Google Temporarily Pauses Some Reports in OSS VRP
As of October 1, 2026, Google is no longer accepting new product vulnerability reports through OSS VRP. The reason is an influx of invalid automated reports.
Tag vulnerabilities
VulnCheck Reports Attempts to Exploit CVE-2026-61500 in Rejetto HFS
Security firm VulnCheck has recorded attempts to exploit a flaw in Rejetto HFS 3.x that could allow an attacker to forge an administrator session and execute code on the server.
Updated: Citrix Adds Temporary Mitigation for Actively Exploited NetScaler Vulnerability
Citrix has also published a temporary mitigation for the actively exploited CVE-2026-88779 vulnerability. Fixed versions for affected NetScaler ADC and Gateway deployments remain available.
GitLab Fixes Critical Vulnerability in Self-Hosted AI Gateway
GitLab has released fixes for the critical CVE-2026-90970 vulnerability in its AI Gateway service. It affects self-hosted deployments and could allow command execution after authentication.
CISA Lists Zammad Vulnerability as Actively Exploited; Chaining Could Lead to Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the Zammad vulnerability CVE-2026-102489 to its catalog of actively exploited vulnerabilities. Combined with a second flaw, it could allow an attacker to gain root privileges.
Fortinet and CISA Warn of Actively Exploited FortiMail Flaw
Critical vulnerability CVE-2026-104286 in FortiMail allows unauthenticated file writing. Fortinet confirmed its exploitation, and CISA added it to the KEV catalog.
Microsoft warns of active exploitation of a Zimbra Collaboration Suite flaw
The unauthenticated CVE-2026-73570 flaw in Zimbra’s SNMP notifications allows command execution on vulnerable mail servers. A fix has been available since July.
Google Introduces Gemini 4 Argon, Initially Available Only to Selected Cybersecurity Defenders
Google has introduced Gemini 4 Argon, with access limited to trusted cybersecurity defenders through the Fairwind program. The company is delaying broader release because of the risk of misuse of its advanced security capabilities.
Cisco Fixes Critical Flaw in Catalyst SD-WAN Manager as Attacks Are Underway
Cisco has released fixes for CVE-2026-76504 in Catalyst SD-WAN Manager. The critical flaw allows remote, unauthenticated attackers to gain administrator privileges, and the vendor has confirmed active exploitation.
TeamViewer Fixes Five Severe Vulnerabilities in Clients and Host
TeamViewer released updates for five vulnerabilities with a maximum CVSS score of 8.8. Full Client and Host versions before 15.82 for Windows, Linux and macOS are affected.