Rapid7 reportedly disclosed 17 Zimbra Collaboration Suite flaws, from cross-site scripting to sudo-based root escalation, with patch releases now available.
Sansec says an unknown actor infected 953 online stores, mostly Magento, since July 2025 using five loader domains and a
OpenMage Magento LTS 20.19.0 and 20.18.2 fix 34 vulnerabilities, including a CVSS 9.0 OAuth CSRF flaw that could yield a
Mautic 7.2.2, 6.0.10 and 5.2.12 fix CVE-2026-115188, a CVSS 9.9 file-upload remote code execution flaw, along with SQL injection and
GitLab fixed CVE-2026-110264, a CVSS 10.0 regex flaw in Onigmo that can let unauthenticated users run code on self-managed servers
Node.js shipped fixes for 10 flaws, led by a Brotli decoder out-of-bounds write that could allow code execution; a public
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and
A CVSS 9.3 denial-of-service flaw in Signal’s RingRTC library can leave a microphone and camera live after hangup. A fix
Google’s Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.