Vulnerability | Breaking Cybersecurity News | The Hacker News

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that  converts a personal account  into an organization, Docker said in a  security advisory  on October 12. Conversion transferred the account's personal access tokens (PATs) to the user designated as the organization's owner. A PAT is used in place of a password in the registry, and the person who created each token can still use it. The access was limited to the registry. It did not reach the Docker Hub web interface, and it could not be used to change a password, email address, or two-factor settings, or to take over an account. Docker tracks the flaw as CVE-2026-105445 and rated it critical. The  CVE record  it published on October 13 gives the flaw a CVSS 4.0 score of 9.4. The ...

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm  Volexity said  on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti, found the attack on one customer's appliance. The appliance was fully patched at the time and running version 22.8R2.4. The attacker, which Volexity tracks as UTA0576, began exploiting it on October 3. Ivanti said  on October 13 that it is aware of "limited exploitation in the wild." The first two flaws are an authentication bypass and a remote code execution flaw, tracked together as  CVE-2026-104935 . Together they let an attacker run code as the appliance's cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said. The CVE reco...

A flaw in SAP's  Cloud SDK for Python  can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a  security advisory  on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain, the name such an application passes to the SDK to say which tenant a request is for. The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0 out of 10. The advisory names  version 0.45.2 , released on August 21, as the fix. The SDK handles authentication for those services with the application's client credentials, a client ID and a client secret. Version 0.45.2 added a check that rejects any tenant subdomain that is not a simple name. Six later releases do not apply that check in every case, The Hacker News found. Versions 0.53.0 through 0.55.0, published betwe...

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary said . "Changing the repository or project identity requires a new trust relationship with a fresh 48-hour validation window -- ordinary edits don't restart the deadline." The change contains the risk associated with trusting a repository or project name that changes ownership, GitHub said, adding npm also rejects trusted publishing tokens from GitHub Actions issue_comment events going forward, along with the Existing pull_request_target restriction. In an update to its documentation, GitHub states that a newly created trusted publisher configuration must compl...

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known. Owners of affected TVs should check for a firmware update. No workaround is available for those who cannot update yet. The attack enters through a service that the TV exposes on port 3001, which is used by the LG ThinQ app for pairing. An attacker replays a manifest from sync-demo, a built-in app already on the device, signed with a test certificate the firmware trusts. A permission in the manifest causes the pairing service to skip the PIN prompt and hand over a privileged key. With that key, the attacker laun...