Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
A notice published on September 25, 2026 says a weblog administrator can use an include directive in a Velocity template to read classpath files, including configurations containing secrets.
Cyber ·
A notice published on September 25, 2026 reports unauthenticated deserialization in Apache Roller 6.1.5's XML-RPC endpoint and rates the flaw critical, with a CVSS 3.1 score of 9.8.
Cyber ·
A notice published on September 25, 2026 describes an anonymous configuration action that can persistently change the homepage weblog selection in Apache Roller 6.1.5.
Cyber ·
A bulletin published on September 25, 2026 reports reflected XSS in Apache Roller 6.1.5, involving a manipulated directory parameter.
Cyber ·
An advisory published on September 25, 2026 describes stored XSS in Apache Roller 6.1.5, rated important with a CVSS 3.1 score of 5.4 (medium).
Cyber ·
An alert published on September 25, 2026, reports that Apache Roller 6.1.5 accepts requests without the required salt token, enabling actions on behalf of logged-in users.
Cyber ·
A September 25, 2026 security notice says a captured valid WSSE digest header can be replayed to gain the victim’s AtomPub authority in Apache Roller 6.1.5.
Cyber ·
On September 25, 2026, Kiteworks said it had received intelligence from federal authorities about a possible attack targeting some systems used by customers and advised them to stop using the platform.
Cyber ·
A September 25, 2026 news item says Labcorp will overhaul data security practices and pay a $2.3 million fine. The measures cover supplier incident response, data sharing limits, and risk management.
Cyber ·
NotCVE-2026-0015 reports that an unauthenticated critical function in the input-leapd daemon may let a low-privilege local Windows user run commands as NT AUTHORITY\SYSTEM.
Cyber ·
A September 25, 2026 post points to an oss-sec discussion about an XSS vulnerability in ansi2html 1.9.4 and mentions a related Hacker News discussion.
Cyber ·
The Sovereign Tech Agency will invest nearly €1.3 million in KDE through 2027. At Akademy 2026 in Graz, contributors described how they secured the funding and what they hope it will support.
Cyber ·
In a news report published on September 25, 2026, Bitget’s CEO attributed a US$387 million theft to North Korea and said a protection fund holding more than US$464 million would cover the losses.
Cyber ·
On September 25, 2026, Greg Kroah-Hartman announced two stable Linux kernel releases, with fixes in different parts of the code and a recommendation to update.
Cyber ·
Published on September 25, 2026, this summary covers discussions at the Git Contributors' Summit on Git 3.0, security, documentation, pluggable object databases, and LLM use.
Cyber ·
On September 25, 2026, the force said a cyberattack disrupted some non-emergency systems and may have compromised staff information.
Cyber ·
On September 25, 2026, the LWN feed listed security updates from several Linux distributions, covering kernels, libraries, browsers, and tools. The note does not detail vulnerabilities or fixed versions.
Cyber ·
On September 25, 2026, CISA reported adding flaws in Microsoft SharePoint and MikroTik RouterOS to the KEV catalog, citing evidence of active exploitation.
Cyber ·
On September 25, 2026, CISA added CVE-2026-87902 to the KEV catalog, citing evidence of active exploitation. The agency encourages organizations to prioritize known vulnerabilities by risk.
Cyber ·
A report published on September 25, 2026, describes questions about a claim that an AI agent broke into an Australian health portal.
Looking for something else?DocumentationContact
