Security news aggregator

Latest coverage for Vulnerability

Vulnerabilities are flaws attackers can exploit to access systems or data; timely patching, isolation, and least privilege reduce the impact.

8 headlines in this view

A vulnerability is a weakness in a system’s design, code, configuration, or operating process that could allow an attacker to violate a security requirement. It may affect software, hardware, networks, cloud services, or exposed interfaces, and is not automatically exploitable: practical risk depends on factors such as exposure, required privileges, available attack paths, and existing controls. Outcomes can include unauthorized access, information disclosure, code execution, or disruption of service.

Effective vulnerability management combines accurate asset inventory with code review, security testing, scanning, and trusted vulnerability intelligence. Organizations should prioritize weaknesses affecting reachable, business-critical systems—especially when exploitation is known or requires little access—then patch or otherwise mitigate them and verify the fix. Where patching is delayed, controls such as disabling an exposed feature, restricting network access, or strengthening authentication can reduce the attack surface. Records should preserve affected versions, risk decisions, remediation owners, and validation results.

Showing 8 most recent headlines Filtered view

Security Affairs 1 week, 2 days ago

Microsoft fixed Defender flaw RoguePlanet (CVE-2026-50656)

Microsoft fixed RoguePlanet (CVE-2026-50656), a Defender flaw allowing local attackers to gain higher privileges through the Malware Protection Engine. Microsoft released security updates for RoguePlanet, a vulnerability tracked as CVE-2026-50656 (CVSS score of 7.8) affecting the Malware Protection Engine used by Defender. The Microsoft Malware Protection Engine (mpengine.dll) powers Defender’s malware scanning, detection, and removal […]

More from Security Affairs 9 Jul 2026, 10:17 p.m. Theme · 12 stories CVE-2026-50656 CVE Fixed Flaw Malware Microsoft Vulnerability

Security Affairs 1 week, 2 days ago

Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation

Ubiquiti patched seven UniFi OS flaws, including critical CVE-2026-50746, which allows command injection in UniFi Connect Application. Ubiquiti released security updates for seven critical UniFi OS vulnerabilities, including a maximum-severity flaw, tracked as CVE-2026-50746 (CVSS score of 10.0), enabling command injection attacks. The issue affects UniFi Connect Application versions 3.4.16 and earlier, a platform used […]

More from Security Affairs 9 Jul 2026, 8:20 a.m. Incident · 5 stories CVE-2026-50746 Critical Vulnerability CVE Flaw Patch Privilege Escalation Ubiquiti Vulnerability

The Hacker News 1 week, 3 days ago

15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros

Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched

More from The Hacker News 8 Jul 2026, 6:16 p.m. Incident · 5 stories CVE-2026-43499 CVE Disclosure Flaw Linux Patch Research Root Access Vulnerability

Security Affairs 1 week, 4 days ago

Adobe ColdFusion flaw CVE-2026-48282 now exploited in the wild

Attackers are exploiting the critical Adobe ColdFusion flaw CVE-2026-48282, which allows remote code execution on unpatched servers. Attackers have started exploiting CVE-2026-48282, a maximum-severity vulnerability in Adobe ColdFusion. The flaw is a path traversal issue that could result in arbitrary code execution without authentication. It affects ColdFusion 2025.9, 2023.20, and earlier versions, allowing remote attackers […]

More from Security Affairs 7 Jul 2026, 7:53 a.m. Incident · 3 stories Actively exploited CVE-2026-48282 Adobe Authentication CVE Flaw Remote Code Execution Vulnerability

The Hacker News 1 week, 4 days ago

Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig

More from The Hacker News 7 Jul 2026, 4:28 a.m. Incident · 4 stories CVE-2026-20896 CVE DevOps Disclosure Docker Exploit Flaw Patch Threat Actor Unauthenticated Virtualisation Vulnerability

Bleeping Computer 1 week, 4 days ago

Max severity Adobe ColdFusion flaw now exploited in attacks

Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, according to vulnerability intelligence company KEVIntel. [...]

More from Bleeping Computer 7 Jul 2026, 1:18 a.m. Incident · 3 stories Actively exploited CVE-2026-48282 Adobe CVE Flaw Vulnerability

Security Affairs 1 week, 5 days ago

Bad Epoll Flaw Gives Attackers Root Access on Linux and Android

Bad Epoll (CVE-2026-46242) lets local attackers gain root on Linux and Android. The flaw was missed by AI but found by a security researcher. A newly disclosed Linux kernel vulnerability, named Bad Epoll (CVE-2026-46242), allows a local attacker with no special privileges to gain full root access on affected Linux systems and Android devices. Security updates are […]

More from Security Affairs 6 Jul 2026, 8:24 p.m. Incident · 2 stories CVE-2026-46242 Android Artificial Intelligence CVE Disclosure Flaw Linux Root Access Vulnerability

Threat Hunter 1 week, 5 days ago

SharePoint Is on Fire Again: What CISA\'s CVE-2026-45659 Warning Means, and How to Hunt It

On July 2, 2026, CISA added CVE-2026-45659, a SharePoint Server RCE, to its Known Exploited Vulnerabilities catalog with a two-day patch deadline. Storm-2603 is using it to stage Warlock ransomware, living off the land the whole way. Here is why it matters, plus a free 12-rule Sigma pack to hunt it.

More from Threat Hunter 6 Jul 2026, 12:00 p.m. Actively exploited CVE-2026-45659 CISA CVE Patch Ransomware Remote Code Execution Vulnerability Warning