Vulnerability

Vulnerability

Citrix Patches 10 Critical NetScaler Vulnerabilities

Citrix has released security updates fixing 10 critical vulnerabilities across its NetScaler products. Nine of them affect NetScaler ADC and NetScaler Gateway. The tenth is a separate flaw in NetScaler Console that could let unauthenticated attackers bypass access controls. Citrix also fixed many high- and medium-severity bugs, and urges

Vulnerability

Critical Red Hat Quay Flaw Lets Attackers Take Over Registry Token Signing

Red Hat has disclosed a critical vulnerability in Red Hat Quay, its enterprise container registry for storing, managing, and distributing container images. The flaw is tracked as CVE-2026-123710 and has a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:

Vulnerability

Node.js Fixes 16 Vulnerabilities, Including HTTP/2 Crash and HTTPS Memory Leak That Can Expose TLS Private Keys

The Node.js project has released security updates that fix 16 vulnerabilities in the runtime, seven of them rated high. The most serious flaws are in Node.js’s built-in HTTP/2, HTTPS, and TLS server code. They let unauthenticated clients crash servers, corrupt memory, or read memory from

Vulnerability

Critical Apache HTTP Server Flaw in mod_http2 Enables Unauthenticated Remote Code Execution

A critical vulnerability in Apache HTTP Server’s HTTP/2 module, mod_http2, could let a remote attacker run code on vulnerable servers. The flaw is tracked as CVE-2026-119618 and rated 9.8 on the CVSS scale. It affects Apache HTTP Server versions 2.4.55 through 2.

Vulnerability

Zoom Patches Critical Privilege Escalation Flaws in Zoom Workplace for Windows

Zoom has released security updates for two vulnerabilities in Zoom Workplace for Windows. One of them is rated critical. Both let an unauthenticated attacker escalate privileges over the network, with no special permissions or prior access needed. The vulnerabilities * CVE-2026-108186 (CVSS 9.6, Critical): An improper input validation

Vulnerability

Critical Fortinet2Shell Vulnerability

Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published

Vulnerability

Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products - Updates Available

Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively. Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If