Critical Ghostscript Vulnerability Puts Servers at Risk Through PDF Uploads
Ghostscript CVE-2026-39919 heap buffer overflow enables RCE via crafted PDF uploads against servers using the interpreter.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesWednesday, October 14
Critical Security Flaw in SAP's Cloud SDK for Python Exposes OAuth2 Credentials
SAP Cloud SDK Python SSRF (CVSS 10) can leak OAuth2 client credentials from multi-tenant apps to attacker-controlled servers.
Fortinet FortiSandbox Vulnerability Poses Significant Security Risk
FortiSandbox GUI auth bypass CVE-2026-107656 could let remote attackers access administrative functions without credentials.
GitLab Addresses Critical Security Flaw with Urgent Patches
GitLab released patches for a CVSS 10.0 unauthenticated RCE in CE/EE that allowed arbitrary server code execution.
Microsoft Introduces Risk Cohorts in October Patch Tuesday Update
Microsoft's October patch batch addresses over 1,400 vulnerabilities and introduces risk cohorts to help prioritization.
Urgent Patch Required for Ivanti Connect Secure Zero-Day Vulnerability
CISA warns of actively exploited Ivanti Connect Secure zero-day enabling unauthenticated remote commands; immediate patching recommended.
Monday, October 12
FBI Breach Exposes Security Patch Oversight
PremiumA third-party vendor failure to apply a security patch exposed sensitive FBI personnel information, prompting contractor removal.
Critical SonicWall Vulnerability Under Active Exploitation
PremiumAttackers actively exploit maximum-severity SonicWall SMA1000 vulnerability CVE-2026-102255, patched three days earlier.
Critical AhsayCBS Vulnerabilities Lead to Remote Code Exploitation
PremiumAttackers exploit unpatched AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134 to bypass auth and inject OS commands.
AI Tools Exploited in Cyberattacks on South Korean Banks
PremiumAttacker used ARTEX AI and Claude agents to orchestrate attacks against South Korean banks, amplifying automation risk in breaches.
Urgent Security Patch Required for Citrix NetScaler ADC and Gateway
PremiumCitrix warns of critical NetScaler ADC/Gateway RCE CVE-2026-107406, urging immediate patching to prevent remote code execution.
Zenity Labs Uncovers AWS Bedrock AgentCore Vulnerability Exposing Cloud Credentials
PremiumZenity Labs' AgentCorruption shows a prompt can hijack AWS Bedrock AgentCore agents to access chats, memories, and cloud secrets.
P7 DarkSword iOS Exploit Kit Targets Crypto Wallets with Enhanced Capabilities
PremiumNew P7 DarkSword iOS exploit kit variant steals keychain and crypto wallets, adds two-way C2 and remote commands on devices.
Anthropic's AI Models Exploit Software Flaws, Raising Security Concerns
PremiumClaude exploited injection flaws during tests; Anthropic cuts live internet access and launches OSS Scanner to help defenders.
Critical Vulnerability in AnyDesk Linux Could Allow Remote Access
PremiumA pre-auth AnyDesk Linux vulnerability gives root access; proof-of-concept exploit published, update to 8.0.3 recommended.
Ransomware Groups Exploiting Palo Alto VPN Vulnerability
PremiumRansomware groups exploit Palo Alto GlobalProtect authentication bypass (CVE-2026-0257) to create unauthorized VPN sessions and access internal networks.
Friday, October 9
Malicious Firefox Extensions Exploit Wallet Vulnerabilities to Steal Crypto
PremiumCluster of 16 malicious Firefox extensions intercept wallet import flows to steal cryptocurrency recovery phrases and private keys.
SonicWall Releases Critical Patch for SMA1000 SSRF Vulnerability
PremiumSonicWall released hotfixes for four SMA1000 flaws; most serious was a CVSS 10.0 pre-auth SSRF potentially reaching internal functions.
Critical LMCache Vulnerability Exposes Servers to Remote Code Execution
PremiumCritical unauthenticated RCE in LMCache (LLM cache servers) allows remote code execution; no fixed version available yet.
Critical AWS Vulnerability 'AgentCorruption' Threatens Cloud Security
PremiumPatched AWS Bedrock AgentCore vulnerability could allow a single malicious prompt to compromise an entire agent fleet; patch available.
Get these articles delivered to your inbox.
Subscribe free