92 results
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
ESET said on November 10 that it found a previously undocumented modular .
Apple released iOS and iPadOS 27.
Google updated the Chrome Stable channel on Nov 9, 2026 to 157.
Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .
Ethersphere maintainers said on GitHub that Swarm Desktop 0.
A researcher known as forcequit published worse_query, an iOS sandbox-escape proof of concept, on GitHub on November 8; it lets an app read other apps' data containers on iOS 26 and 27 .
Mirae Asset Securities announced that its internal groupware system, mi-global, suffered an external attack on November 5, leaking personal data of approximately 35,255 employees, including former and outsourced personnel .
Semiconductor packaging firm Xintec (3374) said in a Nov 6 MOPS filing that an unknown IP address intruded into its internal information systems .
On November 5, 2026, OpenSSH released version 10.
According to Security NEXT, the Tokyo Metropolitan Bureau of Waterworks discovered on October 2, 2026, that only empty storage boxes remained inside a locked cabinet while four hard drives were missing .
According to Security NEXT, Denny's Japan discovered on October 30, 2026 that application-related systems had been breached by a third party, potentially exposing personal data of legacy app customers .
According to Security NEXT, the operator of Sukesan Udon stated that a server misconfiguration at contractor Caho Enterprise may have allowed external parties to view personal data of current and former employees .
According to Security NEXT, during an inventory check on September 9, 2026, Nara Prefecture discovered that a USB flash drive used for data exchange with its pharmaceutical and medical device application review system was missing .
On November 4, 2026, TWCERT/CC disclosed three high-severity vulnerabilities in Abouttime Tech's Herowatch series, including an insecure direct object reference flaw in Herowatch Go Server (CVE-2026-121817), firmware signed with publicly known test keys in Herowatch Mini (CVE-2026-121818), and missing authentication in the Herowatch Mini ADB service (CVE-2026-121816) .
According to Security NEXT, a use-after-free vulnerability (CVE-2026-98432) exists in IPv4 TCP connection handling in the Linux kernel .
Following Google's disclosure of the XCPE botnet, cybersecurity vendor TrendAI published observations from June 3 to October 1 showing approximately 1.
ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid .
Fortinet FortiGuard Labs published research on Nov 2 saying it has tracked, over several months, a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan it calls PapRAT for persistent access, attributing it to BITTER with high confidence .