News
Cisco Unified CM CVE-2026-20230: attackers are dropping webshells
SecurityInfrastructure
Cisco Unified Communications Manager, the software many companies use to run their phone systems, has an unauthenticated flaw that is already being exploited. At worst, attackers can take over the server and seize root. U.S. CISA set a June 28 deadline; apply the fix.
2026.06.2650 views
News
pnpm Vulnerabilities: Which Versions Are Safe and What to Do
SecurityDevelopment
Two high-severity flaws have been found in pnpm, the widely used JavaScript package manager. Pulling in a malicious package or repository can let an attacker take over a developer's machine and run arbitrary code. Fixes are out: update to 10.34.2+ on the 10.x line or 11.5.3+ on 11.x.
2026.06.2675 views
News
CVE-2026-56129: Toshiba's Unpatched Driver Loads on Windows 11
Japanese CompaniesSecurity
A driver preinstalled on Toshiba and Dynabook PCs has a vulnerability that may let even a non-administrator user improperly access the PC's memory. Disclosed June 25, 2026 as CVE-2026-56129. No fix will be provided; the countermeasure is to remove the affected driver. Check the vendor's official notice for whether your model is affected.
2026.06.2563 views
News
10 Flaws in Quest NetVault Backup: What CVE-2026-9787 Really Does
InfrastructureSecurity
Quest NetVault Backup, enterprise backup software, has 10 CVSS-8.8 vulnerabilities disclosed at once — several allow bypassing authentication and taking over the server to run commands at the highest privilege. Published by Trend Micro's ZDI on June 24, 2026. Fixed in 14.0.2. Update internet-exposed management consoles first.
2026.06.2547 views
News
Reverse-Proxy Takeover Flaw in Low-Code Platform Appsmith (CVE-2026-55454) — Update to v2.1
SecurityDevelopment
Appsmith, a popular low-code platform for building internal business apps, has a flaw that lets a low-privilege user take over the server's traffic gateway (reverse proxy). CVE-2026-55454, severity CVSS 9.9. The bundled proxy's management function was open without authentication, and combined with SSRF the configuration can be replaced wholesale. Versions before 2.1 are affected; update to 2.1.
2026.06.2546 views
News
Cacti CVE-2026-39893 lets attackers dump the database with no login
SecurityInfrastructure
Cacti, a standard tool for monitoring servers and networks with graphs, has a flaw that can let the database be manipulated without authentication. CVE-2026-39893, with a top-class severity of CVSS 9.8. It is SQL injection from a filtering value, abusable without a login on setups with guest viewing enabled. Versions 1.2.30 and earlier are affected; update to 1.2.31.
2026.06.2556 views
News
Three Unauthenticated Takeover Flaws in Team Chat Rocket.Chat (CVE-2026-45688 and More) — Update Now
SecurityDevelopment
Rocket.Chat, a team chat platform used by governments and enterprises, has three flaws that can let an attacker take over another account without authentication. The most serious, CVE-2026-45688 and CVE-2026-45689, are CVSS 9.1. By injecting database symbols into the login endpoint, an attacker bypasses identity checks and can steal access and escalate to admin. Update to the latest release of your line.
2026.06.2541 views
News
Self-Hosted Git Service Gogs: Six Flaws Fixed in 0.14.3
SecurityDevelopment
Gogs, a lightweight Git service for managing source code on your own server, has six vulnerabilities. The most serious, CVE-2026-52813, is a CVSS 10.0 that takes over the server without authentication. Others include code execution and admin-rights seizure. Versions before 0.14.3 are affected; a single update fixes them all. If you self-host Gogs, update now.
2026.06.2557 views
News
The Mastodon Flaw That Turns the Server Into a Stepping Stone: Which Versions Are Safe
InfrastructureSecurity
Mastodon's server software has an SSRF flaw that lets an attacker abuse the server itself as a stepping stone to make unauthorized connections from outside. CVE-2026-47389, severity CVSS 8.6. By merely crafting DNS, an attacker can reach internal services or cloud management info (keys) and steal credentials. Versions 4.5.9 / 4.4.16 / 4.3.22 and earlier are affected; operators should update to 4.5.10 / 4.4.17 / 4.3.23.
2026.06.2539 views
News
Two File-Write Flaws in Self-Hosted Media Server Jellyfin (CVE-2026-48793 and More) — Update to v10.11.10
SecurityInfrastructure
Jellyfin, a popular tool for streaming movies and music from a home server, has two flaws letting an attacker write files to places on the server they should not. CVE-2026-48793 and CVE-2026-49247, both CVSS 8.8. No administrator privileges are needed, and shared or internet-exposed servers are most at risk. Versions before 10.11.10 are affected; update to 10.11.10.
2026.06.2571 views
News
Ghost CVE-2026-53943: update target corrected from 6.37.0 to v6.54.1
DevelopmentSecurity
Ghost, a popular tool for blogs and newsletters, has a flaw that lets an attacker poison the site's display from outside and potentially take over the operator's account. CVE-2026-53943, severity CVSS 9.6. A header sent without authentication can serve a poisoned display to other visitors, and when the public site and admin share one domain it can lead to staff takeover. Versions 4.0.0–6.36.x are affected; update to 6.37.0.
2026.06.2547 views
News
Rclone: update to v1.74.4 — six more flaws after CVE-2026-49980
SecurityInfrastructure
Rclone, a standard tool for saving and syncing files to the cloud, has a flaw abusable remotely without authentication. CVE-2026-49980, with a top-class severity of CVSS 9.8. If the remote-control daemon (rcd) is exposed to the network, a single crafted request can run arbitrary commands on the machine running Rclone. Versions 1.46.0–1.74.2 are affected; update to 1.74.3.
2026.06.2541 views
