CVE

Microsoft patches two actively exploited zero-days (CVE-2024-29988, CVE-2024-26234)

April 9, 2024

On this April 2024 Patch Tuesday, Microsoft has fixed a record 147 CVE-numbered vulnerabilities, including CVE-2024-29988, a vulnerability that Microsoft hasn’t marked …

NVD: NIST is working on longer-term solutions

April 3, 2024

The recent conspicuous faltering of the National Vulnerability Database (NVD) is “based on a variety of factors, including an increase in software and, therefore, …

Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)

March 29, 2024

UPDATE: April 9, 09:23 AM ET Two stories have been published since this initial release: Which Linux distros are affected and what can you do? XZ Utils backdoor: Detection …

CVE count set to rise by 25% in 2024

February 26, 2024

The report from Coalition indicates an anticipated 25% rise in the total count of published common vulnerabilities and exposures (CVEs) for 2024, reaching 34,888 …

VMware pushes admins to uninstall vulnerable, deprecated vSphere plugin (CVE-2024-22245, CVE-2024-22250)

February 21, 2024

VMware Enhanced Authentication Plug-in (EAP), a plugin for VMware vSphere, has two vulnerabilities (CVE-2024-22245, CVE-2024-22250) that could be exploited by attackers to …

CVE Prioritizer: Open-source tool to prioritize vulnerability patching

February 19, 2024

CVE Prioritizer is an open-source tool designed to assist in prioritizing the patching of vulnerabilities. It integrates data from CVSS, EPSS, and CISA’s KEV catalog to …

CVEMap: Open-source tool to query, browse and search CVEs

February 1, 2024

CVEMap is an open-source command-line interface (CLI) tool that allows you to explore Common Vulnerabilities and Exposures (CVEs). It’s designed to offer a streamlined …

45% of critical CVEs left unpatched in 2023

January 25, 2024

Global attack attempts more than doubled in 2023, increasing 104%, according to Armis. Blind spots and critical vulnerabilities are worsening, with 45% of critical CVEs …

Atlassian reveals critical Confluence RCE flaw, urges “immediate action” (CVE-2023-22527)

January 16, 2024

Atlassian has patched a critical vulnerability (CVE-2023-22527) in Confluence Data Center and Confluence Server that could lead to remote code execution. The good news is that …

Creating a formula for effective vulnerability prioritization

December 18, 2023

In this Help Net Security interview, Michael Gorelik, CTO and Head of Malware Research at Morphisec, provides insights into the business impact of vulnerabilities. Gorelik …

December 2023 Patch Tuesday: 33 fixes to wind the year down

December 12, 2023

Microsoft’s December 2023 Patch Tuesday is a light one: 33 patches, only four of which are deemed critical. “This month, Microsoft did not patch any zero-day …

The hidden costs of Java, and the impact of pricing changes

November 1, 2023

An overwhelming 98% of all the businesses surveyed use Java in their software applications or infrastructure, and 57% of those organizations indicate that Java is the backbone …

CVE