vulnerability NAVTOR NavBox A critical vulnerability (CVE-2026-21404) has been identified in NAVTOR NavBox versions 4.16.1.20, allowing local attackers to gain unauthorized access due to hard-coded credentials within the Windows Communication Found… CISA Advisories · Jun 4, 2026 Critical CVE-2026-21404NOsoapcredentialswcf
vulnerability B&R PPT30 Operating System A vulnerability, CVE-2025-11482, has been identified in B&R PPT30 Operating System versions prior to 1.8.0, specifically within the OPC-UA Server. An unauthenticated network-based attacker could exploit this flaw to perm… CISA Advisories · Jun 4, 2026 High CVE-2025-11482WOopcuafirmwarenetwork-based
vulnerability Hitachi Energy ITT600 Explorer Hitachi Energy has identified vulnerabilities in its ITT600 Explorer product, specifically versions prior to 2.1 SP6, which could lead to Denial of Service (DoS) attacks. The vulnerabilities stem from a stack overflow in… CISA Advisories · Jun 4, 2026 High CVE-2024-8176CVE-2025-59375SWiec61850denial of servicelibexpat
vulnerability Cisco warns of critical Unified CM flaw with PoC exploit code Cisco has issued a critical security update addressing a vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM) software. This flaw allows attackers to gain root privileges through SSRF attacks… BleepingComputer · Jun 4, 2026 Critical CVE-2026-20230CVE-2026-20045CVE-2024-20253ssrfprivilege escalationroot access
vulnerability Cisco Warns of Available PoC for Critical Unified CM Vulnerability The high-severity flaw can be exploited remotely, without authentication, in server-side request forgery (SSRF) attacks. The post Cisco Warns of Available PoC for Critical Unified CM Vulnerability appeared first on Secur… SecurityWeek · Jun 4, 2026 High CVE-2026-20230
vulnerability VS Code Vulnerability Allows One-Click GitHub Token Theft A researcher has disclosed the full details of the vulnerability and released a PoC without notifying Microsoft in advance. The post VS Code Vulnerability Allows One-Click GitHub Token Theft appeared first on SecurityWee… SecurityWeek · Jun 4, 2026 Medium
vulnerability CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability, CVE-2026-45247, affecting the Mirasvit Cache Warmer Magento extension to its KEV catalog. This flaw allows for remote c… The Hacker News · Jun 4, 2026 Critical CVE-2026-45247USUKFRphpobjectdeserialization
vulnerability CISA warns of active attacks exploiting Android, Linux bugs The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting vulnerabilities in the Linux kernel and Android operating system. BleepingComputer · Jun 3, 2026 CVE-2025-48595CVE-2022-0492
vulnerability Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag A vulnerability in Microsoft 365 Android apps allowed unauthorized apps to steal user account tokens, potentially granting access to sensitive data like emails and calendar information. The flaw, discovered by Enclave, s… The Hacker News · Jun 3, 2026 High CVE-2026-41100CVE-2026-41101CVE-2026-41102androidtokenspoofing
vulnerability Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479) A 2-year-old remote code execution (RCE) vulnerability, CVE-2026-23479, was discovered in Redis 7.2.0 by an autonomous AI security tool, Team Xint Code. The flaw, stemming from a use-after-free issue in the `unblockClien… The Hacker News · Jun 3, 2026 High CVE-2026-23479UKuse-after-freerceredis
vulnerability Organizations Warned of Exploited Linux Kernel Vulnerability An improper authentication bug allows attackers to escalate their privileges and escape containers. The post Organizations Warned of Exploited Linux Kernel Vulnerability appeared first on SecurityWeek . SecurityWeek · Jun 3, 2026 Medium CVE-2022-0492CVE-2025-48595
vulnerability Acer working to patch max severity zero-days in Wave 7 routers Acer has confirmed the existence of two critical zero-day vulnerabilities in its Wave 7 mesh routers, reported by security researcher Gergo Pap. These flaws, CVE-2026-49200 and CVE-2026-49201, allow unauthorized access t… BleepingComputer · Jun 3, 2026 Critical CVE-2026-49200CVE-2026-49201zero-daymesh routercredentials
vulnerability Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore Assume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and "patch everything in time" stopped working years ago. Stop betting the org on winning that race. You don't control which… The Hacker News · Jun 3, 2026 Critical
vulnerability Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Too… The Hacker News · Jun 3, 2026 Medium CVE-2026-33829CVE-2023-35636
vulnerability VS Code zero-day lets hackers steal GitHub tokens in one click A researcher, Ammar Askar, has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link. The vulne… BleepingComputer · Jun 3, 2026 High zero-daygithubvscode
vulnerability Critical Kirki flaw exploited to hijack WordPress admin accounts Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators. BleepingComputer · Jun 2, 2026 High CVE-2026-8206
vulnerability Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that has come under active… The Hacker News · Jun 2, 2026 Critical CVE-2025-48595
vulnerability Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of a… The Hacker News · Jun 2, 2026 High CVE-2024-21182CVE-2026-21962
vulnerability Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk A critical vulnerability was discovered in six Microsoft 365 Android apps – Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote – due to a debug flag left enabled in production code. This allowed… SecurityWeek · Jun 2, 2026 Critical CVE-2026-41100USdebugaccess tokensupply chain
vulnerability Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities Google says the Android vulnerability CVE-2025-48595 has been exploited in limited, targeted attacks. The post Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities appeared first on SecurityWeek . SecurityWeek · Jun 2, 2026 Critical CVE-2025-48595CVE-2026-0059
