vulnerability Microsoft Warns of Two Actively Exploited Defender Vulnerabilities Microsoft has disclosed two actively exploited vulnerabilities within its Defender security platform, CVE-2026-41091 and CVE-2026-45498, both of which allow for privilege escalation and denial-of-service attacks. These v… The Hacker News · May 21, 2026 High CVE-2026-41091CVE-2026-45498CVE-2026-33825defendervulnerabilityprivilege escalation
vulnerability Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days Microsoft released patches for two previously exploited zero-day vulnerabilities within its Defender security software. These vulnerabilities, CVE-2026-41091 and CVE-2026-45498, allowed for privilege escalation and denia… SecurityWeek · May 21, 2026 High CVE-2026-41091CVE-2026-45498CVE-2008-4250zero-dayprivilege escalationdenial of service
vulnerability Google’s Surge in Chrome Vulnerability Discoveries Likely Driven by AI More than 200 vulnerabilities patched in recent Chrome releases are marked as ‘reported by Google’. The post Google’s Surge in Chrome Vulnerability Discoveries Likely Driven by AI appeared first on SecurityWeek . SecurityWeek · May 21, 2026 Medium
vulnerability Microsoft warns of new Defender zero-days exploited in attacks Microsoft has released security patches for two zero-day vulnerabilities, CVE-2026-41091 (RedSun) and CVE-2026-45498 (UnDefend), that are being actively exploited in attacks. These flaws, affecting Microsoft Defender and… BleepingComputer · May 21, 2026 High CVE-2026-41091CVE-2026-45498USzero-dayprivilege escalationdefender
vulnerability 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros A nine-year-old vulnerability in the Linux kernel, CVE-2026-46333, allows unprivileged users to execute commands as root, posing a significant risk to systems running affected distributions. The flaw stems from improper… The Hacker News · May 21, 2026 High CVE-2026-46333linuxkernelprivilege escalation
vulnerability Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks Drupal has released security updates for a "highly critical" security vulnerability in Drupal Core that could be exploited by attackers to achieve remote code execution, privilege escalation, or information disclosure. T… The Hacker News · May 21, 2026 High CVE-2026-9082
vulnerability Anthropic Silently Patches Claude Code Sandbox Bypass Anthropic has addressed a vulnerability in its Claude Code network sandbox that could have allowed attackers to bypass security controls and potentially exfiltrate data. The vulnerability, discovered by researcher Aonan… SecurityWeek · May 20, 2026 High CVE-2025-66479sandboxprompt injectionsecurity
vulnerability Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01) This CISA advisory details a vulnerability (SEVD-2026-132-01) in Schneider Electric’s Ecostruxure Machine Expert HVAC software, specifically versions prior to 1.10.0. The vulnerability, classified as CWE-312 (Cleartext S… CISA Advisories · May 20, 2026 High CVE-2026-6332WOcwe-312source codeconfidentiality
vulnerability CISA Adds Seven Known Exploited Vulnerabilities to Catalog CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability CVE-2009-1537 Micros… CISA Advisories · May 20, 2026 Medium CVE-2008-4250CVE-2009-1537CVE-2009-3459
vulnerability Exploit released for new PinTheft Arch Linux root escalation flaw A publicly available exploit, dubbed ‘PinTheft’, has been released for a Linux kernel vulnerability allowing local attackers to gain root privileges on Arch Linux systems. The vulnerability, residing in the RDS module, w… BleepingComputer · May 20, 2026 High linuxprivilege escalationrds
vulnerability How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) This article details a vulnerability (CVE-2026-3102) in ExifTool for macOS, allowing an attacker to execute arbitrary commands by injecting malicious data into the FileCreateDate metadata field. The vulnerability stems f… Securelist · May 20, 2026 Critical CVE-2026-3102CVE-2021-22204exiftoolmacosmetadata
vulnerability Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit This report details a zero-day vulnerability, dubbed ‘YellowKey,’ affecting Windows 11 and Server 2025, allowing attackers to bypass BitLocker Device Encryption through a USB drive exploit. Microsoft has released a mitig… The Hacker News · May 20, 2026 High CVE-2026-45585USbitlockerwinrezero-day
vulnerability Microsoft shares mitigation for YellowKey Windows zero-day Microsoft has released mitigation steps for a newly disclosed Windows zero-day vulnerability, dubbed YellowKey, which allows unauthorized access to BitLocker-protected drives. The vulnerability was initially revealed by… BleepingComputer · May 20, 2026 High CVE-2026-33825CVE-2026-45585zero-daybitlockerwinre
vulnerability Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector Verizon’s 2026 Data Breach Investigations Report (DBIR) reveals that vulnerability exploitation has become the leading cause of data breaches, surpassing credential theft. The report highlights a concerning trend of slow… SecurityWeek · May 20, 2026 High USvulnerability managementpatchinggen-ai
vulnerability Max-severity flaw in ChromaDB for AI apps allows server hijacking A critical vulnerability (CVE-2026-45829) has been identified in the ChromaDB project, allowing unauthenticated attackers to execute arbitrary code on exposed servers. This flaw stems from a misplacement of authenticatio… BleepingComputer · May 19, 2026 Critical CVE-2026-45829apipythonfastapi
vulnerability Verizon DBIR: Enterprises Face a Dangerous Vulnerability Glut Verizon's 2026 Data Breach Investigations Report (DBIR) highlights a concerning trend: the increasing prevalence of exploits in initial breaches, rising to 31% in 2025. Organizations struggle to keep pace with the massiv… Dark Reading · May 19, 2026 High NOvulnerabilitiespatch managementai
vulnerability TP-Link, Photoshop, OpenVPN, Norton VPN vulnerabilities Cisco Talos has disclosed multiple vulnerabilities across several popular products, including TP-Link routers, Adobe Photoshop, OpenVPN, and Norton VPN. These vulnerabilities range from buffer overflows and OS command in… Cisco Talos · May 19, 2026 Medium CVE-2026-30814CVE-2026-30815CVE-2026-30816routerbuffer overflowos command injection
vulnerability Kieback & Peter DDC Building Controllers This CISA advisory details a cross-site scripting (XSS) vulnerability affecting several versions of Kieback & Peter’s DDC Building Controllers. The vulnerability, CVE-2026-4293, allows an attacker to execute JavaScript c… CISA Advisories · May 19, 2026 Medium CVE-2026-4293AUATCNxssbuilding automationot
vulnerability ZKTeco CCTV Cameras A vulnerability has been identified in ZKTeco CCTV cameras, specifically models utilizing the SSC335-GC2063-Face-0b77 Solution firmware, allowing unauthorized access to camera credentials and configuration information. T… CISA Advisories · May 19, 2026 Medium CVE-2026-8598CHcctvcameraauthentication
vulnerability ABB CoreSense HM and CoreSense M10 This advisory from CISA details a path traversal vulnerability (CVE-2025-3465) affecting ABB CoreSense HM and CoreSense M10 devices. Unauthenticated users could potentially gain access to restricted directories, leading… CISA Advisories · May 19, 2026 High CVE-2025-3465WOpath traversalcve-2025-3465abb
