Stay updated on the latest in information security flaws. Explore news, insights, and analysis on vulnerabilities affecting digital safety.
Search across headline titles and summaries.
Background for this topic.
A flaw is a defect in software, hardware, system design, or configuration that causes unintended behavior. In security reporting, the term usually means a weakness that could violate confidentiality, integrity, or availability when reached through a particular interface, input, privilege, or operating condition. Not every flaw is exploitable, and exploitability depends on factors such as exposure, authentication requirements, affected versions, and available mitigations.
Flaws matter because they can create attack paths in applications, operating systems, devices, APIs, or administrative settings. Security teams assess their severity and exposure, prioritize remediation, apply patches or configuration changes, and use isolation or access controls when immediate fixes are unavailable. Code review, testing, vulnerability scanning, and monitoring can reveal flaws across the development and operational lifecycle. Reports should distinguish a confirmed vulnerability from a theoretical defect and provide enough technical detail to support validation without unnecessarily enabling exploitation.
Weekly headline count for the current query.
The White House announced Gold Eagle to help accelerate the discovery, prioritization and patching of flaws found by AI
Wiz discovered GhostApproval, a symlink flaw in six major AI coding assistants that bypasses approval
Threat actors are exploiting an Adobe ColdFusion vulnerability which has a CVSS score of 10.0
Opera GX flaw let sites automatically install mods to steal data from other pages, now patched
An attacker has exploited a zero day in Oracle Peoplesoft to gain access to the IT systems of the NAIC, the standard-setting association for the US federal insurance system
A high-severity flaw in Cisco Catalyst SD-WAN Manager disclosed in early June was exploited as early as March
macos-xpc-flaw-disable-edr-mdm-standard-user-xm-cyber
OpenAI expanded Daybreak with a full GPT-5.5-Cyber release to help defenders patch software flaws
Apple BootROM exploit exposes unpatchable USB flaw on A12 and A13 devices
Critical phpBB authentication bypass lets attackers hijack any account with one request
The flaw, CVE-2026-11645, can allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page
Critical Everest Forms Pro RCE flaw exploited to create rogue WordPress admin accounts
The emergence of AI models capable to autonomously find and fix vulnerabilities at scale is having a significant impact on patching management, experts say
Obsidian publishes PoC for a 1-click Flowise RCE that can fully compromise self-hosted servers
CERT-In urges 12-hour patching of exposed flaws as AI compresses exploitation timelines
Qualys finds nine-year-old Linux ptrace flaw exposing SSH keys and password hashes locally
Verizon DBIR finds 31% of data breaches began with software flaws last year
The zero-day vulnerability affects on-premises installations for all versions of Exchange Server 2016, 2019 and Subscription Edition
New Fragnesia kernel flaw lets unprivileged local users escalate to root on Linux systems
Avada Builder flaws allowed file read and SQL injection on one million WordPress sites