The critical, unauthenticated bugs allow attackers to bypass authentication and proxy a user’s browser traffic.

The post Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension appeared first on SecurityWeek.

Six critical vulnerabilities in Neurons for ITSM could enable remote code execution, while Sentry and EPMM received patches for authentication bypass flaws.

The post Ivanti Patches Critical Flaws Across Enterprise Security Products appeared first on SecurityWeek.

Dubbed MikroTrick, the bugs allow attackers to bypass authentication, overwrite configuration files, and take over devices.

The post MikroTik Patches Critical Flaws Chained to Hack Routers appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Microsoft rolled out patches for cloud services, hackers compromised 5,000 Dropbox accounts, and Guardio is now valued at $1.1 billion.

The post In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation appeared first on SecurityWeek.

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.

The post HPE Patches Critical RCE Vulnerabilities in AOS-CX appeared first on SecurityWeek.

Publicly disclosed S/MIME flaws could expose encrypted email content, while critical IOS XR and Nexus bugs could enable remote code execution and authentication bypass.

The post Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities appeared first on SecurityWeek.

Using a technically valid TLS certificate for Softaculous’ domains, a threat actor diverted traffic to fake software updates.

The post Malicious Virtualizor Update Served via BGP Hijacking appeared first on SecurityWeek.