"Microsoft issued fixes for 59 flaws, including six actively exploited zero-days in various Windows components that could be abused to bypass security features, escalate privileges, and trigger a denial-of-service (DoS) condition. Elsewhere, Adobe released updates for Audition, After Effects, InDesign Desktop, Substance 3D, Bridge, Lightroom Classic, and DNG SDK. The company said it's not aware of in-the-wild exploitation of any of the shortcomings."
"SAP shipped fixes for two critical-severity vulnerabilities, including a code injection bug in SAP CRM and SAP S/4HANA (CVE-2026-0488, CVSS score: 9.9) that an authenticated attacker could use to run an arbitrary SQL statement and lead to a full database compromise. The second critical vulnerability is a case of a missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (CVE-2026-0509, CVSS score: 9.6) that could permit an authenticated, low-privileged user to perform certain background Remote Function Calls without the required S_RFC authorization."
"Rounding off the list, Intel and Google said they teamed up to examine the security of Intel Trust Domain Extensions ( TDX) 1.5, uncovering five vulnerabilities in the module ( CVE-2025-32007, CVE-2025-27940, CVE-2025-30513, CVE-2025-27572, and CVE-2025-32467), and nearly three dozen weaknesses, bugs, and improvement suggestions. "Intel TDX 1.5 introduces new features and functionality that bring confidential computing significantly closer to feature parity with traditional virtualization solutions," Google said. "At the same time, these feature"
Multiple vendors released security patches addressing critical and actively exploited vulnerabilities. Microsoft fixed 59 flaws including six actively exploited Windows zero-days that can bypass protections, escalate privileges, and cause denial-of-service. Adobe issued updates for Audition, After Effects, InDesign Desktop, Substance 3D, Bridge, Lightroom Classic, and DNG SDK with no reported in-the-wild exploitation. SAP patched two critical flaws: a code injection in SAP CRM and S/4HANA (CVE-2026-0488, CVSS 9.9) enabling arbitrary SQL and full database compromise, and a missing authorization check in NetWeaver ABAP (CVE-2026-0509, CVSS 9.6) allowing unauthorized background RFCs. Patching may require kernel updates, profile parameter changes, and role/UCON adjustments. Intel TDX 1.5 review found five vulnerabilities plus numerous other issues.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]