptop
SecurityAI
Ray, the AI distributed-computing framework used by OpenAI and Uber, has a flaw (CVE-2026-57516): loading a crafted dataset (.tar) runs arbitrary code on the server. Ingesting public data and models becomes dangerous. Severity 8.8 — update to 2.56.0.
2026.07.0249 views
News
CWP takeover flaw CVE-2026-57517: exploit code is public
InfrastructureSecurity
Control Web Panel (CWP, formerly CentOS Web Panel), a free Linux server management panel, has a flaw (CVE-2026-57517) that lets an unauthenticated attacker manipulate the database and take over the server. 150,000+ instances are exposed — update to 0.9.8.1225.
2026.07.0275 views
News
Fastify middie flaw CVE-2026-14198 lets a crafted URL bypass auth; update to 9.3.3
SecurityDevelopment
middie, a popular plugin for the Node.js web framework Fastify, has a flaw (CVE-2026-14198): a crafted URL bypasses auth and other middleware. No login needed, severity 9.1 — update to 9.3.3.
2026.07.0136 views
News
LatePoint CVE-2026-13228: 5.6.9 is no longer enough, update to 5.6.10
SecurityDevelopment
A flaw in the WordPress booking plugin LatePoint (CVE-2026-13228) lets a staff-level account take over the whole site. 100,000+ sites are affected — update to version 5.6.4 now.
2026.07.0138 views
News
Critical Flaw in BMC Control-M (CVE-2026-10539): Server Takeover With No Password — Update to 9.0.21.300
SecurityInfrastructure
BMC Control-M, which runs companies' core batch jobs, has a critical flaw: a passwordless attacker can take over the server (CVE-2026-10539, CVSS 9.0). Update to 9.0.21.300.
2026.07.0193 views
News
Aflac Japan Leaks Data on 4.38 Million Customers: What Policyholders Should Do, and the 'Instant Withdrawal' Myth
PrivacyJapanese CompaniesSecurity
Aflac Japan leaked ~4.38M customers' data via unauthorized access, incl. bank accounts for ~230,000. Does that mean instant withdrawal, and what should policyholders do?
2026.07.01136 views
News
UltraVNC: 3 Critical Flaws (CVE-2026-7840) — Repeater Takeover With No Password, Update to 1.8.2.4
SecurityInfrastructure
UltraVNC has three critical flaws. The repeater can be hijacked with no password (CVE-2026-7840, CVSS 9.8); a viewer bug lets a rogue server seize your PC. Update to 1.8.2.4.
2026.07.01114 views
News
Pre-Auth RCE in IBM Db2 (CVE-2026-10109): Patch the Core Database Now
SecurityInfrastructure
IBM Db2, the enterprise core database, has a flaw (CVE-2026-10109): tampering with the pre-login connection exchange runs commands on the server with no authentication. Rated 9.8; IBM has shipped special fix builds — apply now.
2026.07.0132 views
News
Conductor CVE-2026-58138: PoC is public, no confirmed attacks yet
SecurityInfrastructure
Conductor (formerly Netflix Conductor), a platform that chains business processes, has a flaw (CVE-2026-58138): sending one crafted workflow definition to the API runs commands before login. Rated 9.8; update to 3.30.2 now.
2026.07.0154 views
News
Adobe ColdFusion Flaw Now Exploited in Attacks — CVE-2026-48282, Seven 10.0s, Patch Now
InfrastructureSecurity
Adobe ColdFusion has 9 new flaws that let attackers take over a server from outside with no login. Five are rated a perfect 10.0 (CVE-2026-48276 et al.). Adobe shipped a fix (APSB26-68) — update now.
2026.07.0183 views
