Three vulnerabilities in Salesforce Agentforce allowed hackers to hijack trusted agents, steal data, and launch phishing attacks.

The post ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration appeared first on SecurityWeek.

Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.

The post Roundcube Webmail Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.

The vulnerabilities, tracked as CVE-2026-28324 and CVE-2026-28325, can be exploited without authentication.

The post SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted appeared first on SecurityWeek.

The nine critical security defects could be exploited for arbitrary code execution and privilege escalation.

The post Adobe Patches Critical Flaws in Connect, AEM Forms appeared first on SecurityWeek.

The browser update resolves several critical-severity memory safety and memory corruption flaws.

The post Chrome 154 Patches 108 Vulnerabilities appeared first on SecurityWeek.

Remote attackers could trigger the critical-severity flaw to access privileged internal functionality.

The post Arista Urges Immediate Patching of Exploited VCO Zero-Day appeared first on SecurityWeek.

Unauthenticated attackers could send malicious traffic to BIG-IP to achieve remote code execution.

The post Critical F5 BIG-IP Vulnerability Exploited as Zero-Day appeared first on SecurityWeek.

The critical-severity flaw could allow unauthenticated attackers to upload and execute arbitrary scripts.

The post Check Point Patches Exploited Management Server Zero-Day appeared first on SecurityWeek.

A Chinese threat actor has exploited the bug to exfiltrate sensitive information from nearly 1,000 ZyXEL switches.

The post Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers appeared first on SecurityWeek.

The bug lets attackers automatically install and preview themes and could lead to remote code execution.

The post WordPress Patches ‘Click2Shell’ Vulnerability appeared first on SecurityWeek.

Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory.

The post Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities appeared first on SecurityWeek.

Hacktron researchers earned a bug bounty after demonstrating access to OpenAI employee accounts. 

The post AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code appeared first on SecurityWeek.

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.

The post Microsoft Patches 18 Vulnerabilities in AI, Cloud Products appeared first on SecurityWeek.

CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions.

The post Critical Orkes Conductor Vulnerability Exploited in Attacks appeared first on SecurityWeek.

Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges.

The post Check Point, Kaspersky, Tanium Patch Product Vulnerabilities appeared first on SecurityWeek.

The decision follows BOD 26-04, which directs federal organizations to prioritize vulnerabilities based on real-world risk.

The post CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot appeared first on SecurityWeek.

Attackers could exploit the flaws to increase resource usage, trigger an unexpected program exit, or terminate the named process.

The post ISC Patches 14 Vulnerabilities in BIND 9 Security Update appeared first on SecurityWeek.

The vulnerabilities may lead to root access, command execution, bypasses, SQL injection, and remote code execution.  

The post Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard appeared first on SecurityWeek.

Remote, unauthenticated attackers can exploit the vulnerability to bypass authentication via crafted requests.

The post Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day appeared first on SecurityWeek.

Vulnerabilities in The Events Calendar can provide attackers with remote code execution capabilities.

The post Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover appeared first on SecurityWeek.