An unauthenticated command injection flaw in PAN-OS GlobalProtect (CVE-2024-3400, CVSS 10.0) gives attackers root on the firewall and is being exploited.
Attackers are abusing CVE-2024-20720 in Adobe Commerce and Magento to plant a persistent backdoor and a Stripe payment skimmer.
Google fixed an actively exploited integer overflow in Chrome's Skia graphics library, its seventh Chrome zero-day of 2023. Update to 119.0.6045.199.
Three ownCloud flaws, two of them now actively exploited, can leak admin credentials and allow file access without authentication.
Veeam fixed four Veeam ONE flaws, including two it rates critical, that could allow remote code execution on the SQL server and theft of NTLM hashes.
Attackers exploited a Cisco IOS XE web UI zero-day (CVE-2023-20198) to create admin accounts and install an implant on thousands of devices.
Four J-Web flaws in Junos OS on SRX and EX Series can be chained for unauthenticated remote code execution. Patch, or disable J-Web.
