📰 Dev.to · BeyondMachines

Siemens patched a maximum-severity authentication bypass vulnerability CVE-2026-56451 in its Opcenter X manufacturing platform that allowed unauthenticated atta

CISA has warned of active exploitation of two critical RCE vulnerabilities in Joomla's SP Page Builder and Page Builder CK extensions. Attackers are using these

OPNsense released critical security updates to fix a root remote code execution vulnerability (CVE-2026-57155) in its GeoIP alias importer. The update also patc

The Texas Hearing Institute suffered a ransomware attack claimed by the Interlock group, resulting in the alleged theft of 540 GB of data and compromising the p

phpBB version 3.3.17 patches a critical authentication bypass (CVE-2026-48611) that allows unauthenticated attackers to take over any account, including adminis

Apple released security updates for iOS, macOS, and Safari to fix 37 vulnerabilities, including 26 WebKit flaws.

Aflac Japan reported a data breach affecting 4.38 million policyholders after unauthorized actors accessed the 'Aflac Yoriso Net' portal for ten days. The breac

curl version 8.21.0 addresses 18 vulnerabilities, including a 25-year-old authentication bypass (CVE-2026-8932) and multiple memory safety issues. The flaws pri

Xsolis, a healthcare technology firm, suffered a data breach affecting nearly 1.4 million people after a targeted phishing attack allowed unauthorized access to

Atlassian's June 2026 security update addresses 100 vulnerabilities, including critical flaws in third-party dependencies like Axios, Apache Tomcat, and Netty.

LiteLLM patched a critical vulnerability chain (CVSS 9.9) that allows low-privilege users to escalate privileges and execute arbitrary code on AI gateway server

Oracle issued an emergency patch for a critical code injection vulnerability (CVE-2026-35273, CVSS 9.8) in PeopleSoft Enterprise PeopleTools that allows unauthe

Arm reports a critical privilege escalation vulnerability (CVE-2025-10263) affecting multiple CPU cores, including Neoverse and Cortex models, due to a timing f

Palo Alto Networks patched a high-severity authentication bypass vulnerability (CVE-2026-0257) in PAN-OS and Prisma Access that is being exploited to gain unaut

Kennedy McLaughlin & Associates, an Australian accounting firm, confirmed a data breach after the Qilin ransomware group published stolen client financial recor

Gogs is reported to have a critical unpatched authenticated RCE vulnerability (CVSS 9.4) that allows users to execute arbitrary code via malicious branch names

Carnival Corporation reported a data breach resulting from a social engineering attack on an employee account that exposed names, addresses, and government iden

7-Zip version 26.00 and earlier contain a critical heap buffer overflow (CVE-2026-48095) in the NTFS handler that allows attackers to execute arbitrary code via

A critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) is being exploited to steal administrative keys and inject malicious 'ClickFix' scripts int

Charter Communications is investigating a data breach claimed by the ShinyHunters group, who allege they stole 42 million customer records via compromised cloud

LiteSpeed Technologies patched a critical, actively exploited vulnerability (CVE-2026-48172, CVSS 10.0) in its cPanel plugin that allows any user to run scripts

NGINX has disclosed a critical heap buffer overflow vulnerability (CVE-2026-9256) in its rewrite module that allows unauthenticated attackers to cause denial-of

Grafana Labs suffered a codebase breach after an unauthorized party, claimed by the CoinbaseCartel group via a compromised GitHub token to exfiltrate internal s

The sealed-env npm package patched a critical vulnerability (CVE-2026-45091) that leaked plaintext TOTP secrets in unseal tokens, allowing attackers to bypass t