Topic
99 articles
CMS SecurityWordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
MicrosoftMicrosoft reclassifies CVE-2026-65660 as an 8.8 CVSS RCE flaw after threat actors bypass SharePoint SafeControls filtering to execute arbitrary .NET code.
Active ExploitZyxel patches actively exploited stack buffer overflow flaw CVE-2026-7273 in GS1900 smart switches, enabling unauthenticated LAN attackers to execute arbitrary code.
Active ExploitThreat actors actively weaponize high-severity flaw CVE-2026-33626 in LMDeploy within hours of release, using multimodal image loaders as SSRF proxies into cloud metadata.
CiscoCisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
LinuxThreat actors weaponize improper condition check flaw CVE-2025-39682 in Linux kernel kTLS receive path, triggering out-of-bounds corruption in multi-tenant workloads.
AWS CloudAWS patches high-severity flaw CVE-2026-86831 in Amazon EKS aws-network-policy-agent allowing unauthorized pod communication and network isolation bypass.
Threat IntelCISA orders emergency patching of PTC Windchill PLM vulnerability CVE-2026-12569 enabling unauthenticated remote code execution and CAD blueprint theft.
Crypto / Web3CISA adds Linux kernel cryptographic socket race condition vulnerability CVE-2025-39964 to KEV catalog following active root privilege escalation attacks.
LinuxCISA adds Linux kernel ebtables SNAT memory corruption flaw CVE-2026-53266 (CVSS 8.8) to KEV catalog following active hypervisor privilege escalation.
Active ExploitCISA orders federal agencies to patch Ubiquiti UniFi OS vulnerability CVE-2026-34909 enabling unauthenticated network configuration extraction and takeover.
LinuxCISA adds Linux kernel cgroups v1 release_agent vulnerability CVE-2022-0492 to KEV catalog as threat actors weaponize container breakout exploits.
Check PointCISA orders emergency patching of Check Point Security Gateway flaw CVE-2026-50751 enabling unauthenticated perimeter VPN bypass and network takeover.
CiscoCISA orders emergency remediation of Cisco Catalyst SD-WAN Manager flaws CVE-2026-20262 and CVE-2026-20245 enabling remote administrative root takeover.
Active ExploitCISA adds Splunk Enterprise vulnerability CVE-2026-20253 (CVSS 9.8) to KEV catalog following active exploitation targeting enterprise SIEM clusters.
Active ExploitCISA adds Ivanti Sentry vulnerability CVE-2026-10520 (CVSS 9.8) to KEV catalog following active zero-day exploitation against corporate mobile gateways.
OT / SCADACISA adds Lantronix EDS5000 industrial serial device server vulnerability CVE-2025-67038 to KEV catalog following active exploitation against OT networks.
CiscoCISA adds Cisco IOS HTTP server CSRF flaw CVE-2008-4128 to KEV catalog following active in-the-wild exploitation to alter router configuration registers.
MicrosoftCISA orders federal agencies to patch critical Microsoft SharePoint vulnerabilities CVE-2026-58644 and CVE-2026-56164 enabling unauthenticated remote code execution.
OT / SCADACISA adds KNX industrial building automation protocol vulnerability CVE-2023-4346 to KEV catalog following active exploitation against critical OT facilities.
Agentic AICISA adds critical Langflow AI vulnerabilities CVE-2026-0770 and CVE-2026-55255 to KEV catalog as threat actors weaponize agentic pipeline execution flaws.
Active ExploitCISA incorporates Adobe ColdFusion path traversal vulnerability CVE-2026-48282 (CVSS 9.8) into KEV catalog following active exploitation against enterprise application servers.
CiscoCISA adds Cisco Unified Communications Manager vulnerability CVE-2026-20230 (CVSS 8.5) to KEV catalog following active in-the-wild enterprise telephony attacks.
Threat IntelCISA adds Ubiquiti UniFi OS vulnerability CVE-2026-34910 (CVSS 8.8) to KEV catalog following active in-the-wild exploitation against network edge gateways.