The latest GitLab CE/EE updates address 13 vulnerabilities, including three high-severity defects.

The post GitLab Patches Code Execution, Information Disclosure Vulnerabilities appeared first on SecurityWeek.

The latest version of the open source data transfer tool resolves 18 medium and low-severity vulnerabilities.

The post 25-Year-Old Vulnerability Patched in Curl appeared first on SecurityWeek.

More than half of the bugs are use-after-free defects, which can potentially lead to remote code execution.

The post Chrome 149 Update Resolves 18 Severe Vulnerabilities appeared first on SecurityWeek.

A standard non-admin account is sufficient to conduct an attack that exploits legitimate OS behavior rather than software vulnerabilities.

The post macOS Weaknesses Chained to Silently Disable Endpoint Security Agents appeared first on SecurityWeek.

The flaws allow remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands.

The post Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs appeared first on SecurityWeek.

The security defects allow unauthenticated users to take control of the open source software supply chain.

The post Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking appeared first on SecurityWeek.

Attackers could abuse Dify's multi-tenant cloud service to read private chats, preview other tenants' documents, and reach internal APIs.

The post Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps appeared first on SecurityWeek.

Attackers can send crafted media files to execute code in any application that uses FFmpeg’s libavcodec library.

The post FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances appeared first on SecurityWeek.

Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability. 

The post Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data appeared first on SecurityWeek.

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data.

The post Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data appeared first on SecurityWeek.

CISA has given federal agencies only three days to patch CVE-2026-20253, which can be exploited for unauthenticated remote code execution.

The post Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure appeared first on SecurityWeek.

Splunk patched an OS command injection in AI Toolkit, while Atlassian fixed dozens of flaws in third-party dependencies.

The post Atlassian, Splunk Patch Critical Vulnerabilities appeared first on SecurityWeek.

Insufficient validation of user input allows an attacker to gain access to the underlying OS and elevate their privileges to root.

The post Critical Command Execution Vulnerability Patched in Cisco ISE appeared first on SecurityWeek.

Critical flaws in NGINX could allow remote, unauthenticated attackers to cause a restart and potentially execute arbitrary code.

The post F5 Patches Critical, High-Severity NGINX Vulnerabilities appeared first on SecurityWeek.

The industrial automation giant has fixed security holes in Logix, CompactLogix, Flex, RSLinx, and FactoryTalk products.

The post Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software appeared first on SecurityWeek.

Oracle has released its June 2026 Critical Security Patch Update to fix vulnerabilities in Communications, EBS, Enterprise Manager and other products.

The post Oracle’s Second Monthly Security Updates Deliver 245 Patches  appeared first on SecurityWeek.

The browser updates address multiple memory safety bugs that could potentially lead to remote code execution.

The post Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities appeared first on SecurityWeek.

The flaws allow attackers to execute arbitrary PHP code and gain root privileges on shared hosting servers.

The post Joomla, LiteSpeed Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.

SOCRadar has detected 30,000 compromised Fortinet firewalls that expose networks to hacking. 

The post 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs appeared first on SecurityWeek.

The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.

The post Ivanti Sentry Exploitation Attempts Hitting Honeypots appeared first on SecurityWeek.