Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Most administrators do not think about BIND, browser engines, or cloud kernels until one of them fails.
Multiple vulnerabilities were discovered in nginx, a high-performance web and reverse proxy server, which may result in denial of service, memory disclosure or…
Update python-django5 to the latest 5.x release (5.2.17) Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups Fixes CVE-…
Update python-django5 to the latest 5.x release (5.2.17) Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups Fixes CVE-…
Update python-django5 to the latest 5.x release (5.2.17) Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups Fixes CVE-…
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wedn…
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information dis…
A buffer overflow was found in the ODML parser of MKVToolNix, a set of command-line tools (and GUI) to work with Matroska files, which could potentially result…
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information dis…
The update for nginx released as DSA 6496-1 caused a regression in the nginx-dev package: the backported fix for CVE-2026-42533 declared two private header fil…
Update lru crate to version 0.18.4 and add a compat package for version 0.16. This fixes an obscure potential use-after-free issue: https://rustsec.org/advisor…
The urwid web display backend generates web session identifiers by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, whi…
Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.
Update lru crate to version 0.18.4 and add a compat package for version 0.16. This fixes an obscure potential use-after-free issue: https://rustsec.org/advisor…
On September 10, 2026, Wiz Research reported that multiple attackers had chained two Artifactory vulnerabilities against self-hosted repositories. One flaw gav…
Multiple vulnerabilities were discovered in nginx, a high-performance web and reverse proxy server, which may result in denial of service, memory disclosure or…
Several vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and…
Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewa…
Adobe has released an emergency fix for a Magento vulnerability that attackers are already using against online stores. Someone exploiting the flaw can make an…
Chrome release notes can be a blur of version numbers. This one deserves a closer look. In the Linux build published on September 3, 2026, Google fixed CVE-202…
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, eve…
Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws.The fixes are avai…
A kernel crash tells defenders that something went wrong. It does not show whether an attacker can turn that failure into a useful capability, combine several …
A patched Linux server can still fail a penetration test because patch status cannot show whether an attack path remains open.
