Wireshark Update Fixes 19 Flaws That Turn Untrusted Captures Into Workstation Risk
Wireshark 4.6.9 and 4.4.19 address 19 documented vulnerabilities, including a configuration-profile flaw that may permit code execution. Security teams should update analyst workstations and treat captures, profiles and...
Unsigned JWT Flaw Opened Microsoft Analytics Service to Administrator Access
A missing signature check in Microsoft’s internal Titan analytics service allowed a forged token to obtain administrator privileges and query connected databases. Microsoft closed the public endpoint after...
Actively Exploited Linux Kernel Race Condition Enables Root and Container Escape
A race condition in Linux’s AF_ALG cryptographic interface can give an unprivileged local attacker root access and may support Docker container escape. CISA lists CVE-2025-39964 as exploited in...
ServiceNow Rushes Fixes for Five AI Platform Bugs After Two Are Rated Critical
ServiceNow has patched five vulnerabilities in its AI Platform, including a SQL injection flaw and a missing-authorization bug that together could let an unauthenticated attacker read, alter, or...
No Permissions Needed: OxygenOS Bugs Could Hand Root Access to Any App on a OnePlus 15
Two unpatched flaws in OnePlus's latest OxygenOS build could let an app that requests zero permissions still seize root-level control of the device, by abusing privileged system services...
Actively Exploited Roundcube Flaw Lets Attackers Slip Past the Login Screen Entirely
Canadian cybersecurity officials have confirmed active, in-the-wild exploitation of a pre-authentication SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842. The flaw requires no valid credentials to exploit,...
Cloudflare Patches Container Flaw That Exposed Residual Cross-Tenant Data
Cloudflare fixed a storage-layer weakness that could reveal fragments left behind by other customers using its Containers platform. The company found no malicious exploitation in retained telemetry and...
AWS Integration Lambda Could Turn Limited IAM Access Into Privileged Cloud Actions
CVE-2026-94384 allowed callers of an Amazon Connect Salesforce setup function to make AWS requests with the Lambda execution role's privileges. AWS has fixed the issue in AmazonConnectSalesforceLambda 5.26...