Three vulnerabilities in Salesforce Agentforce allowed hackers to hijack trusted agents, steal data, and launch phishing attacks.
The post ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration appeared first on SecurityWeek.
Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.
The post Roundcube Webmail Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.
The vulnerabilities, tracked as CVE-2026-28324 and CVE-2026-28325, can be exploited without authentication.
The post SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted appeared first on SecurityWeek.
Tracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code.
The post Critical WordPress Vulnerability Exploited Immediately After Disclosure appeared first on SecurityWeek.
The nine critical security defects could be exploited for arbitrary code execution and privilege escalation.
The post Adobe Patches Critical Flaws in Connect, AEM Forms appeared first on SecurityWeek.
The browser update resolves several critical-severity memory safety and memory corruption flaws.
The post Chrome 154 Patches 108 Vulnerabilities appeared first on SecurityWeek.
Remote attackers could trigger the critical-severity flaw to access privileged internal functionality.
The post Arista Urges Immediate Patching of Exploited VCO Zero-Day appeared first on SecurityWeek.
Unauthenticated attackers could send malicious traffic to BIG-IP to achieve remote code execution.
The post Critical F5 BIG-IP Vulnerability Exploited as Zero-Day appeared first on SecurityWeek.
The critical-severity flaw could allow unauthenticated attackers to upload and execute arbitrary scripts.
The post Check Point Patches Exploited Management Server Zero-Day appeared first on SecurityWeek.
Abdelhamid Naceri, a former Microsoft Germany employee, is the exploit leaker Nightmare Eclipse, aka Chaotic Eclipse.
The post Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity appeared first on SecurityWeek.
