vulnerability Path traversal flaw in AI dev platform Langflow exploited in attacks Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in the AI development platform Langflow, to write arbitrary files on exposed servers. BleepingComputer · Jun 10, 2026 High CVE-2026-5027CVE-2026-0770CVE-2026-21445
vulnerability Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities This article reports on critical security vulnerabilities recently patched by Fortinet, Ivanti, and SAP. These vulnerabilities, including command injection and authentication bypass flaws, could allow unauthorized code e… The Hacker News · Jun 10, 2026 Critical CVE-2026-25089CVE-2026-10520CVE-2026-10523command injectionremote code executionauthentication bypass
vulnerability Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE A critical vulnerability, CVE-2026-5027, in the Langflow low-code platform has been actively exploited, allowing for remote code execution due to a lack of input sanitization. This flaw, combined with unauthenticated aut… The Hacker News · Jun 10, 2026 Critical CVE-2026-5027CVE-2026-0770CVE-2026-33017USCAlow-codeairemote code execution
vulnerability CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation CISA has added three newly exploited vulnerabilities to its KEV catalog, impacting Cisco, Google Chrome, and Arista Networks. These vulnerabilities – one in Cisco SD-WAN Manager, another in Chrome’s V8 engine, and a thir… The Hacker News · Jun 10, 2026 High CVE-2026-20245CVE-2026-11645CVE-2026-7473cvesd-wanchrome
vulnerability Microsoft patches Exchange Server zero-day exploited in attacks Microsoft has patched an actively exploited Exchange Server vulnerability that allows threat actors to execute arbitrary JavaScript code in cross-site scripting (XSS) attacks targeting Outlook Web Access users. BleepingComputer · Jun 10, 2026 Critical CVE-2026-42897
vulnerability Microsoft ships largest Patch Tuesday on record, with one bug under active attack Microsoft released its largest Patch Tuesday update to date, containing 206 CVEs, driven by the increasing use of AI in vulnerability discovery. A particularly concerning vulnerability, CVE-2026-45657, is described as ‘w… The Record · Jun 10, 2026 Critical CVE-2026-45657CVE-2026-41091CVE-2026-50507UKpatch tuesdayvulnerabilityai
vulnerability Critical HVAC and UPS Vulnerabilities Could Let Hackers Disrupt Data Centers Claroty researchers have analyzed the security of Vertiv UPS network cards and the Trane Tracer SC+ HVAC controller. The post Critical HVAC and UPS Vulnerabilities Could Let Hackers Disrupt Data Centers appeared first on… SecurityWeek · Jun 10, 2026
vulnerability New Windows Zero-Day Exploit ‘RoguePlanet’ Released A new Windows zero-day exploit, dubbed RoguePlanet, has been released by the threat actor Nightmare Eclipse, targeting Microsoft Defender and potentially leading to local privilege escalation and BitLocker bypass. This f… SecurityWeek · Jun 10, 2026 High CVE-2026-45586CVE-2026-50507CVE-2026-41091USzero-daylocal privilege escalationbitlocker
vulnerability Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days On Tuesday, Microsoft patched two zero-day vulnerabilities that let attackers gain SYSTEM privileges on fully patched Windows systems, and a third one that grants access to BitLocker-protected drives. BleepingComputer · Jun 10, 2026 Critical CVE-2026-45586CVE-2020-17103CVE-2026-45585
vulnerability ServiceNow Patches Vulnerability Exploited Against Some Customers The company updated hosted customer instances to patch a security issue it reportedly had known about since April 7. The post ServiceNow Patches Vulnerability Exploited Against Some Customers appeared first on SecurityWe… SecurityWeek · Jun 10, 2026 Medium
vulnerability Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs Microsoft released a significant security update addressing 206 vulnerabilities across its software portfolio, including multiple critical Remote Code Execution (RCE) flaws and several zero-days. The update focuses on pa… The Hacker News · Jun 10, 2026 Critical CVE-2025-10263CVE-2026-8863CVE-2026-45657USzero-dayrcebitlocker
vulnerability Critical Vulnerabilities Patched in Fortinet, Ivanti Products Two OS command injection flaws can be exploited remotely, without authentication, for arbitrary code execution. The post Critical Vulnerabilities Patched in Fortinet, Ivanti Products appeared first on SecurityWeek . SecurityWeek · Jun 10, 2026 CVE-2026-25089CVE-2026-10520CVE-2026-10523
vulnerability ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact In addition, Rockwell Automation announced some enhancements to its SecureOT cybersecurity solution for OT. The post ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact appeared first on Secur… SecurityWeek · Jun 10, 2026 CVE-2025-15467
vulnerability ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances ServiceNow has disclosed a security incident where an unknown threat actor exploited a vulnerability to gain unauthorized access to customer instances. The flaw, initially discovered and internally tracked by ServiceNow… The Hacker News · Jun 10, 2026 High AUsecurityvulnerabilityaccess
vulnerability No Patch Planned for Exploited Arista EOS Vulnerability Organizations are advised to apply vendor-supplied mitigations or discontinue the vulnerable devices. The post No Patch Planned for Exploited Arista EOS Vulnerability appeared first on SecurityWeek . SecurityWeek · Jun 10, 2026 Medium CVE-2026-7473CVE-2026-11645CVE-2026-20245
vulnerability Ivanti: Max severity Sentry flaw allows code execution as root Ivanti has patched two critical vulnerabilities in its Sentry secure mobile gateway solution, including a maximum-severity flaw that enables remote attackers to execute code with root privileges. BleepingComputer · Jun 10, 2026 CVE-2026-10520CVE-2026-10523
vulnerability Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows A security researcher, Chaotic Eclipse (MSNightmare), has released a proof-of-concept exploit, RoguePlanet, targeting a zero-day vulnerability in Microsoft Defender, granting SYSTEM-level access on updated Windows 11 and… The Hacker News · Jun 10, 2026 High CVE-2026-33825CVE-2026-45498CVE-2026-41091USzero-dayexploitmicrosoft defender
vulnerability Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS Six vulnerabilities, dubbed Proto6, have been identified in protobuf.js, a JavaScript implementation of Protocol Buffers. These flaws could lead to remote code execution (RCE) and denial-of-service (DoS) attacks, primari… The Hacker News · Jun 10, 2026 High CVE-2026-44289CVE-2026-44290CVE-2026-44291node.jsprotobufrce
vulnerability Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges A new Microsoft Defender zero-day vulnerability, dubbed "RoguePlanet," has emerged, allowing attackers to gain SYSTEM privileges on fully patched Windows 10 and 11 systems via a race condition. The vulnerability was disc… BleepingComputer · Jun 9, 2026 High zero-dayrace conditionremote code execution
vulnerability Microsoft Patch Tuesday for June 2026 — Snort rules and prominent vulnerabilities Microsoft released its June 2026 security patch update, addressing 206 vulnerabilities across its product suite. A significant portion, 32 critical vulnerabilities, focus on remote code execution (RCE) issues within prod… Cisco Talos · Jun 9, 2026 High CVE-2026-42985CVE-2026-47291CVE-2026-44803remote code executionbuffer overflowinteger overflow
