Critical Zimbra Classic Web Client XSS Flaw Enables Code Execution via Crafted Emails
Zimbra has disclosed a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client that could allow attackers to execute arbitrary…
Tag: CVE-2026-55200
Progress Urges ShareFile Customers to Shut Down Storage Zone Controllers Amid Credible Security Threat
Progress Software has instructed ShareFile customers to immediately shut down Windows servers running Storage Zone Controllers in response to a credible external…
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm…
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Execute Code at Boot
Researchers at firmware security firm Binarly have discovered six new vulnerabilities in U-Boot, the widely used bootloader for devices ranging from home…
WhatsApp-to-Host Attack Chain Exploits Three OpenClaw Flaws for Code Execution
Security researcher Chinmohan Nayak has detailed a WhatsApp-to-host attack chain leveraging three now-patched vulnerabilities in the OpenClaw personal AI assistant. The flaws,…
Laser Attack Resets Tangem Wallet Passwords on Cards That Can’t Be Patched
Researchers at Ledger's Donjon security team have demonstrated a laser fault injection attack that can reset the password on Tangem crypto wallet…
New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic
The China-linked cybercrime group Silver Fox has been attributed to a new Rust-based remote access trojan (RAT) called MODBEACON. Chinese cybersecurity company…
Lumen Technologies Rebuilds Exposure Management at Scale: From 17,000 to 1.1 Million Assets
Lumen Technologies, a telecommunications company with nearly a century of history, used the Axonius asset intelligence platform to reconcile data from over…
Unpatched XRING Flaw in Alibaba’s XQUIC Lets Remote Clients Crash HTTP/3 Servers
A critical unpatched vulnerability, dubbed XRING, has been disclosed in XQUIC, Alibaba's open-source QUIC and HTTP/3 library. Discovered by FoxIO researcher Sébastien…
Fake Microsoft Entra Passkey Enrollment Used in Voice Phishing Attacks Targeting M365 Users
A sophisticated threat actor tracked as O-UNC-066 by Okta is targeting organizations across multiple sectors with a voice-based phishing (vishing) scheme that…