Skip to content
Bug MeterX WatchBlack OctoberSaari khabrein
Cyber Khabar
Fraud hua? 1930Fraud hua? 1930Fraud hua? 19301930
Bug MeterX WatchBlack OctoberSaari khabrein
Bug MeterBlack October explainerSourcesReading guideRSScybercrime.gov.in

Cyber Khabar har ghante official advisories, security news aur researchers ke blogs padhta hai, aur unhe AI se aasaan Hinglish mein likhta hai. Har khabar ke saath asli source ka link hai — zaroori faisle se pehle source zaroor padhein.

Fraud ho jaaye to 1930 par call karein ya cybercrime.gov.in par report karein.

cyber khabar
Bug MeterX WatchBlack OctoberSaari khabrein
Cyber Khabar
Fraud hua? 1930Fraud hua? 1930Fraud hua? 19301930
Bug MeterX WatchBlack OctoberSaari khabrein
Bug MeterBlack October explainerSourcesReading guideRSScybercrime.gov.in

Cyber Khabar har ghante official advisories, security news aur researchers ke blogs padhta hai, aur unhe AI se aasaan Hinglish mein likhta hai. Har khabar ke saath asli source ka link hai — zaroori faisle se pehle source zaroor padhein.

Fraud ho jaaye to 1930 par call karein ya cybercrime.gov.in par report karein.

cyber khabar
Bug Meter · source-linked security updates

Duniya bhar ke software mein roz kitne naye chhed mil rahe hain.

Har naye security bug ko ek number milta hai; CVE. Yahan dikhta hai roz kitne aaye, kitne khatarnak hain, aur kin bugs ka hackers abhi sach mein istemaal kar rahe hain.

Data aa raha hai…

Aapka software, aapke bugs.

Jo software aap ya aapki company chalati hai, use chuniye — uske sabse naye critical bugs neeche dikhenge. Summary cve.now ki hai (English, AI se likhi, CC-BY 4.0).

WordPressPHPGoogle ChromeMicrosoft ExchangeFortinetCiscoLinuxnginxApacheMySQLVMwareIvantiCitrixNode.jsNext.js

Linux ke bugs aa rahe hain…

Shabdon ka matlab

CVE
Kisi software bug ka official naam/number, jaise CVE-2026-109618. Ek bug = ek CVE.
CVSS score
0 se 10 tak khatre ka number. 9 se upar = Critical, matlab bahut aasaani se bada nuksaan ho sakta hai.
KEV
US agency CISA ki list un bugs ki jinhe hackers sach mein istemaal kar rahe hain. Ye sabse zaroori list hai; inka patch pehle.

Data purana ho sakta hai. Pichhle 90 minute mein successful update nahi hua. Aakhri sync: 4 Nov, 8:40 am IST.

774Pichhle 24 ghante mein naye bugs (CVE) darj hue
81Critical feed mein pichhle 7 din update hue bugs
30Known exploited bugs, pichhle 7 din feed updates (CISA KEV)
3,99,311Ab tak duniya mein kul darj bugs
Roz kitne naye bugs darj hue Critical (9+) Baaki
  1. 531Thu 29Thu 29: 531 naye · 63 critical
  2. 564Fri 30Fri 30: 564 naye · 28 critical
  3. 282Sat 31Sat 31: 282 naye · 26 critical
  4. 77Sun 1Sun 1: 77 naye · 21 critical
  5. 290Mon 2Mon 2: 290 naye · 22 critical
  6. 535Tue 3Tue 3: 535 naye · 18 critical
  7. 463AajAaj: 463 naye · 29 critical

Din India ke time (IST) ke hisaab se. Pehla din aur "Aaj" adhoore ho sakte hain.

Pichhle 7 din ke 3,204 naye bugs kitne khatarnak hain
  • ▲Criticalscore 9–10 · turant patch227
  • ◆Highscore 7–8.9 · jaldi patch908
  • ●Mediumscore 4–6.91,078
  • ○Lowscore 0–3.9110
  • ?Score pendingRisk abhi assess nahi hua881

Hackers abhi inka istemaal kar rahe hain

CISA Known Exploited list ke bugs par recent feed updates

  • Polkit pkexec utility me local privilege escalation bug, attacker root ya admin rights le sakta hai.A local privilege escalation vulnerability was found on polkit's pkexec utility. (Update: proof of concept on GitHub published) ↗CVE-2021-40344 Nov, 7:23 am
  • WordPress core upgrade ke dauran hacker bina login ke site pe code chala sakta hai, site poori control ho sakti hai.WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution (Update: added to CISA KEV) ↗CVE-2026-1199774 Nov, 2:19 am
  • Ivanti Connect Secure VPN mein predictable file names se attacker remote login karke malicious file upload kar sakta hai.Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to… ↗CVE-2026-1185273 Nov, 8:31 pm
  • VMware vCenter ka vmdir access control bug, hacker admin rights le sakta hai.Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller… (Update: proof of concept on GitHub published) ↗CVE-2020-39523 Nov, 7:44 pm
  • PHP me stale global state flaw, hacker remote code chala sakta hai.RCE via stale global state (Update: Nuclei template published) ↗CVE-2026-1096193 Nov, 3:33 pm

Critical bugs ke recent updates

cve.now ke hisaab se: KEV, CERT-critical, ya bade software mein CVSS 9+

  • Polkit pkexec ka bug, local user root ban sakta hai, system ko full control mil jayega.A local privilege escalation vulnerability was found on polkit's pkexec utility. (Update: proof of concept on GitHub published) ↗CVE-2021-40344 Nov, 7:23 am

Aakhri sync: 4 Nov, 8:40 am IST · Data: cve.now (CVE List, NVD, CISA KEV, OSV, EPSS se). Summaries CC-BY 4.0; Hinglish explanations adapted hain. NVD data istemaal hota hai; NVD ka endorsement nahi.

  • Linux kernel MPTCP ka bug, attacker network packets se system ko crash ya data chura sakta hai.mptcp: avoid combining some incoming suboptions (Update: proof of concept on GitHub published) ↗CVE-2026-805874 Nov, 7:23 am
  • Chrome Android me WebGL bug se attacker fake page se code chala sakta, device control ho sakta.Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code… (Update: now rated critical) ↗CVE-2026-1209314 Nov, 3:52 am
  • Chrome DevTools me galat auth se attacker fake page se code chala ke sandbox tod sakta.Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (Update: now rated critical) ↗CVE-2026-1210304 Nov, 3:02 am
  • Chrome Windows me Views bug se attacker fake page se code chala ke system pe control le sakta.Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (Update: now rated critical) ↗CVE-2026-1210344 Nov, 3:02 am
    • CVE-2026-80587#2026-11-04T01:53:34.494ZCVE-2026-80587: mptcp: avoid combining some incoming suboptions (Update: proof of concept on GitHub published)Update: proof of concept on GitHub published. The vulnerability affects the Linux kernel's MPTCP (Multipath TCP) networking code, specifically how it handles incoming MPTCP suboptions in TCP packets. Because the kernel accepts combinations of suboptions that the protocol says should be mutually exclusive, a crafted packet could cause unexpected behavior, potentially leading to a crash or other disruption of network connections.Critical4 Nov, 7:23 am
    • CVE-2024-1086#2026-11-02T13:59:34.666ZCVE-2024-1086: Use-after-free in Linux kernel's netfilter: nf_tables component (Update: proof of concept on GitHub published)Update: proof of concept on GitHub published. The Linux kernel's netfilter nf_tables component is affected, which is used for packet filtering and firewall rules on Linux systems. A local attacker with access to the system could exploit this memory-handling flaw to gain elevated (root-level) privileges.Critical2 Nov, 7:29 pm
    • CVE-2026-89633#2026-10-31T19:52:34.419ZCVE-2026-89633: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Update: proof of concept on GitHub published)Update: proof of concept on GitHub published. The Linux kernel's SMB client (CIFS/SMB3 filesystem support) is affected, specifically its handling of SMB transaction2 responses when coalescing data. A malicious or compromised SMB server could supply crafted offset values that cause the client to read or write memory outside its allocated buffers, potentially leading to a crash or memory corruption on systems mounting remote SMB shares.Critical1 Nov, 1:22 am
    • CVE-2026-99154#2026-10-31T12:45:34.463ZCVE-2026-99154: scsi: libiscsi: Reject a negative task index from parse_pdu_itt (Update: now rated critical)Update: now rated critical. The Linux kernel's iSCSI library (libiscsi), used by iSCSI initiator drivers such as be2iscsi for Emulex/Broadcom adapters, can be made to read memory before its command array when a PDU carries a negative task index. This could cause out-of-bounds memory access in the kernel, with potential for crashes or information exposure.Critical31 Oct, 6:15 pm
    • CVE-2026-99153#2026-10-31T12:45:34.463ZCVE-2026-99153: scsi: libiscsi: Validate the ITT reflected in a Reject PDU (Update: now rated critical)Update: now rated critical. The Linux kernel's iSCSI initiator support (libiscsi) is affected: when a target sends a Reject PDU, the kernel trusted the task identifier inside it, so a malicious or faulty target could make it complete an arbitrary command slot. The result can be a kernel crash (a NULL pointer dereference) or an in-flight SCSI read being reported as successful with its data never written.Critical31 Oct, 6:15 pm
    • CVE-2026-98432#2026-10-29T15:59:34.619ZCVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (Update: proof of concept on GitHub published)Update: proof of concept on GitHub published. The Linux kernel's IPv4 TCP stack is affected, specifically the handling of IP options on TCP child and request sockets during SYN/SYNACK processing and socket migration. The impact is a potential use-after-free of IP option memory, which can crash the system or lead to memory corruption.Critical29 Oct, 9:29 pm
    • CVE-2026-46300#2026-10-28T19:15:34.411ZCVE-2026-46300: net: skbuff: preserve shared-frag marker during coalescing (Update: added to CISA KEV)Update: added to CISA KEV. The Linux kernel's core networking packet-buffer code (sk_buff handling, specifically skb_try_coalesce() used during TCP receive coalescing) is affected. The flaw can cause packets carrying externally owned or page-cache-backed data to lose their "shared" marker, so IPsec ESP may decrypt them in place over memory it should not modify.Critical29 Oct, 12:45 am
    • CVE-2026-98464#2026-10-24T14:29:34.346ZCVE-2026-98464: RISC-V: KVM: Synchronize hrtimer callback during teardown (Update: now rated critical)Update: now rated critical. In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before th...Critical24 Oct, 7:59 pm