Aggregator

A vulnerability was found in ImageMagick up to 6.9.13-47/7.1.2-22 and classified as critical. This affects an unknown function of the component Magick -distribute-cache Service. The manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2026-46692. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability was found in ImageMagick up to 6.9.13-47/7.1.2-22. It has been rated as problematic. This affects an unknown function of the component MIFF Encoder. This manipulation causes incorrect calculation of buffer size. The identification of this vulnerability is CVE-2026-46521. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

A new Linux kernel local privilege escalation vulnerability, dubbed “DirtyClone” (CVE-2026-43503), that allows unprivileged local users to gain full root access by manipulating cloned network packets through the XFRM/IPsec subsystem, all without leaving a trace in kernel logs or audit records. DirtyClone is a high-severity variant in the DirtyFrag vulnerability family, a class of Linux […]

The post New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets appeared first on Cyber Security News.

Chinese-speaking APT CL-STA-1062 targeted Southeast Asian government and energy networks open-source tools, and a new TinyRCT backdoor. Palo Alto Networks Unit 42 researchers published a detailed report on a Chinese-speaking threat actor, tracked as CL-STA-1062, that has been running persistent operations across East Asia since at least March 2022 and shifted focus to Southeast Asian […]

Миллиарды лет свидетельство инопланетной органики пролежало в иле…

A vulnerability classified as critical was found in ImageMagick up to 6.9.13-47/7.1.2-22. Affected by this issue is some unknown functionality of the component Digital Image Parser. The manipulation results in heap-based buffer overflow. This vulnerability is reported as CVE-2026-46520. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in ImageMagick up to 6.9.13-46/7.1.2-21. It has been classified as problematic. This vulnerability affects unknown code of the component PSD Decoder. Performing a manipulation results in resource consumption. This vulnerability was named CVE-2026-45031. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability identified as critical has been detected in ImageMagick up to 6.9.13-47/7.1.2-21. The impacted element is an unknown function of the component Digital Image Parser. This manipulation causes out-of-bounds read. This vulnerability is tracked as CVE-2026-45359. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability labeled as problematic has been found in ImageMagick up to 6.9.13-46/7.1.2-21. This affects an unknown function of the component Digital Image Parser. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-45664. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability described as critical has been identified in ImageMagick up to 6.9.13-46/7.1.2-21. Affected is an unknown function of the component Digital Image Parser. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-45624. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in ImageMagick up to 6.9.13-46/7.1.2-21. It has been rated as problematic. Impacted is an unknown function of the component IPTC Output File Handler. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-42326. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A high-severity vulnerability in the Amazon Q Developer Extension for Visual Studio Code (VS Code), Amazon’s AI-powered coding assistant. Tracked as CVE-2026-12957 and CVE-2026-12958 and disclosed by Wiz Research, the flaws allowed attackers to achieve arbitrary code execution and cloud credential theft simply by having a developer open a malicious repository. The root cause was […]

The post Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments appeared first on Cyber Security News.

The Open Source Sustainability Initiative's goal is to help enterprises manage and secure aging open source projects while maintaining regulatory compliance.

Мещанский суд отправил в СИЗО троих фигурантов Qiwi-схемы.

A threat actor using the alias NormalLeVrai has posted a “comeback” teaser headlined as a leak of GOV.CO, the official digital platform of the Colombian government, claiming 4,300,002 records.

英国伦敦大学玛丽皇后学院的研究人员分析了 1960-2023 年间发行的逾 38 万首歌曲的歌词后发现，流行音乐中使用的情感语言和道德语言发生了显著变化。表达关怀和体面等道德美德的词语随时间推移变得越来越少见，而与伤害、欺骗、颠覆和堕落相关的语言逐渐增多。研究人员指出，“音乐不仅仅是娱乐。它是社会讲述自身故事的方式之一。通过分析几十年来的歌词，我们可以开始看到情感表达和道德叙事随时间如何演变。”研究还发现，女性艺术家更多与关爱和忠诚等美德联系在一起，而男性艺术家和男女混合组合则更多与反映伤害、颠覆和堕落等负面主题联系在一起。

A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks aimed at government entities and critical infrastructure in Southeast Asia. The activity, particularly aimed at state-owned enterprises in the energy and government sectors, has been attributed to a threat actor called CL-STA-1062, which Palo Alto Networks

Currently trending CVE - Hype Score: 2 - A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.

A newly disclosed Linux kernel vulnerability combining a Copy-on-Write (COW) page-cache corruption flaw with the net/sched subsystem’s act_pedit component is enabling unprivileged local attackers to escalate privileges to full root access on several major Linux distributions. The exploit, dubbed packet_edit_meme, has been verified in June 2026 against actively maintained enterprise and consumer kernels. The root […]

The post New Linux pedit COW Exploit Allows Attackers to Gain System Root Access appeared first on Cyber Security News.