Zimbra SNMP Flaw CVE-2026-73570 Actively Exploited for Unauthenticated RCE
A now-patched command injection vulnerability in Zimbra Collaboration (ZCS), tracked as CVE-2026-73570 (CVSS 8.9), is under active exploitation in the wild, according…
Tag: server security
Critical Gitea RCE Vulnerability CVE-2026-60004 Allows Repository Writers to Execute Shell Commands via Git Hooks
A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-60004 with a CVSS score of 9.8, has been patched in Gitea, the…
24,650 Internet-Exposed BMCs Leak IPMI Password Hashes Before Login
Cybersecurity researchers have discovered over 36,000 Baseboard Management Controller (BMC) interfaces exposing the Intelligent Platform Management Interface (IPMI) protocol to the public…
Critical NGINX Heap Buffer Overflow CVE-2026-42533 Allows DoS and Potential RCE
F5 has patched a critical heap buffer overflow vulnerability in NGINX, tracked as CVE-2026-42533, which can crash worker processes and may allow…
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Execute Code at Boot
Researchers at firmware security firm Binarly have discovered six new vulnerabilities in U-Boot, the widely used bootloader for devices ranging from home…
Unpatched XRING Flaw in Alibaba’s XQUIC Lets Remote Clients Crash HTTP/3 Servers
A critical unpatched vulnerability, dubbed XRING, has been disclosed in XQUIC, Alibaba's open-source QUIC and HTTP/3 library. Discovered by FoxIO researcher Sébastien…
New Bad Epoll Linux Kernel Flaw (CVE-2026-46242) Enables Root Privilege Escalation on Android and Linux Systems
A newly disclosed Linux kernel vulnerability, dubbed "Bad Epoll" and tracked as CVE-2026-46242, allows unprivileged local users to gain full root access…
29-Year-Old Squid Proxy Bug ‘Squidbleed’ Leaks Cleartext HTTP Requests
A critical heap over-read vulnerability in the Squid web proxy, dubbed 'Squidbleed' (CVE-2026-47729), can leak cleartext HTTP requests—including credentials and session tokens—to…