A Missing Check in Red Hat Quay’s Key Server Lets Anyone Forge Trusted Signing Keys
A critical flaw in Red Hat Quay's service key server, tracked as CVE-2026-123710 with a CVSS score of 9.8, lets an anonymous caller plant a self-approved signing key...
AWS Closes an SSRF Hole in Its MCP Gateway That Could Turn a Trusted User Into an Internal Network Scanner
AWS has patched a server-side request forgery flaw in its open-source mcp-gateway-registry project, tracked as CVE-2026-125926, that let an authenticated user with server-registration rights redirect the gateway to...
Node.js Patches 16 Bugs, Including One That Can Leak TLS Private Keys From Memory
Node.js has shipped fixes for 16 security vulnerabilities across its 22.x, 24.x, and 26.x release lines, seven of them rated high severity. The most serious, a use-after-free triggered...
Unpatched SignDrop Exploit Claims to Bypass Windows’ Newest Anti-Ransomware Shield
A researcher has published a proof-of-concept called SignDrop that claims to defeat the HMAC authentication Microsoft added to the Common Log File System last year, potentially letting a...
Fortinet Patches a Cluster of Critical Flaws — Several Let Attackers Skip the Login Screen Entirely
Fortinet has disclosed a batch of critical vulnerabilities across FortiManager, FortiAnalyzer, and FortiOS, several of which score above 9.0 on the CVSS scale and can be triggered without...
Microsoft Confirms Attackers Are Already Exploiting a Fresh Outlook Flaw to Steal Login Hashes
Microsoft has confirmed active exploitation of a newly patched Outlook vulnerability that can leak a victim's Windows authentication hash when they open a malicious file. The zero-day, fixed...
Barracuda Confirms Hackers Are Chaining Two Email Gateway Bugs for Full Root Access
Barracuda says a small number of customers have already been hit by attackers combining two vulnerabilities in its Email Security Gateway to gain root-level access without authentication. The...
Google Rushes Emergency Patch as Chrome Zero-Day Is Exploited in the Wild
Google has shipped an emergency Chrome update after confirming that attackers are already exploiting a high-severity use-after-free flaw in the browser's XML handling. The fix lands alongside eight...