Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. [...]
Google ha pubblicato il bollettino di sicurezza Android di ottobre, contenente correzioni per 25 vulnerabilità, di cui 7 con gravità “critica” e 18 con gravità “alta”.
EPSS 0.00 a dalších 8 CVE-2026-49937 CVE-2026-55265 CVE-2026-55266 CVE-2026-55269 CVE-2026-55270 CVE-2026-55279 CVE-2026-55280 CVE-2026-55286 CVE-2026-58815 CVE-2026-58834 CVE-2026-58835 CVE-2026-58841 CVE-2026-58854 CVE-2026-58856 CVE-2026-58859 CVE-2026-58865 CVE-2026-58880 Google IT FR
Fáilte! Pwn2Own Ireland 2026 has arrived in Cork, and the world's top security researchers are ready. We've got more phone entries than we've ever had, and more than 60 entries total. Earlier today, we held the random draw to determine attempt order. Below is the official schedule. All times are Irish Standard Time (IST) and may change as the competition progresses. You can find our live leaderboard here. This will be updated throughout the day. Jump to: Day One Day Two Day Three DAY ONE…
Companies like Google and Microsoft are find much bigger numbers of vulnerabilities in their own products as a result of AI. But the same technology is leading to public reporting programs becoming overwhelmed by the mass submission of speculative, duplicated, or hallucinated findings. Now, Google’s announced it has temporarily stopped accepting submissions to its open source bug bounty program, OSS VRP. “Why is this happening? This pause is due to a significant rise in automated submissions,…
Google US
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 11 nuove vulnerabilità di sicurezza. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eludere i meccanismi di sicurezza, eseguire codice arbitrario e compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.00 CVE-2026-103621 CVE-2026-103622 CVE-2026-103623 CVE-2026-103624 CVE-2026-103625 CVE-2026-103626 CVE-2026-103628 CVE-2026-103629 CVE-2026-103630 CVE-2026-103631 Google IT
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. [...]
Google US
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Google FR
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 6.3, CVEs: CVE-2026-103628, CVE-2026-103626, CVE-2026-103621, CVE-2026-103630, CVE-2026-103625, CVE-2026-103624, CVE-2026-103629, CVE-2026-103622, CVE-2026-103623, CVE-2026-103631, CVE-2026-103627, Summary: The Stable channel has been updated to 154.0.8037.97/.98 for Windows and Mac and 154.0.8037.97 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is…
EPSS 0.00 CVSS 6.3 CVE-2026-103621 CVE-2026-103622 CVE-2026-103623 CVE-2026-103624 CVE-2026-103625 CVE-2026-103626 CVE-2026-103627 CVE-2026-103628 CVE-2026-103629 CVE-2026-103630 CVE-2026-103631 Google FI
Serial number: AV26-984 Date: October 1, 2026 As of September 29, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 154.0.8037.92/.93 (Windows/Mac), and 54.0.8037.92 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop
Google CA
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 32 nuove vulnerabilità di sicurezza, di cui 6 con gravità “critica” e 11 con gravità “alta”.
EPSS 0.00 CVE-2026-102299 CVE-2026-102301 CVE-2026-102302 CVE-2026-102304 CVE-2026-102306 CVE-2026-102308 CVE-2026-102309 CVE-2026-102312 CVE-2026-102316 CVE-2026-102317 CVE-2026-102321 CVE-2026-102323 CVE-2026-102324 CVE-2026-102326 CVE-2026-102328 CVE-2026-102329 CVE-2026-102331 Google IT
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Google FR
Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...]
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.3, CVEs: CVE-2026-81375, Summary: A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.
EPSS 0.00 CVSS 8.3 CVE-2026-81375 Google FI
Most of us click on search results without knowing much about the website we’re about to visit. And once we’re there, it’s not always obvious when something isn’t quite right. Now, we’ve added two new features to Malwarebytes Browser Guard that will do even more to keep you safe online. Search Reputation gives you a quick read on your search results, before you even click on anything. And with Scam Guard Lite, you can analyze the contents of a webpage directly from the Browser Guard extension…
Over the last few days, Google issued several different Chrome updates. On September 22, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and Mac. The update includes 108 security fixes including 11 rated Critical. It will roll out over the coming days and weeks. One day later, Google released Chrome 155 for Android, version 155.0.8059.16, to a…
EPSS 0.01 CVE-2026-95281 CVE-2026-95350 CVE-2026-95357 Google US
The Irish Data Protection Commission (DPC) has fined Google €403 million ($459 million) for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020. During that time, Google collected users’ location data without making clear that it could be used to infer their interests and shape the ads they saw. Google’s location history keeps track of users’ locations when using their devices. It’s an opt-in…
Google US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.1: 9.8, CVEs: CVE-2026-95274, CVE-2026-95275, CVE-2026-95276, CVE-2026-95277, CVE-2026-95278, CVE-2026-95279, CVE-2026-95280, CVE-2026-95281, CVE-2026-95282, CVE-2026-95283, CVE-2026-95284, CVE-2026-95285, CVE-2026-95286, CVE-2026-95287, CVE-2026-95288, CVE-2026-95289, CVE-2026-95290, CVE-2026-95291, CVE-2026-95292, CVE-2026-95293 (+88 other associated CVEs), Summary: Chrome 154 fixes 108 vulnerabilities,…
CVSS 9.8 Google FI
Serial number: AV26-955Date: September 23, 2026 As of September 22, 2026, Google published a security advisory to address vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 154.0.8037.57/.58 (Windows/Mac), and 54.0.8037.57 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Google Chrome Security Advisory
Google CA
A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes Config Connector. Varonis explains how this confused deputy problem can turn a single Kubernetes YAML file into a path to organization-wide privilege escalation. [...]
Google Kubernetes US
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 108 nuove vulnerabilità di sicurezza, di cui 11 con gravità “critica” e 25 con gravità “alta”.
Google IT
Phishing follows whatever people want at the moment, and right now that includes AI subscriptions they don’t have to pay for. We recently uncovered a new variation on this theme: A fake Claude Max giveaway that uses a convincing Google sign-in window to steal login information.Claude’s paid plans start at $20 a month and cost considerably more for higher usage limits, while free accounts have stricter limits. That makes the promise of a free upgrade an attractive lure.Microsoft reported in June…
CERT Polska uncovered a toll fraud operation targeting Polish users through deceptive Meta advertisements and malicious applications distributed via Google Play. We preserved 1235 ads, linked 852 to 17 applications through code or infrastructure, reconstructed the complete execution chain, and observed live premium SMS and carrier billing tasking.
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Google FR
Tomorrow's webinar examines real Google Workspace breaches involving social engineering and malicious OAuth applications, from initial access through the critical first hours of incident response. Learn which security controls and response decisions can make the greatest difference. [...]
Google US
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors. Shortly after that blog post was published, Volexity discovered additional campaigns—this time from a third Chinese threat actor, tracked by Volexity under the alias UTA0565—that used the same chained exploits on September…
KEV ✓ EPSS 0.04 CVE-2026-85046 CVE-2026-85880 CVE-2026-87491 Google Microsoft veřejná správa US
Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users' location data. [...]
Google US
Google says one of its Gemini models accessed systems belonging to three real companies during a cybersecurity evaluation in May. The model reportedly guessed credentials in one case, while finding exposed credentials in public repositories in two others. Google says Gemini stopped once it recognized that it had reached real infrastructure and that the affected organizations were notified. Gemini was participating in an evaluation run by Irregular, a third-party AI cybersecurity testing firm.…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.6, CVEs: CVE-2026-93374, CVE-2026-93372, CVE-2026-93375, CVE-2026-93382, CVE-2026-93387, CVE-2026-93373, CVE-2026-93381, CVE-2026-93379, CVE-2026-93377, CVE-2026-93380, CVE-2026-93384, CVE-2026-93383, CVE-2026-93376, CVE-2026-93378, CVE-2026-93385, CVE-2026-93386, Summary: Google released Chrome 153.0.8010.52/.53 for Windows/Mac and 153.0.8010.52 for Linux on 17 September. The update contains 16 security…
EPSS 0.00 CVSS 9.6 CVE-2026-93372 CVE-2026-93373 CVE-2026-93374 CVE-2026-93375 CVE-2026-93376 CVE-2026-93377 CVE-2026-93378 CVE-2026-93379 CVE-2026-93380 CVE-2026-93381 CVE-2026-93382 CVE-2026-93383 CVE-2026-93384 CVE-2026-93385 CVE-2026-93386 CVE-2026-93387 Google FI FR
Serial number: AV26-939Date: September 18, 2026 As of September 17, 2026, Google is affected by vulnerabilities in the following product: Chrome Prior to 153.0.8010.53 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop
Google CA
Researchers at Zimperium’s zLabs have analyzed an Android Trojan that uses an automated, multi-stage infection process. What’s new is that RatHat gives a live AI assistant the keys to the accessibility tree of the infected device and uses it to determine where to tap or scroll, rather than following a hardcoded script. The variable attack path makes it harder for signature- and rule-based mobile security tools to detect this Trojan. It also abuses Android Debug Bridge (ADB), a legitimate tool…
Fast-growing companies face countless recommendations for securing Google Workspace, but not every control provides the same value. This webinar examines real-world breaches to explore which security controls matter most, which may be overrated, and where lean security teams should focus their resources. [...]
Google US
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 16 nuove vulnerabilità di sicurezza, di cui 2 con gravità “critica” e 7 con gravità “alta”.
EPSS 0.00 CVE-2026-93372 CVE-2026-93373 CVE-2026-93374 CVE-2026-93375 CVE-2026-93377 CVE-2026-93379 CVE-2026-93381 CVE-2026-93382 CVE-2026-93387 Google IT
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases](https://chromereleases.googleblog.com/2026)) for more information.
EPSS 0.00 CVSS 8.8 CVE-2026-91745 Google Microsoft US
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases](https://chromereleases.googleblog.com/2026)) for more information.
EPSS 0.00 CVSS 9.6 CVE-2026-91728 Google Microsoft US
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: None, CVEs: CVE-2026-56914, CVE-2026-58773, CVE-2026-55318, CVE-2026-55343, CVE-2026-56920, CVE-2026-56967, CVE-2026-58683, CVE-2026-58710, CVE-2026-0179, CVE-2026-0187, CVE-2026-0192, CVE-2026-0194, CVE-2026-0199, CVE-2026-0200, CVE-2026-55302, CVE-2026-55317, CVE-2026-55323, CVE-2026-55329, CVE-2026-55337, CVE-2026-55357 (+90 other associated CVEs), Summary: The Pixel Update Bulletin contains details of…
Google FI
Serial number: AV26-926 Date: September 16, 2026 As of September 15, 2026, Google is affected by vulnerabilities in the following product: Chrome Prior to 153.0.8010.48 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop
Google CA
The first hours after discovering a Google Workspace breach can determine how an incident unfolds. This webinar examines real-world breaches to show which early response decisions can limit the impact and which can make matters worse. [...]
Google US
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-58704 Google Pixel Improper Authorization Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian…
KEV ✓ EPSS 0.01 CVE-2026-58704 Google veřejná správa US
Aggiornamenti di sicurezza Google di settembre risolvono molteplici vulnerabilità, di cui 46 con gravità “critica” e 63 con gravità “alta”, nei dispositivi Pixel.
Google IT
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 42 nuove vulnerabilità di sicurezza, di cui 3 con gravità “critica” e 28 con gravità “alta”.
EPSS 0.00 a dalších 6 CVE-2026-91718 CVE-2026-91721 CVE-2026-91724 CVE-2026-91727 CVE-2026-91728 CVE-2026-91729 CVE-2026-91731 CVE-2026-91733 CVE-2026-91734 CVE-2026-91735 CVE-2026-91736 CVE-2026-91737 CVE-2026-91741 CVE-2026-91743 CVE-2026-91745 CVE-2026-91748 CVE-2026-91749 Google IT
Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks. [...]
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Google FR
De multiples vulnérabilités ont été découvertes dans Google Pixel. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données. Google indique que la vulnérabilité...
Google FR
Google is changing how some links in its search results work. Instead of linking directly to the destination, Google has started routing some search result links through opaque google.com/goto?url=... redirects. The url parameter does not show a readable version of the destination but uses a custom, Google-specific encoding. Google confirmed the rollout to Search Engine Roundtable: “We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take…
Google US
Attackers can combine social engineering with malicious OAuth applications to gain access to Google Workspace data without relying solely on stolen passwords. This webinar examines two attacks to show how these breaches unfold and which security controls can help stop them. [...]
Google US
Elastic Security Labs has tracked REF9334, a Brazilian banking malware operation, since May 2025. Its toolkit is called KREMLIN (as named by the malware author, Kr3mlin4rt1st), though nothing about the operation is Russian. Lures impersonate twelve Brazilian banks; error messages and code comments are written in Portuguese, and the operators' Ethereum transactions cluster during São Paulo working hours. Over 15 months and seven campaigns, they built a malicious browser extension that installs…
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur. Microsoft indique que la vulnérabilité CVE-2026-87491 est activement exploitée.
KEV ✓ EPSS 0.04 CVE-2026-87491 Microsoft Google Chrome FR HR US CA NL
A single X DM split into two malware chains: AMOS stealer on Mac, NetSupport Manager on Windows, see the Huntress SOC analyst breakdown.
Google US
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
EPSS 0.00 CVE-2026-87536 Google Microsoft US
BlueMoon, a shared Chrome and Windows exploit kit, shows why “patch later” is becoming a dangerous gamble. Security updates are easy to put off. The browser still opens, Windows still works, and choosing to relaunch your browser or restart your computer later can feel harmless. But a newly documented exploit kit called “BlueMoon” shows how quickly patching delays can become dangerous. Proofpoint Researchers found four espionage groups using the same exploit chain against Chrome browsers running…
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.6, CVEs: CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, CVE-2026-87628, CVE-2026-87512, CVE-2026-87585, CVE-2026-87444, CVE-2026-87447, CVE-2026-87440, CVE-2026-87633, CVE-2026-87525, CVE-2026-87578, CVE-2026-87517, CVE-2026-87524, CVE-2026-87569, CVE-2026-87554, CVE-2026-87467, CVE-2026-87492, CVE-2026-87520 (+210 other associated CVEs), Summary: The Chrome team is delighted to announce the…
CVSS 9.6 Google FI
Une vulnérabilité a été découverte dans Microsoft Edge. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. Microsoft indique que la vulnérabilité CVE-2026-85046 est activement exploitée.
KEV ✓ EPSS 0.02 CVE-2026-85046 Microsoft Google veřejná správa FR CA NL US IT
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Google FR
Aggiornamenti di sicurezza Google sanano 104 vulnerabilità, di cui 31 con gravità “critica” e 73 con gravità “alta”, nei componenti Android. Tali vulnerabilità, qualora sfruttate, potrebbero consentire di eseguire codice arbitrario, elevare i privilegi, accedere a informazioni riservate o compromettere la disponibilità del servizio sui dispositivi interessati.
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel…
KEV ✓ EPSS 0.89 CVE-2025-25249 CVE-2026-19490 CVE-2026-20079 CVE-2026-87491 Fortinet Citrix Google Cisco veřejná správa US
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 230 nuove vulnerabilità di sicurezza, di cui 5 con gravità “critica” e 41 con gravità “alta”.
Google IT
Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year. [...]
CVE-2026-2441 * CVE-2026-3909 * CVE-2026-3910 * CVE-2026-5281 * CVE-2026-85046 * CVE-2026-87491 * Google US
Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day. As Rapid7 noted last month, there is no reason to suppose that Patch Tuesday will…
Third-party applications connected to Google Workspace can retain access long after their original purpose is forgotten. This webinar examines how overly permissive integrations contribute to breaches and which security controls can help fast-growing companies reduce their exposure. [...]
Google US
Cisco Talos began an investigation after observing a DLL named "verification.google" executing from WebDAV at a Ukrainian government organization. We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload. Pivoting around the similar WebDAV behavior led to a second loader named "pf.ch" and allowed us to reconstruct its earlier delivery…