The Gentleman
You must login to view this content
Aggregator
CVE-2026-40358 | Microsoft Office up to LTSC 2024 use after free
1 month ago
A vulnerability marked as critical has been reported in Microsoft Office up to LTSC 2024. The affected element is an unknown function. Performing a manipulation results in use after free.
This vulnerability is identified as CVE-2026-40358. The attack can be initiated remotely. There is not any exploit available.
To fix this issue, it is recommended to deploy a patch.
vuldb.com
CVE-2026-35440 | Microsoft Word up to Word 2016 file access
1 month ago
A vulnerability identified as problematic has been detected in Microsoft Word 2019/365 Apps/LTSC 2021/LTSC 2024/Word 2016. This issue affects some unknown processing. This manipulation causes files or directories accessible.
The identification of this vulnerability is CVE-2026-35440. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to install a patch to address this issue.
vuldb.com
CVE-2026-35439 | Microsoft SharePoint Server 2.0/16.0.5548.1003 deserialization
1 month ago
A vulnerability categorized as critical has been discovered in Microsoft SharePoint Server 2.0/16.0.5548.1003. This vulnerability affects unknown code. The manipulation results in deserialization.
This vulnerability was named CVE-2026-35439. The attack may be performed from remote. There is no available exploit.
It is advisable to upgrade the affected component.
vuldb.com
Open WebUI Vulnerability via File Upload Leads to 1-Click RCE Attack
1 month ago
A single click can allow attackers to exploit a critical, unpatched flaw in Open WebUI to seize control of AI workspaces, execute remote code, hijack accounts, and steal sensitive chat histories. Discovered by security researcher Metin Yunus Kandemir, the vulnerability stems from a Stored Cross-Site Scripting (XSS) flaw in the platform’s profile image upload feature. […]
The post Open WebUI Vulnerability via File Upload Leads to 1-Click RCE Attack appeared first on Cyber Security News.
Abinaya
Горелкин предупредил: GitHub станет недоступен на 100% — пора переносить проекты на российские аналоги
1 month ago
Депутат назвал происходящее сознательной дискриминацией россиян.
Ivanti Patches Multiple Vulnerabilities in Secure Access, Xtraction, vTM and Endpoint Manager
1 month ago
Ivanti has released its May 2026 Patch Tuesday security updates, disclosing vulnerabilities across four products while revealing that artificial intelligence tools are already helping its engineers uncover flaws that traditional scanners miss and warning that AI-driven discovery will likely accelerate future disclosure volumes. Ivanti Patches Multiple Vulnerabilities The company addressed vulnerabilities in four distinct products […]
The post Ivanti Patches Multiple Vulnerabilities in Secure Access, Xtraction, vTM and Endpoint Manager appeared first on Cyber Security News.
Guru Baran
No Blind Spots: How Top MSSPs Prevent Incidents withLive Threat Visibility
1 month ago
Every incident that damages a client starts with a moment of invisibility: a connection the SIEM didn’t flag, a domain the detection rules didn’t know about, an IOC that was active for two days before any feed registered it. Top-performing MSSPs have learned that preventing incidents isn’t primarily a matter of analyst skill or tooling sophistication. It […]
The post No Blind Spots: How Top MSSPs Prevent Incidents withLive Threat Visibility appeared first on Cyber Security News.
Balaji N
Public Authority for Civil Information Allegedly Breached Exposing 5.23 Million Kuwaiti Citizen Records From the Kuwaiti Government Identity Authority
1 month ago
.dwi-post,
.dwi-post * {
font-family: 'Inter', -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
}
.dwi-post {
--dwi-card: rgba(127, 127, 127, 0.06);
--dwi-border: rgba(127, 127, 127, 0.18);
--dwi-muted: rgba(127, 127, 127, 0.85);
--dwi-cyan: #38bdf8;
--dwi-amber: #fbbf24;
max-width: 680px;
margin: 0 auto;
font-size: 16px;
line-height: 1.65;
font-feature-settings:
Dark Web Informer
Škoda warns of customer data breach after online shop hack
1 month ago
Škoda Auto, a wholly owned subsidiary of the Volkswagen Group, has disclosed a data breach after attackers hacked its online shop and stole the personal information of an undisclosed number of customers. [...]
Sergiu Gatlan
Заплатил выкуп — и что? Вымогатели года придумали схему, при которой деньги уже не помогают
1 month ago
6% компаний в России, 8% в Латинской Америке: кто и как страдает от вымогателей.
Android 17 to expand banking scam call and privacy protections
1 month ago
Android 17, expected to roll out next month, will introduce several security and privacy features focused on device theft, threat detection, and banking scam calls. [...]
Bill Toulas
Google and Amnesty International teamed up to make it harder for spyware vendors to hide
1 month ago
Intrusion Logging marks the first feature from a major device vendor to aid with forensic detection of sophisticated threats, Amnesty International said.
The post Google and Amnesty International teamed up to make it harder for spyware vendors to hide appeared first on CyberScoop.
Tim Starks
科技云报到：智算千亿赛道向何方？一文读懂信通院《2026智能算力服务研究报告》
1 month ago
科技云报到
European countries are exporting surveillance tech to countries with poor human rights records, report says
1 month ago
The report, released by the advocacy group Human Rights Watch on Tuesday, alleges that the European Commission has failed to effectively police member states' surveillance tech sales despite the 2021 implementation of updated bloc-wide export rules designed to rein in the practice.
New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution
1 month ago
Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution.
Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email.
The vulnerability, tracked as CVE-2026-45185 (CVSS score: 9.8), aka Dead.Letter, has been described as a
The Hacker News
Pwn2Own Berlin 2026 Hits Capacity as Rejected Hackers Release 0-Days
1 month ago
Pwn2Own Berlin 2026 reportedly reached full capacity for the first time, prompting rejected researchers to publicly disclose zero-day exploits targeting Firefox, NVIDIA, and AI platforms.
Deeba Ahmed
亿格云完成数亿元B轮融资，加码“人+AI”统一安全治理
1 month ago
亿格云
Больше тяги, больше дальности, энергия для лазеров: двигатель XA103 переписывает законы воздушного боя
1 month ago
Он уже прошёл сборку… правда, пока что только на компьютере.
SAP unveils Autonomous Enterprise for AI-driven business operations
1 month ago
SAP introduced the Autonomous Enterprise to help enhance the world’s most critical business workflows, so that humans and AI work together to meet the accelerating demands of global business profitably, strategically and safely. “For the mission-critical processes of our customers, ‘almost right’ just isn’t good enough,” said Christian Klein, CEO of SAP SE. “By uniting SAP Business AI Platform with SAP Autonomous Suite, we anchor AI agents in the business processes, data and governance so … More →
The post SAP unveils Autonomous Enterprise for AI-driven business operations appeared first on Help Net Security.
Industry News