Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM...
critical
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Ravie LakshmananAug 18, 2026Vulnerability / Artificial Intelligence Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA,...
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
Swati KhandelwalAug 17, 2026Vulnerability / DevOps GitLab has released security updates to address a critical vulnerability impacting its Community Edition...
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Ravie LakshmananAug 17, 2026Vulnerability / Website Security A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin...
Zoom Zero-Click RCE: AI Helped Build an Exploit in Under 24 Hours
A critical Zoom vulnerability chain could have allowed an attacker to take control of another participant’s device simply by joining...
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Ravie LakshmananAug 12, 2026Vulnerability / Web Security Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce,...
Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
Ravie LakshmananAug 06, 2026Network Security / Vulnerability Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst...
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files...
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Swati KhandelwalJul 29, 2026Vulnerability / DevOps Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A...
Critical TeamCity Flaw Could Let Unauthenticated Attackers Execute Server Commands
JetBrains has patched a critical TeamCity vulnerability that could allow unauthenticated attackers to run operating system commands on exposed, self-hosted...
Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws...
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link...
Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
Ravie LakshmananJul 21, 2026Email Security / Vulnerability Zimbra has rolled out fixes to address multiple critical security issues, including a...
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow...
Critical Zoom Flaw Could Let Attackers Take Over Windows Accounts
A critical flaw in Zoom’s Windows software could allow an unauthenticated attacker to remotely take over an account, giving organizations...
