News
Snowflake CLI Had a Code-Injection Flaw Before 3.19.0: Building a Malicious Project Can Take Over Your Machine
SecurityDevelopmentInfrastructure
Snowflake CLI, the official tool for the Snowflake cloud data platform, has a code-injection flaw (CVE-2026-13749, CVSS 8.8): building or deploying a malicious project runs attacker code on your machine. Fixed in 3.19.0 — update now.
2026.06.3037 views
News
libzypp (openSUSE/SUSE Linux) File-Overwrite Flaw: What It Is and How to Fix It
SecurityLinuxInfrastructure
libzypp, the openSUSE/SUSE Linux package manager, has a path traversal flaw (CVE-2026-25707, CVSS up to 8.8): a malicious repository can overwrite system files. Update to the fixed version now.
2026.06.2950 views
Lab
Is PostgreSQL 18 Faster? A 20M-Row Benchmark vs 17
DevelopmentInfrastructure
Is PostgreSQL 18 really faster? We loaded the same 20M rows into 17.9 and 18 and measured. The big aggregation, where async I/O should shine, got slower instead. Only skip scan clearly won. One setting can flip the result. What to know before upgrading.
2026.06.29165 views
News
Fluentd Hit by Unauthenticated RCE (CVE-2026-44024, CVSS 9.8) Plus 5 More — Update to v1.19.3 Now
DevelopmentInfrastructureSecurity
Fluentd has a critical flaw (CVE-2026-44024, CVSS 9.8): an unauthenticated attacker can overwrite files via a crafted log tag to run code. Six issues fixed; update to v1.19.3 now.
2026.06.2962 views
News
Kestra Now Has Seven Known Flaws, None Fixed in Any Stable Build
InfrastructureDevelopmentSecurity
Critical Kestra flaws (CVE-2026-53576/49869): an unauthenticated attacker bypasses login and runs commands as root, taking over the host. The orchestration platform is used by 30,000+ orgs. Update to 1.3.24.
2026.06.2750 views
News
Max-Severity Flaw in Manufacturers' Design-Data Software PTC Windchill: Patch Now (CVE-2026-12569)
SecurityInfrastructure
PTC Windchill and FlexPLM, the design-data software used across automotive, electronics and other manufacturing, has a max-severity flaw allowing unauthenticated remote takeover. Germany's BSI warned admins at night, and attacks are reported underway. U.S. CISA set a June 28 deadline; apply the fix.
2026.06.2662 views
News
Cisco Unified CM CVE-2026-20230: attackers are dropping webshells
SecurityInfrastructure
Cisco Unified Communications Manager, the software many companies use to run their phone systems, has an unauthenticated flaw that is already being exploited. At worst, attackers can take over the server and seize root. U.S. CISA set a June 28 deadline; apply the fix.
2026.06.2650 views
News
10 Flaws in Quest NetVault Backup: What CVE-2026-9787 Really Does
InfrastructureSecurity
Quest NetVault Backup, enterprise backup software, has 10 CVSS-8.8 vulnerabilities disclosed at once — several allow bypassing authentication and taking over the server to run commands at the highest privilege. Published by Trend Micro's ZDI on June 24, 2026. Fixed in 14.0.2. Update internet-exposed management consoles first.
2026.06.2547 views
News
Cacti CVE-2026-39893 lets attackers dump the database with no login
SecurityInfrastructure
Cacti, a standard tool for monitoring servers and networks with graphs, has a flaw that can let the database be manipulated without authentication. CVE-2026-39893, with a top-class severity of CVSS 9.8. It is SQL injection from a filtering value, abusable without a login on setups with guest viewing enabled. Versions 1.2.30 and earlier are affected; update to 1.2.31.
2026.06.2556 views
News
The Mastodon Flaw That Turns the Server Into a Stepping Stone: Which Versions Are Safe
InfrastructureSecurity
Mastodon's server software has an SSRF flaw that lets an attacker abuse the server itself as a stepping stone to make unauthorized connections from outside. CVE-2026-47389, severity CVSS 8.6. By merely crafting DNS, an attacker can reach internal services or cloud management info (keys) and steal credentials. Versions 4.5.9 / 4.4.16 / 4.3.22 and earlier are affected; operators should update to 4.5.10 / 4.4.17 / 4.3.23.
2026.06.2539 views
News
Two File-Write Flaws in Self-Hosted Media Server Jellyfin (CVE-2026-48793 and More) — Update to v10.11.10
SecurityInfrastructure
Jellyfin, a popular tool for streaming movies and music from a home server, has two flaws letting an attacker write files to places on the server they should not. CVE-2026-48793 and CVE-2026-49247, both CVSS 8.8. No administrator privileges are needed, and shared or internet-exposed servers are most at risk. Versions before 10.11.10 are affected; update to 10.11.10.
2026.06.2571 views
News
Rclone: update to v1.74.4 — six more flaws after CVE-2026-49980
SecurityInfrastructure
Rclone, a standard tool for saving and syncing files to the cloud, has a flaw abusable remotely without authentication. CVE-2026-49980, with a top-class severity of CVSS 9.8. If the remote-control daemon (rcd) is exposed to the network, a single crafted request can run arbitrary commands on the machine running Rclone. Versions 1.46.0–1.74.2 are affected; update to 1.74.3.
2026.06.2541 views
