Security news aggregator

Latest coverage for Vulnerability

Vulnerabilities are flaws attackers can exploit to access systems or data; timely patching, isolation, and least privilege reduce the impact.

11 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

A vulnerability is a weakness in a system’s design, code, configuration, or operating process that could allow an attacker to violate a security requirement. It may affect software, hardware, networks, cloud services, or exposed interfaces, and is not automatically exploitable: practical risk depends on factors such as exposure, required privileges, available attack paths, and existing controls. Outcomes can include unauthorized access, information disclosure, code execution, or disruption of service.

Effective vulnerability management combines accurate asset inventory with code review, security testing, scanning, and trusted vulnerability intelligence. Organizations should prioritize weaknesses affecting reachable, business-critical systems—especially when exploitation is known or requires little access—then patch or otherwise mitigate them and verify the fix. Where patching is delayed, controls such as disabling an exposed feature, restricting network access, or strengthening authentication can reduce the attack surface. Records should preserve affected versions, risk decisions, remediation owners, and validation results.

Volume over time

Weekly headline count for the current query.

Showing 11 most recent headlines Filtered view

Interlock's post-exploit toolkit exposed Ransomware criminals exploited CVE-2026-20131, a maximum-severity bug in Cisco Secure Firewall Management Center software, as a zero-day vulnerability more than a month before Cisco patched the hole, according to Amazon security boss CJ Moses.…

The Register 19 Mar 2026, 6:40 a.m. Actively exploited CVE-2026-20131 0-Day Amazon (company) Cisco CVE Disclosure Exploit Exposure Firewalls Flaw Patch Ransomware Vulnerability

If at first you don’t succeed, patch and patch again More threat intel teams are sounding the alarm about a critical Windows Server Update Services (WSUS) remote code execution vulnerability, tracked as CVE-2025-59287 and now under active exploitation, just days after Microsoft pushed an emergency patch and the US Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog.…

The Register 28 Oct 2025, 12:54 p.m. Actively exploited CVE-2025-59287 CVE Google Microsoft Patch Remote Code Execution Threat Intelligence Vulnerability

Critical bugs galore among 61 Microsoft fixes, 56 from Adobe, a dozen from SAP, and a fistful from Fortinet Patch Tuesday Microsoft's monthly patch drop has arrived, delivering a mere 61 CVE-tagged vulnerabilities – none listed as under active attack or already known to the public.…

The Register 13 Mar 2024, 1:16 p.m. Adobe Critical Vulnerability CVE Fortinet Microsoft Patch Patch Tuesday Vulnerability
The Register 2 years, 5 months ago

More mass exploits hit the same buggy Ivanti devices

At this point you might be better just shutting the stuff down All manner of miscreants are piling onto the latest Ivanti flaw, a server-side request forgery (SSRF) vulnerability tracked as CVE-2024-21893, according to threat hunters tracking the string of CVEs that have been plaguing the software shop's gateways over recent weeks.…

The Register 6 Feb 2024, 9:45 a.m. Actively exploited CVE-2024-21893 CVE Exploit Flaw Vulnerability

If you're still running a vulnerable instance then 'assume a breach' More than 600 IP addresses are launching thousands of exploit attempts against CVE-2023-22527 – a critical bug in out–of-date versions of Atlassian Confluence Data Center and Server – according to non-profit security org Shadowserver.…

The Register 23 Jan 2024, 12:37 p.m. Actively exploited CVE-2023-22527 Breach Critical Vulnerability CVE Exploit Remote Code Execution Vulnerability

At least two extortion gangs abusing CVE-2023-4966, we're told Citrix Bleed, the critical information-disclosure bug that affects NetScaler ADC and NetScaler Gateway, is now under "mass exploitation," as thousands of Citrix NetScaler instances remain vulnerable, according to security teams.…

The Register 1 Nov 2023, 9:45 a.m. Actively exploited CVE-2023-4966 Citrix CVE Disclosure Extortion Ransomware Vulnerability

That's a vulnerability that's under attack, fix available ... cancel those July 4th plans, perhaps? More than 338,000 FortiGate firewalls are still unpatched and vulnerable to CVE-2023-27997, a critical bug Fortinet fixed last month that's being exploited in the wild.…

The Register 4 Jul 2023, 11:17 a.m. Actively exploited CVE-2023-27997 Critical Vulnerability CVE Firewalls Fixed Fortinet Patch Vulnerability

Cough, cough, use Rust. Plus: Eight more exploited bugs added to CISA's must-patch list The most dangerous type of software bug is the out-of-bounds write, according to MITRE this week. This type of flaw is responsible for 70 CVE-tagged holes in the US government's list of known vulnerabilities that are under active attack and need to be patched, we note.…

The Register 30 Jun 2023, 8:24 a.m. CISA CVE Flaw Government MITRE Patch Vulnerability