Vulnerabilities are weaknesses or flaws in systems, software, hardware, configurations, or processes that adversaries can exploit to compromise confidentiality, integrity, or availability. The concept underpins vulnerability management, regulatory compliance, risk assessment, and security investment decisions across enterprise IT, cloud, and operational technology environments.
623 articles about Vulnerabilities
Decision Insights Threat Desk • May 8, 2026
A local privilege escalation flaw in Linux kernel versions 4.17+ can let an unprivileged user gain root access. The issue, CVE-2026-31431 (“Copy Fail”), involves algif_aead/AF_ALG page-cache writes and targets in-memory setuid binaries.
Decision Insights Coverage • May 8, 2026
DirtyFrag is a Linux local privilege escalation using CVE-2026-43284 and CVE-2026-43500, with module-blocking mitigation recommended.
Decision Insights Signals • May 7, 2026
Snyk integrated Anthropic’s Claude into its AI Security Platform to automate vulnerability discovery, prioritization, and fixes.
Decision Insights Signals • May 5, 2026
Synack made Sara AI Pentesting generally available, pairing agentic AI with human validation for continuous security testing.
Decision Insights Threat Desk • April 22, 2026
Ollama’s model quantization engine has an unauthenticated remote information disclosure flaw in CVE-2026-5757 that can let an attacker with model upload access read and exfiltrate server heap memory.
Decision Insights Signals • April 22, 2026
Aqua Security introduced Aqua Compass, an MCP server in runtime security workflows, and new runtime risk dashboards that recalculate monetary exposure as controls enforce.
Decision Insights Threat Desk • April 21, 2026
Terrarium vulnerability CVE-2026-5752 enables arbitrary code execution with root privileges via JavaScript prototype chain traversal.
Decision Insights Threat Desk • April 21, 2026
Radware Alteon 34.5.4.0 vADC has a reflected XSS flaw in ReturnTo on /protected/login, enabling JavaScript execution in victims’ browsers.
Decision Insights Signals • April 21, 2026
SEALSQ said Anthropic’s Claude Mythos Preview raised cybersecurity risks and that it wants PQC embedded in semiconductor hardware.
Decision Insights Signals • April 15, 2026
Endor Labs launched an agentic code security benchmark extending Carnegie Mellon’s SusVibes, plus a public leaderboard (Agent Security League). The benchmark tests AI coding agents on 200 real-world tasks across 108 open-source projects and 77 CWE classes, including anti-cheating safeguards. Results compare functional correctness and security outcomes across agent/model pairs.
Decision Insights Coverage • April 13, 2026
The discovery clock just accelerated On April 7, Anthropic announced that its newest model, Claude Mythos Preview, had autonomously discovered thousands of high and critical severity zero-day vulnerabilities across every major operating system and web browser—many hiding in plain sight for over a decade. A 27-year-old bug in OpenBSD. A 16-year-old flaw in FFmpeg that The post When AI Finds Every Bug appeared first on NSS Labs.
Decision Insights Signals • April 13, 2026
Anthropic’s Project Glasswing brings major technology firms to use Mythos Preview for defensive scanning and zero-day fixes.