Apache Camel’s Latest Security Update Closes Six Flaws — From File-Leaking XXE Bugs to Remote Code Execution
The Apache Camel integration framework has shipped fixes for six vulnerabilities spanning XML parsing, deserialization, and credential handling. Three are rated high severity, including a pair of XXE...
GitLab Patches Maximum-Severity RCE Flaw as Exploit Code Goes Public
A public proof-of-concept now exists for CVE-2026-97229, a maximum-severity (CVSS 10.0) GitLab vulnerability that chains a CI/CD regex integer overflow into remote command execution. Self-managed GitLab instances on...
Microsoft’s October Patch Tuesday Fixes Over 1,100 Flaws and Debuts a New Way to Triage Them
Microsoft's October 2026 Patch Tuesday addressed 1,118 vulnerabilities, one of its largest releases yet, and introduced an experimental 'risk cohort' framework that groups flaws by the shared exposure...
Thousands of Exposed NVIDIA GPU Monitors Leave AI Data Centers Open to Crash Attacks
A high-severity flaw in NVIDIA's DCGM Exporter monitoring tool lets unauthenticated attackers flood debug endpoints and knock GPU telemetry offline. Researchers found over 2,000 exposed instances across nearly...
Apache Patches a Dozen Tomcat Flaws Spanning WebSockets, HTTP/2, and TLS Checks
Apache has released Tomcat 11.0.26 to close twelve security holes across WebSocket, HTTP/2, AJP, authentication, and certificate-validation code, including a message-smuggling bug and a header mix-up introduced by...
GitLab’s Email-to-Issue Feature Can Be Hijacked to Commit Code as Any User
Researchers at Aikido Security found that GitLab’s incoming-email work-item feature relies on a long-lived, non-expiring token that, if exposed, lets an attacker submit merge requests and land commits...
Maximum-Severity Flaw in D-Link Routers Lets Attackers Take Over Devices With No Login Required
A stack-based buffer overflow in D-Link's DIR-822A router, rated a perfect CVSS 10.0, can be triggered remotely with no authentication and no user interaction, and a working public...
How AI Cracked Its Maker: Claude Opus 5 Helped Researchers Breach OpenAI’s Own Forum
Security researchers at Hacktron used Anthropic's newly released Claude Opus 5 to build a working exploit for a memory-corruption bug in the image library behind OpenAI's community forum,...