Vulnerability Management

More than a million WordPress sites may be at risk from a WPML multilingual CMS plugin.

SolarWinds has patched a hardcoded credential vulnerability in its Web Help Desk product.

Three years after initial discovery, the Log4j vulnerability is still being exploited in the wild.

Cyberattackers are leveraging a zero-day Cisco switch bug to take control of systems.

WordPress websites could be hijacked in intrusions exploiting a PHP object injection flaw in GiveWP plugin.

Microsoft Outlook, Teams, Word, Excel, PowerPoint, and OneNote for macOS were impacted by eight security flaws, which could be utilized to evade available app permissions in the operating system even without further user verification.

Attacks exploiting a Windows Ancillary Function Driver for WinSock zero-day vulnerability, tracked as CVE-2024-38193, have been deployed by North Korean hacking collective Lazarus Group

CISA is warning that ongoing intrusions targeting SolarWinds Web Help Desk instances vulnerable to the critical Java deserialization flaw, tracked as CVE-2024-28986, could be leveraged to facilitate remote code execution.