UPDATED
Malwarebytes Labs · · Critical severity
Google has released its September 2026 Pixel Update Bulletin , fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.” The bug is not described as a simple remote takeover, but as a...
Help Net Security · · Medium severity
A Linux privilege escalation vulnerability (CVE-2026-87886) affecting Acronis’ backup extensions for cPanel, WebHost Manager (WHM), and Plesk, is being leveraged by attackers, the backup and recovery company warns. “Exploitation of this...
BleepingComputer · · Critical severity
Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks.
BleepingComputer · · Critical severity
Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild.
Help Net Security · · Critical severity
Attackers have leveraged a zero-day SQL injection vulnerability (CVE-2026-76461) to compromise Cisco Secure Email Gateway appliances, Cisco confirmed on Monday. The vendor’s Product Security Incident Response Team became aware of active...
CISA KEV · · Critical severity
Cisco Secure Email Gateway SQL Injection Vulnerability. Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary...
Help Net Security · · Critical severity
The EU Agency for Cybersecurity switched on the Cyber Resilience Act‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporting obligations started binding manufacturers. ENISA built the tool and runs its...
The Hacker News · · Critical severity
Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports...
CISA KEV · · Critical severity
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability. GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an...
CISA KEV · · Critical severity
JFrog Artifactory Improper Authentication Vulnerability. JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is...
CISA KEV · · Critical severity
JFrog Artifactory Incorrect Authorization Vulnerability. JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and...
CISA KEV · · Critical severity
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability. ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker...
Exploit-DB · · Medium severity
CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
AlienVault OTX · · Medium severity
Active exploitation of three critical vulnerabilities in JFrog Artifactory has been identified, with attackers chaining CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 to bypass authentication and gain administrative control....
The Hacker News · · Critical severity
PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development...
CISA KEV · · Critical severity
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability. MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the...
CISA KEV · · Critical severity
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability. MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the...
Help Net Security · · Critical severity
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC), which is used for centrally managing multiple...
Malwarebytes Labs · · Critical severity
Chrome is rolling out an update for its desktop browser. The update includes 230 security fixes, one of which is known to be actively exploited . The stable channel has been updated to 153.0.8010.36/.37 for Windows and Mac, and...
BleepingComputer · · Critical severity
Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks.
CISA KEV · · Critical severity
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability. Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an...
CISA KEV · · Critical severity
Google Chromium V8 Out of Bounds Write Vulnerability. Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This...
CISA KEV · · Critical severity
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability. Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands...
CISA KEV · · Critical severity
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability. Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the...
Help Net Security · · Critical severity
Google has fixed 230 vulnerabilities in Chrome, including a zero-day flaw, CVE-2026-87491, with an in-the-wild exploit. “Google is aware that an exploit for CVE-2026-87491 exists in the wild,” the company said in a Tuesday security...
CISA KEV · · Critical severity
Microsoft Windows Heap-Based Buffer Overflow Vulnerability. Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. Required action:...
CISA KEV · · Critical severity
N-able N-central Static Code Injection Vulnerability. N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Required action: Apply mitigations in accordance with...
CISA KEV · · Critical severity
Microsoft Windows Link Following Vulnerability. Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. Required action: Apply mitigations in...
CISA KEV · · Critical severity
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability. Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine...
Tenable Research ·
104 Critical 860 Important 0 Moderate 0 Low Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild. Microsoft...
Tenable Research · · Critical severity
A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became...
Help Net Security · · Critical severity
N-able released an emergency hotfix for CVE-2026-86218, a remote code execution (RCE) flaw affecting N-central, its remote monitoring and management (RMM) solution popular with managed service providers (MSPs). In its release notes,...
CERT Polska · · Critical severity
The CERT Polska team identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS, including two critical ones. These vulnerabilities are already actively used to take over devices whose SSH service is available...
Hacker News · · Critical severity
CISA KEV · · Critical severity
Google Chromium V8 Type Confusion Vulnerability. Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could...
Help Net Security · · Critical severity
Google has patched 12 vulnerabilities affecting its popular Chrome browser, among them CVE-2026-85046, which has been exploited in the wild. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the company said in a...
The Hacker News · · Critical severity
Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been...
All CISA Advisories · · Medium severity
CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability CVE-2026-48710 Kludex Starlette HTTP...
CISA KEV · · Critical severity
SonicWall SMA1000 Appliances OS Command Injection Vulnerability. SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS...
CISA KEV · · Critical severity
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability. SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free