Aggregator

A vulnerability classified as critical was found in ImageMagick up to 6.9.13-47/7.1.2-22. Affected by this issue is some unknown functionality of the component Digital Image Parser. The manipulation results in heap-based buffer overflow. This vulnerability is reported as CVE-2026-46520. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in ImageMagick up to 6.9.13-46/7.1.2-21. It has been classified as problematic. This vulnerability affects unknown code of the component PSD Decoder. Performing a manipulation results in resource consumption. This vulnerability was named CVE-2026-45031. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability identified as critical has been detected in ImageMagick up to 6.9.13-47/7.1.2-21. The impacted element is an unknown function of the component Digital Image Parser. This manipulation causes out-of-bounds read. This vulnerability is tracked as CVE-2026-45359. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability labeled as problematic has been found in ImageMagick up to 6.9.13-46/7.1.2-21. This affects an unknown function of the component Digital Image Parser. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-45664. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability described as critical has been identified in ImageMagick up to 6.9.13-46/7.1.2-21. Affected is an unknown function of the component Digital Image Parser. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-45624. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in ImageMagick up to 6.9.13-46/7.1.2-21. It has been rated as problematic. Impacted is an unknown function of the component IPTC Output File Handler. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-42326. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A high-severity vulnerability in the Amazon Q Developer Extension for Visual Studio Code (VS Code), Amazon’s AI-powered coding assistant. Tracked as CVE-2026-12957 and CVE-2026-12958 and disclosed by Wiz Research, the flaws allowed attackers to achieve arbitrary code execution and cloud credential theft simply by having a developer open a malicious repository. The root cause was […]

The post Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments appeared first on Cyber Security News.

The Open Source Sustainability Initiative's goal is to help enterprises manage and secure aging open source projects while maintaining regulatory compliance.

Мещанский суд отправил в СИЗО троих фигурантов Qiwi-схемы.

A threat actor using the alias NormalLeVrai has posted a “comeback” teaser headlined as a leak of GOV.CO, the official digital platform of the Colombian government, claiming 4,300,002 records.

英国伦敦大学玛丽皇后学院的研究人员分析了 1960-2023 年间发行的逾 38 万首歌曲的歌词后发现，流行音乐中使用的情感语言和道德语言发生了显著变化。表达关怀和体面等道德美德的词语随时间推移变得越来越少见，而与伤害、欺骗、颠覆和堕落相关的语言逐渐增多。研究人员指出，“音乐不仅仅是娱乐。它是社会讲述自身故事的方式之一。通过分析几十年来的歌词，我们可以开始看到情感表达和道德叙事随时间如何演变。”研究还发现，女性艺术家更多与关爱和忠诚等美德联系在一起，而男性艺术家和男女混合组合则更多与反映伤害、颠覆和堕落等负面主题联系在一起。

A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks aimed at government entities and critical infrastructure in Southeast Asia. The activity, particularly aimed at state-owned enterprises in the energy and government sectors, has been attributed to a threat actor called CL-STA-1062, which Palo Alto Networks

Currently trending CVE - Hype Score: 2 - A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.

A newly disclosed Linux kernel vulnerability combining a Copy-on-Write (COW) page-cache corruption flaw with the net/sched subsystem’s act_pedit component is enabling unprivileged local attackers to escalate privileges to full root access on several major Linux distributions. The exploit, dubbed packet_edit_meme, has been verified in June 2026 against actively maintained enterprise and consumer kernels. The root […]

The post New Linux pedit COW Exploit Allows Attackers to Gain System Root Access appeared first on Cyber Security News.

Cloudflare 复盘了把 AI 用于企业级漏洞发现的工程系统：重点在于搭建可持久、可换模型、可去重和可分诊的 harness，而非押注单一模型。

A vulnerability described as problematic has been identified in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. Impacted is an unknown function of the component Power Management Service. Executing a manipulation can lead to missing authorization. This vulnerability is tracked as CVE-2022-39095. The attack is restricted to local execution. No exploit exists.

A vulnerability classified as problematic has been found in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. The affected element is an unknown function of the component Power Management Service. The manipulation leads to missing authorization. This vulnerability is listed as CVE-2022-39096. The attack must be carried out locally. There is no available exploit.

A vulnerability marked as problematic has been reported in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. This issue affects some unknown processing of the component Power Management Service. Performing a manipulation results in missing authorization. This vulnerability is identified as CVE-2022-39094. The attack is only possible with local access. There is not any exploit available.

Instead of eliminating jobs for early-career cyber pros, AI is creating new opportunities for candidates with strong human decision-making skills.