Patch Alert Archives • Page 18 of 18 • Daily CyberSecurity

OpenStack Admin Forgery: CVE-2026-22797 Lets Users ‘Ask’ for Root

OpenStack Admin Forgery: CVE-2026-22797 Lets Users ‘Ask’ for Root

Do Son January 16, 2026

OpenStack patches CVE-2026-22797 (Privilege Escalation). Flaw in OAuth2 middleware allows header forgery for admin access. Update keystonemiddleware now.

CVE-2025-33206: High-Severity Flaw Patched in NVIDIA Nsight Graphics for Linux NVIDIA Nsight Vulnerability CVE-2025-33206 NVIDIA ConnectX Firmware - CVE-2024-0105

NVIDIA Nsight Vulnerability CVE-2025-33206 NVIDIA ConnectX Firmware - CVE-2024-0105

CVE-2025-33206: High-Severity Flaw Patched in NVIDIA Nsight Graphics for Linux

Do Son January 15, 2026

NVIDIA patches high-severity command injection in Nsight Graphics for Linux (CVE-2025-33206). Update to v2025.5 to prevent code execution.

Palo Alto Networks Firewalls Hit by Unauthenticated GlobalProtect DoS Flaw PAN-OS IKEv2 Buffer Overflow CVE-2026-0263 Palo Alto Cortex XDR Privilege Escalation Palo Alto Networks Vulnerability CVE-2026-0229 PAN-OS Vulnerability CVE-2026-0227 CVE-2024-5914 - Palo Alto Networks - CVE-2025-0108 & CVE-2025-0110

Palo Alto Networks Firewalls Hit by Unauthenticated GlobalProtect DoS Flaw

Do Son January 15, 2026

Palo Alto warns: CVE-2026-0227 forces GlobalProtect firewalls into maintenance mode. Unauthenticated DoS risk. Update PAN-OS immediately.

Zoho Patches Critical “9.1” Flaw in ADSelfService Plus CVE-2025-1723 ManageEngine Vulnerability CVE-2025-11250

Zoho Patches Critical “9.1” Flaw in ADSelfService Plus

Do Son January 15, 2026

ManageEngine patches critical ADSelfService Plus flaw CVE-2025-11250 (CVSS 9.1). Update to Build 6519 immediately to secure your Active Directory.

One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA Cal.com Vulnerability CVE-2026-23478 Cal.com Auth Bypass, TOTP Logic Flaw

Cal.com Vulnerability CVE-2026-23478 Cal.com Auth Bypass, TOTP Logic Flaw

One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA

Do Son January 15, 2026

Critical Cal.com flaw (CVE-2026-23478) allows full account takeover via a single API call. CVSS 10.0. Update self-hosted instances to v6.0.7 immediately.

High-Severity Flaws in HPE Aruba Networking Expose Mobility Controllers to Attack CVE-2024-54006 & CVE-2024-54007 Aruba AOS Vulnerabilities CVE-2025-37168

CVE-2024-54006 & CVE-2024-54007 Aruba AOS Vulnerabilities CVE-2025-37168

High-Severity Flaws in HPE Aruba Networking Expose Mobility Controllers to Attack

Do Son January 15, 2026

Critical Aruba AOS flaw CVE-2025-37168 (CVSS 8.2) allows unauthenticated file deletion & DoS. Multiple RCE bugs also patched. Upgrade AOS immediately.

Command Injection Alert: High-Severity Flaws Hit LoadMaster & MOVEit WAF CVE-2024-1212 LoadMaster Vulnerability CVE-2025-13444

Command Injection Alert: High-Severity Flaws Hit LoadMaster & MOVEit WAF

Do Son January 15, 2026

Progress patches high-severity RCE flaws (CVE-2025-13444/47) in LoadMaster & MOVEit WAF. Update UI/API endpoints immediately to prevent command injection.

Exploit Code Published: Critical FortiSIEM Flaw Grants Unauthenticated Root Access FortiSIEM PoC Exploit CVE-2025-64155

Exploit Code Published: Critical FortiSIEM Flaw Grants Unauthenticated Root Access

Do Son January 14, 2026

PoC exploit code released for critical FortiSIEM flaw CVE-2025-64155 (CVSS 9.4). Unauthenticated RCE allows root access. Upgrade to v7.4.1 now.

Node.js Patches Memory Leak and Permission Bypasses CVE-2024-27980 Node.js Vulnerability CVE-2025-55131

Node.js Patches Memory Leak and Permission Bypasses

Do Son January 14, 2026

Urgent: Node.js patches CVE-2025-55131 (High Severity). "Dirty" memory flaw exposes secrets. Update to v20.20.0/v22.22.0 now to stop data leaks.

Chrome 144 Released: 10 Security Fixes Patch Dangerous V8 Engine Flaws

Chrome 148 lazy loading Chrome for Linux ARM64 Chrome 145 Update Chrome Security Fixes Chrome Security Update CVE-2026-1220 Chrome 144 Security Update CVE-2026-0899 Chrome Memory Safety, WebGPU UAF Chrome V8 Type Confusion, Google Updater Flaw Chrome V8 Flaw, CVE-2025-13042 Chrome V8, Type Confusion, Chrome 142 Update Chrome V8 Flaw, CVE-2025-12036 Chrome 141, WebGPU Overflow Google Chrome preloading Chrome, V8 vulnerability CVE-2025-9132 Chrome Security Update, Use-After-Free Chrome V8, Type Confusion Chrome Telemetry, Windows 10 EOL Microsoft Family Safety, Chrome Blocking Chrome Security Update, High-Severity Google Chrome, Antitrust CVE-2024-10487 and CVE-2024-10488 Google Chrome Root Program Chrome Update, CVE-2025-3619 Chrome Acquisition, Perplexity.ai

Chrome 144 Released: 10 Security Fixes Patch Dangerous V8 Engine Flaws

Do Son January 14, 2026

Chrome 144 fixes 10 vulnerabilities, including high-severity V8 flaw CVE-2026-0899. Update Windows, Mac & Linux immediately to secure your browser.

Elastic Stack Under Fire: 7 New Flaws Expose Files & Crash Servers Elastic Security Update CVE-2026-0532 Elastic Defend Arbitrary Delete, SYSTEM Privilege Escalation ECE Readonly EoP, Improper Authorization Elastic XSS, Kibana Vulnerabilities Elastic LPE, Observability Tools Vulnerabilities

Elastic Stack Under Fire: 7 New Flaws Expose Files & Crash Servers

Do Son January 14, 2026

Elastic patches 7 high-severity flaws (CVSS 8.6) in Kibana & Elasticsearch. CVE-2026-0532 allows SSRF & file theft. Update to v8.19.10 now.

AI Identity Theft: Critical ServiceNow Flaw (CVE-2025-12420) Allows Unauthenticated Impersonation ServiceNow AI Platform CVE-2026-0542 ServiceNow AI Vulnerability CVE-2025-12420 CVE-2025-0337

ServiceNow AI Platform CVE-2026-0542 ServiceNow AI Vulnerability CVE-2025-12420 CVE-2025-0337

AI Identity Theft: Critical ServiceNow Flaw (CVE-2025-12420) Allows Unauthenticated Impersonation

Do Son January 13, 2026

Critical ServiceNow AI flaw (CVE-2025-12420) allows unauthenticated user impersonation. Self-hosted users: update Now Assist & Virtual Agent immediately.

Angular Security Alert: High-Severity SVG Flaw CVE-2026-22610 Exposes Apps to XSS Angular hostname hijacking vulnerability Angular SSRF Origin Hijacking Angular XSS Vulnerability CVE-2026-32635 Angular i18n XSS CVE-2026-27970 Angular SSR SSRF CVE-2026-27739 Angular Vulnerability CVE-2026-22610 CVE-2025-59052 Angular security Angular XSS Bypass, SVG Injection

Angular hostname hijacking vulnerability Angular SSRF Origin Hijacking Angular XSS Vulnerability CVE-2026-32635 Angular i18n XSS CVE-2026-27970 Angular SSR SSRF CVE-2026-27739 Angular Vulnerability CVE-2026-22610 CVE-2025-59052 Angular security Angular XSS Bypass, SVG Injection

Angular Security Alert: High-Severity SVG Flaw CVE-2026-22610 Exposes Apps to XSS

Do Son January 13, 2026

Angular CVE-2026-22610 (CVSS 8.5) allows XSS via SVG script attributes. Update to v21.0.7 or v20.3.16 immediately to secure your apps.

CVE-2025-67732: Dify Patch Fixes High-Severity Plaintext API Key Exposure Dify API Key Exposure, LLM Security Dify Information Disclosure, LLM Security

Dify API Key Exposure, LLM Security Dify Information Disclosure, LLM Security

CVE-2025-67732: Dify Patch Fixes High-Severity Plaintext API Key Exposure

Do Son January 7, 2026

CVE-2025-67732 unmasks a high-severity flaw in Dify that exposes plaintext API keys to frontend users. Upgrade to v1.11.0 to secure your AI quotas.

CVE-2025-68428: Critical Flaw in jsPDF Library Allows Server-Side File Theft

Do Son January 6, 2026

CVE-2025-68428 reveals a 9.2 critical flaw in jsPDF's Node.js build, allowing arbitrary file reads from servers. Upgrade to version 4.0.0 now!

CVE-2026-21440: New AdonisJS 9.2 Critical Flaw Allows Arbitrary File Writes and RCE AdonisJS RCE, CVE-2026-21440

CVE-2026-21440: New AdonisJS 9.2 Critical Flaw Allows Arbitrary File Writes and RCE

Do Son January 5, 2026

CVE-2026-21440: A critical 9.2 flaw in AdonisJS file uploads allows attackers to overwrite system files and gain RCE. Update to v10.1.2 immediately!

CISA Alert: MongoBleed Added to KEV Catalog as 80,000+ Servers Face Active Exploitation Knowledge Deliver RCE vulnerability FortiClient EMS Vulnerability CVE-2026-35616 Cisco SD-WAN Vulnerability CVE-2026-20122 PCPcat, Next.js RCE Salesloft breach, Salesforce CRM WIREFIRE web shell

Knowledge Deliver RCE vulnerability FortiClient EMS Vulnerability CVE-2026-35616 Cisco SD-WAN Vulnerability CVE-2026-20122 PCPcat, Next.js RCE Salesloft breach, Salesforce CRM WIREFIRE web shell

CISA Alert: MongoBleed Added to KEV Catalog as 80,000+ Servers Face Active Exploitation

Do Son December 30, 2025

CISA adds MongoBleed (CVE-2025-14847) to its KEV Catalog after confirming active exploitation. 80,000+ MongoDB servers are at risk. Patch by Jan 19!

Hackers Revive 2020 FortiGate Flaw to Bypass 2FA Fortinet 2FA Bypass, Case-Sensitivity Exploit CVE-2023-25610 Fortinet SSO Bypass, FortiCloud SAML Flaw

Fortinet 2FA Bypass, Case-Sensitivity Exploit CVE-2023-25610 Fortinet SSO Bypass, FortiCloud SAML Flaw

Hackers Revive 2020 FortiGate Flaw to Bypass 2FA

Do Son December 25, 2025

Fortinet warns of active exploits for CVE-2020-12812, where attackers bypass 2FA on FortiGate firewalls by simply changing username capitalization.

Critical Network Collapse: 9.8 Severity Net-SNMP Buffer Overflow Threatens Global Monitoring Systems Net-SNMP, CVE-2025-68615

Critical Network Collapse: 9.8 Severity Net-SNMP Buffer Overflow Threatens Global Monitoring Systems

Do Son December 24, 2025

CVE-2025-68615: A critical 9.8 severity Net-SNMP buffer overflow allows attackers to crash snmptrapd. Upgrade to v5.9.5 or v5.10.pre2 immediately!

Critical Unauthenticated MongoDB Flaw Leaks Sensitive Data via zlib Compression MongoDB Vulnerability CVE-2026-25611 MongoDB zlib vulnerability, CVE-2025-14847 MongoDB Vulnerabilities, Data Access CVE-2024-6376 CVE-2025-0755

MongoDB Vulnerability CVE-2026-25611 MongoDB zlib vulnerability, CVE-2025-14847 MongoDB Vulnerabilities, Data Access CVE-2024-6376 CVE-2025-0755

Critical Unauthenticated MongoDB Flaw Leaks Sensitive Data via zlib Compression

Do Son December 23, 2025

MongoDB CVE-2025-14847: A high-severity flaw in zlib compression allows unauthenticated attackers to read sensitive heap memory. Upgrade to v8.2.3+!