The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.

The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek.

Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.

The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek.

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.

The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on SecurityWeek.

CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA.

The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek.

On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters.

The post OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass appeared first on SecurityWeek.

Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws.

The post Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws appeared first on SecurityWeek.

Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests.

The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on SecurityWeek.

An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.

The post Barracuda ESG Authentication Bypass Flaw Opens Path to Root appeared first on SecurityWeek.

The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.

The post Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical appeared first on SecurityWeek.

A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff.

The post Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million appeared first on SecurityWeek.

The most severe is a critical flaw in Framework leading to remote code execution without user interaction.

The post Android’s November 2026 Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.

Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.

The post Critical Node-RED Flaw Exploited in Attacks appeared first on SecurityWeek.

The top payout is for high-impact architectural research demonstrating full administrative control.

The post Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward appeared first on SecurityWeek.

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.

The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

The post Fresh WordPress Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.

Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.

The post Drupal Commerce Core Vulnerability Exploited Against Online Stores  appeared first on SecurityWeek.

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

The post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

The post TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines appeared first on SecurityWeek.

The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.

The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.