All news with #vulnerability disclosure tag

🔐 A team of researchers from ETH Zurich and USI disclosed 27 successful attack scenarios against cloud-based password managers from Bitwarden, LastPass, Dashlane and 1Password, challenging vendors' zero-knowledge claims. The attacks exploit design and cryptographic flaws — including unauthenticated public keys, missing ciphertext integrity and KDF downgrades — enabling vault compromise, password recovery and mass takeover. Vendors report remediation is underway; users should verify fixes and follow advisories.

⚠️ Developers patched a nearly 30-year-old heap buffer overflow in the libpng image library—fixed in libpng 1.6.55—that can crash applications processing crafted PNG files and, with careful heap grooming, enable information disclosure or remote code execution. The flaw exists in the png_set_quantize function when called without a histogram and with oversized palettes. A proof-of-concept is public; users and distributors should upgrade promptly.

🔒 A critical vulnerability in the WPvivid Backup & Migration WordPress plugin (CVE-2026-1357, CVSS 9.8) allowed unauthenticated attackers to upload arbitrary files and achieve remote code execution. The flaw affected all versions up to 0.9.123 but, according to Defiant, only sites with the non-default receive backup from another site option enabled are critically exposed. WPVividPlugins released a patch in v0.9.124 on Jan 28; administrators should upgrade immediately.

⚠ Siemens has disclosed a stored cross-site scripting (XSS) vulnerability in Polarion V2404 and V2410 that permits authenticated remote attackers to inject JavaScript into document titles, which can execute in other users' sessions. The flaw is tracked as CVE-2025-40587 and has a CVSS v3.1 base score of 7.6 (High). Siemens advises updating to Polarion V2404.5 or later and V2410.2 or later to remediate the issue. Administrators should prioritize patching, reduce network exposure, and follow Siemens' industrial security guidance.

⚠️ A PS/IGES Parasolid translator component in Siemens Solid Edge contains an out-of-bounds read when parsing specially crafted IGS files, which can crash the application or permit arbitrary code execution in the context of the running process. Siemens has released a patch; administrators should update to V226.00 Update 03 or later. The issue is tracked as CVE-2025-40936 with a CVSSv3.1 base score of 7.8 (High). Apply the vendor update and follow industrial security best practices to limit exposure.

🔒 Siemens reports a heap-based buffer overflow in the WIBU CodeMeter Runtime used by Desigo CC and SENTRON Powermanager products. The flaw (CVE-2023-38545) occurs during the SOCKS5 proxy handshake when curl mishandles hostnames longer than 255 bytes and can enable code execution in the context of the affected process. Siemens provides instructions to update the CodeMeter Runtime component and advises upgrading affected systems to V8.0 QU2 or later; follow the vendor's patching guidance promptly.

🔍 Cybersecurity researchers at Koi Security disclosed the first known malicious Microsoft Outlook add-in, codenamed AgreeToSteal. The attacker claimed an abandoned add-in's domain and used the manifest URL (outlook-one.vercel[.]app) to serve a fake Microsoft sign-in page, harvesting more than 4,000 credentials and exfiltrating them via the Telegram Bot API. The affected add-in, AgreeTo, a calendar/availability tool last updated in December 2022, had requested ReadWriteItem permissions that could have allowed covert mailbox access. Koi recommends domain verification, re-review triggers, delisting stale add-ins, and visible install counts to reduce similar supply-chain abuse.

🔒 OpenClaw (formerly Clawdbot/Moltbot) surged in popularity in January 2026 but contains numerous critical vulnerabilities that place local secrets and system integrity at risk. Researchers found many publicly accessible instances running without authentication, allowing theft of API keys, chat histories, and remote code execution. The agent’s default trust of localhost, an unmoderated skills catalog, and prompt-injection weaknesses enable credential theft and malicious plugin execution. The article recommends isolating deployments, using burner accounts and allowlists, and restricting OpenClaw to dedicated experimental hosts.

⚠️ CISA added six Microsoft-related vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on February 10, 2026, citing evidence of active exploitation. The entries include CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, and CVE-2026-21533, affecting Windows, MSHTML, and Office components. Federal agencies must remediate KEV entries under BOD 22-01, and CISA urges all organizations to prioritize patching to reduce exposure.

⚠️ AVEVA reported that PI to CONNECT Agent (<=v2.4.2520) contains a vulnerability that can record sensitive proxy connection details in event logs. An attacker with local Event Log Reader (S-1-5-32-573) privileges could extract proxy URLs and credentials from those logs and gain unauthorized access to the proxy server. The issue is not remotely exploitable; the vendor’s fix is v2.5.2790 or later. Users should review and sanitize logs, rotate proxy credentials, avoid plain-text passwords in proxy URLs, and restrict Event Log Reader privileges.

⚠️ CISA reports two critical authentication vulnerabilities in ZLAN Information Technology Co. ZLAN5143D v1.600. CVE-2026-25084 allows authentication bypass via direct access to internal URLs, while CVE-2026-24789 exposes an unprotected API that enables remote password changes without credentials. Both are scored CVSS 3.1 9.8. CISA notes the vendor did not respond to coordination; users should minimize network exposure, restrict internet access to devices, contact the vendor, and keep systems updated.

⚠️BeyondTrust has issued an urgent advisory for a critical pre-authentication remote code execution vulnerability tracked as CVE-2026-1731 affecting Remote Support (≤25.3.1) and Privileged Remote Access (≤24.3.4). The flaw is an OS command injection discovered by Harsh Jaiswal and the Hacktron AI team and can be exploited by unauthenticated attackers without user interaction. BeyondTrust says cloud systems were secured by February 2, 2026 and advises on‑premises customers to upgrade to RS 25.3.2 or PRA 25.1.1 immediately.

🔎 Claude Opus 4.6 markedly improves automated vulnerability discovery, finding high-severity bugs faster and without task-specific tooling. Unlike traditional fuzzers, which depend on massive random inputs, Opus 4.6 reads and reasons about code like a human researcher—spotting patterns, past fixes, and precise inputs that trigger failures. Early tests show it uncovered long-standing zero-days in projects previously subject to extensive fuzzing.

🔒 Security researchers at Upwind disclosed six vulnerabilities in n8n, four rated critical (CVSS 9.4), that enable remote code execution, command injection, arbitrary file access and cross-site scripting. The flaws target how n8n sandboxes user processes and protect the host, making multi-user and shared deployments especially dangerous. Administrators and developers should update to the latest release, audit extensions, and treat web-exposed instances with heightened caution.

🔒 Substack has confirmed a security incident in which an unauthorized third party accessed limited user information, including email addresses, phone numbers and other internal metadata. CEO Chris Best said the company detected evidence of the issue on February 3 and notified some users on February 5, saying the data collection occurred in October 2025. Substack stated that no financial data or passwords were accessed, that the vulnerability has been fixed, and that a full investigation is underway.

⚠️Flickr says a vulnerability in a third‑party email service may have exposed member names, email addresses, IP addresses, general location data, Flickr usernames, account types and records of platform activity. The company says it shut off access to the affected system within hours on February 5, 2026, and that passwords and payment card data were not compromised. Flickr urged affected users to review account settings, remain vigilant for phishing, and change reused passwords while it investigates and strengthens monitoring of third‑party providers.

⚠ Four vulnerabilities were disclosed in the open source Ingress NGINX controller used in Kubernetes, with two rated CVSS 8.8. CVE-2026-1580 can enable authentication bypass when a misconfigured custom-errors backend ignores the X-Code header, and CVE-2026-24512 allows configuration injection via rules.http.paths.path, enabling code execution and secret disclosure. The other two issues pose lower or medium risks, including a potential DoS. Affected releases are 1.13.7 and below and 1.14.3 and below, and the only reliable mitigation is upgrading or migrating before Ingress NGINX reaches end of support.

🔐 Substack disclosed that a third party exploited an unspecified weakness in its systems in October, exposing user email addresses, phone numbers and other internal metadata. The company identified the issue on February 3, said it has fixed the vulnerability, and is conducting a full investigation. Substack maintains the breach did not include passwords, credit card numbers, or financial data, but has not disclosed the full scope or publicly posted a detailed incident report.

🔒 Multiple critical vulnerabilities in the open-source workflow platform n8n (tracked as CVE-2026-25049) allow any authenticated user who can create or edit workflows to escape sandboxing and execute arbitrary code on the host server. Independent researchers at Pillar Security, Endor Labs and SecureLayer7 identified sanitization and AST-sandboxing bypasses — including a type-confusion issue and Function-constructor exploits — enabling access to Node.js globals, the filesystem, credentials and connected cloud accounts. n8n released fixes (notably 2.4.0, later 2.5.2 and 1.123.17) and recommends immediate patching, rotating the N8N_ENCRYPTION_KEY and stored credentials, and limiting workflow creation until environments are hardened.

⚠️ Noma Labs disclosed a critical vulnerability, dubbed DockerDash, in Docker's Ask Gordon AI assistant that allows unverified image metadata to be treated as executable instructions. The flaw exploits a trust failure in the Model Context Protocol (MCP) gateway: Ask Gordon reads Docker LABEL metadata, forwards the interpreted content to MCP, and MCP tools execute it without validation. Depending on deployment this can enable remote code execution (cloud/CLI) or large-scale data exfiltration and reconnaissance in Docker Desktop. Docker issued mitigations in Docker Desktop 4.50.0 and users are urged to upgrade.