CISA Adds Zyxel Switch Buffer Overflow to Known Exploited Vulnerabilities Catalog
CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 switches, to its Known Exploited Vulnerabilities Catalog after evidence of active exploitation.
Category
Vulnerability
122 published analyses.
CISA Warns of Active Exploitation of Three Linux Kernel Flaws
CISA has issued an alert about active exploitation of three Linux kernel vulnerabilities, including one critical severity flaw affecting Linux systems.
CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities
CISA has added three critical Linux kernel vulnerabilities with active exploit evidence to its Known Exploited Vulnerabilities catalog, including a severe TLS receive path flaw scored 9.8.
Critical Pre-Auth RCE Found and Exploited in Orkes Conductor Platform
A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor affecting versions prior to 3.30.2 is actively exploited and presents severe security risks.
CISA Adds Two Actively Exploited Linux Kernel Vulnerabilities to KEV Catalog
CISA has identified two Linux Kernel vulnerabilities, CVE-2025-39964 and CVE-2026-53266, as actively exploited and added them to its Known Exploited Vulnerabilities Catalog, urging high-priority remediation.
Critical Check Point Flaw Allows Root Privilege Code Execution
Check Point Software disclosed and patched a critical vulnerability enabling attackers to execute code as root on management systems, risking full enterprise system compromise.
Critical Authentication Flaw in Mitsubishi Electric GX Works3 and Motion Control
A high-severity authentication vulnerability in Mitsubishi Electric GX Works3 and its Motion Control Settings allows local attackers to bypass password checks and manipulate control programs.
Critical RCE Flaw in Unbound DNSSEC Validator Fixed in 1.26.1
A critical heap overflow vulnerability in Unbound DNSSEC validator before version 1.26.1 allows remote code execution via malicious DNS zones.
Critical Vulnerabilities Discovered in Hitachi Energy FACTS Control Systems
Multiple critical vulnerabilities with CVSS scores up to 9.9 impact Hitachi Energy's FACTS Control Platform, risking confidentiality, integrity, and availability in energy sector control systems.
Critical Issabel Framework Flaw Enables Unauthenticated OS Command Execution
A critical vulnerability in the Issabel Framework allows unauthenticated remote OS command execution, actively exploited and posing a severe security risk.
Critical ScreenConnect Flaw Now Actively Exploited in Real Attacks
CISA reports active exploitation of a critical vulnerability in ConnectWise ScreenConnect that risks unauthorized remote access.
CISA Alerts on Ransomware Exploiting Critical VMware vCenter Flaw
CISA warns that ransomware gangs have begun exploiting a critical remote code execution vulnerability in VMware vCenter that was patched in July.
Critical Vulnerabilities Discovered in mySCADA myPRO Manager
Two critical vulnerabilities in mySCADA myPRO Manager allow unauthenticated attackers to access privileged management functions and send arbitrary SMS via connected GSM modems, affecting versions through 2.1.
CISA Adds Cisco Secure Email Gateway SQLi to Known Exploited Vulnerabilities
CISA has listed CVE-2026-76461, a SQL injection flaw in Cisco Secure Email Gateway, as actively exploited and requires urgent remediation by federal agencies.
Microsoft Issues Emergency Windows Updates for RDS Failures
Microsoft released out-of-band updates to address Remote Desktop Services failures and issues affecting Hyper-V and USB audio on certain Windows versions.
Dutch NCSC Warns of Imminent Exploitation of Critical Check Point VPN Flaws
The Dutch Nationaal Cyber Security Centrum warns of imminent exploitation of critical vulnerabilities CVE-2026-85102 and CVE-2026-85103 affecting Check Point VPN appliances.
Critical Artifactory Flaws Exploited to Deploy Rust Backdoor Malware
Attackers exploit chained critical vulnerabilities in JFrog Artifactory to bypass authentication, gain admin access, and deploy Rust-based backdoors on self-hosted servers.
GitLab CVSS 10 File-Read Flaw Faces In-the-Wild Probes
GitLab issued patches for a critical CVSS 10.0 path traversal flaw in its repository commits API that allows unauthenticated file reads and is being actively probed in the wild.
CISA Adds Two Actively Exploited MikroTik Vulnerabilities to KEV Catalog
CISA has listed two critical actively exploited MikroTik RouterOS vulnerabilities in its Known Exploited Vulnerabilities Catalog, highlighting the need for prioritized remediation.
Cisco FMC Flaws Exploited by Ransomware and State Hackers
Two patched vulnerabilities in Cisco Secure Firewall Management Center are actively exploited by ransomware gangs and state-sponsored hackers, threatening critical network security infrastructure.
Cisco confirms active exploitation of critical FMC authentication bypass flaw
Cisco has confirmed active exploitation of a critical authentication bypass vulnerability (CVE-2026-20079) in its Secure Firewall Management Center software, risking enterprise defenses.
Microsoft September 2026 Patch Tuesday fixes 966 flaws and 2 zero-days
Microsoft's September 2026 Patch Tuesday addresses 966 vulnerabilities including two actively exploited zero-day flaws.
N-able patches critical RCE flaw in N-central amid active exploitation
N-able has released an emergency hotfix for a critical remote code execution vulnerability in its N-central RMM platform that is actively exploited.
Critical MikroTik SSH Bypass Exploited - Patch Immediately
MikroTik released a patch for an SSH authentication bypass vulnerability currently exploited to create unauthorized accounts on devices.
Critical VMware Flaw Could Allow Host Code Execution by VM Admins
Broadcom patched two vulnerabilities in VMware Workstation and Fusion, including a critical integer overflow allowing local VM admins to execute arbitrary host code.
CISA Adds Critical Chromium V8 Vulnerability to Exploited Catalog
CISA has added CVE-2026-85046, a type confusion vulnerability in Google Chromium V8, to its Known Exploited Vulnerabilities Catalog due to active exploitation, requiring urgent attention for remediation.
Critical Citrix NetScaler Auth Bypass Flaw Exploited in Attacks
Attackers are actively exploiting a critical authentication bypass vulnerability in Citrix NetScaler, significantly impacting enterprise security.
Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Run Code as Root
Cisco released a patch for a critical vulnerability in Silicon One-based Nexus 9000 switches that allows unauthenticated remote code execution as root, identified as CVE-2026-20212 with a 9.8 CVSS score.
Critical Elementor Pro Flaw Enables Takeover of WordPress Sites
A critical vulnerability (CVE-2026-32475) in Elementor Pro is actively exploited to deliver webshells and execute commands on WordPress servers.
Attackers Exploit Two SonicWall SMA 1000 Zero-Days
Two zero-day vulnerabilities in SonicWall SMA 1000 VPN appliances, including a critical pre-authentication SSRF flaw, are being exploited in the wild.
Critical JFrog Artifactory Flaw Exploited Days After Patch
Attackers are actively exploiting CVE-2026-82329, a critical authentication bypass in JFrog Artifactory, shortly after its public disclosure and patch release.
Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys
An unauthenticated remote code execution vulnerability in Langflow is exploited to steal sensitive OpenAI and AWS credentials, posing substantial risks to cloud and AI security.
GiveWP WordPress Plugin Flaw Lets Hackers Execute Server Commands
A critical vulnerability in the GiveWP donation plugin for WordPress allows unauthenticated attackers to execute arbitrary commands on the hosting server.
Critical cPanel Flaw Lets Single Hosting Customer Gain Root Access
A critical vulnerability in cPanel & WHM's domain parking and addon domain features enables a hosting customer to gain root access, posing a significant threat to server security.
Critical ownCloud Flaw Exploited to Steal Nuclear Records in Philippines
A critical ownCloud vulnerability tracked as CVE-2023-49105 has been added to CISA's KEV catalog following exploitation by a Chinese-speaking threat actor targeting a Philippine nuclear research organization.
PaperCut issues second emergency patch for exploited NG and MF flaws
PaperCut released a second emergency patch addressing two actively exploited vulnerabilities in its NG and MF print management software after initial mitigations were bypassed.
Three CVSS 10.0 ServiceNow Flaws Enable Code Execution and SQL Injection
ServiceNow fixed four security flaws in its AI Platform, including three critical CVSS 10.0 vulnerabilities that allow unauthenticated code execution and SQL injection.
Critical Vulnerabilities Found in Xiiaozet LK100W Devices
Multiple critical vulnerabilities in Xiiaozet LK100W devices could allow attackers to remotely gain full control, with version 2.1.240 addressing these risks.
PaperCut NG and MF Zero-Day Flaw Actively Exploited in Attacks
A critical zero-day vulnerability in all versions of PaperCut NG and MF print management software is actively exploited in attacks, affecting organizations using these products.
Critical Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution
A critical zero-click remote code execution vulnerability in the Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code on affected servers.
Critical Gitea Vulnerability Exploited in Active Code Injection Attacks
Attackers are actively exploiting a critical code injection vulnerability in Gitea, a widely used self-hosted Git service, prompting warnings from U.S. CISA.
Critical Vulnerabilities Found in Ebyte NE2-D11 Firmware
Multiple critical vulnerabilities in Ebyte NE2-D11 devices allow unauthorized administrative access, data exposure, and operational disruption, affecting critical infrastructure controls.
Hackers Breached 270+ Zimbra Servers via Critical RCE Vulnerability
Over 270 Zimbra Collaboration Suite servers have been breached through exploitation of a critical remote code execution vulnerability, exposing organizations to significant security risks.
CISA Adds Oracle HTTP Server Vulnerability to Known Exploited Catalog
CISA has added CVE-2026-21962, an Oracle HTTP Server and WebLogic Server Proxy Plug-in vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation.
Critical Keycloak Password Reset Flaw Could Let Attackers Hijack Any Account
A critical vulnerability rated 9.1 CVSS in Keycloak allows unauthenticated attackers to hijack user accounts by forcing password resets, with patches released by Red Hat and the Keycloak project.
GitLab CVE-2026-19478 Exploited Days After Disclosure
A critical code injection vulnerability in GitLab, CVE-2026-19478, is actively exploited shortly after disclosure, enabling unauthenticated attackers to modify or delete certain publicly accessible projects.
CISA Adds Critical Zimbra OS Command Injection to Known Exploited Vulnerabilities
CISA added CVE-2026-73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities Catalog after active exploitation was observed.
Microsoft patches critical Entra ID flaw exploited in active attacks
Microsoft released a patch for a critical vulnerability in Entra ID that is actively exploited in targeted attacks, affecting identity and access management security.
CISA Adds Two Critical TrueConf Vulnerabilities to KEV Catalog
CISA has included two actively exploited TrueConf Server vulnerabilities in its Known Exploited Vulnerabilities Catalog, emphasizing critical risks to federal agencies and beyond.
CISA Warns of Active Exploitation of Critical MLflow Vulnerability
CISA warns that threat actors are actively exploiting a critical vulnerability in the MLflow AI engineering platform, posing risks to federal agencies and beyond.
Critical NetScaler Flaw Can Bypass Authentication on Gateway Servers
Citrix has patched critical authentication bypass vulnerabilities affecting NetScaler ADC and Gateway, impacting specific FIPS and NDcPP builds used on gateway and AAA servers.
Active Cyber Threat Targets Siemens S7 PLCs Using AI-Generated Exploits
US government agencies warn of an active cyber threat exploiting Siemens S7 Series programmable logic controllers using AI-assisted scripts, risking critical infrastructure disruption and safety.
Critical RCE Flaw in Windows IKE Extension Actively Exploited
CISA warns of active exploitation of a critical remote code execution vulnerability in the Windows Internet Key Exchange Service Extensions, enabling attacker code execution without user interaction.
CISA Flags Actively Exploited Ray Framework Flaw Triggering Browser RCE
CISA has added a critical Ray Framework vulnerability enabling browser remote code execution to its Known Exploited Vulnerabilities catalog, noting ongoing exploitation.
CISA: Ransomware Gangs Exploiting Windows Task Host Flaw
CISA confirms ransomware groups are actively exploiting a high-severity Windows Task Host vulnerability, posing increased risk to enterprise environments.
CISA Adds CVE-2025-62593 Ray Code Injection to KEV Catalog
CISA added the actively exploited Ray-Project code injection vulnerability CVE-2025-62593 to its Known Exploited Vulnerabilities catalog, highlighting urgent remediation needs.
CVE-2026-54121: Enterprise CA Privilege Escalation Risk
CVE-2026-54121 enables a standard domain user to escalate privileges by exploiting an Enterprise Certificate Authority to become a Domain Controller, exposing risks in PKI infrastructure trust models.
Critical Out-of-Bounds Read Vulnerability in Siemens Parasolid
A high-severity out-of-bounds read vulnerability in Siemens Parasolid parsing X_T files allows potential arbitrary code execution, affecting versions prior to V38.0.235 and V38.1.230.
Critical Vulnerabilities Found in Johnson Controls Airwall Affecting Sensitive Data
Two medium-to-high severity vulnerabilities in Johnson Controls Airwall could allow attackers to decrypt sensitive data and read arbitrary files, impacting critical infrastructure security.
Critical SAP Commerce Cloud RCE Flaw Targeted in Active Attacks
A maximum-severity remote code execution vulnerability in SAP Commerce Cloud patched just three days ago is now actively exploited, posing a critical security risk.
Critical RCE Vulnerability Found in Siemens Siveillance Video
Siemens patched a critical remote code execution vulnerability in multiple versions of its Siveillance Video Management Servers that threatens critical infrastructure.
Critical VMware vCenter Vulnerability Actively Exploited for Remote Access
Threat actors are exploiting the critical directory traversal vulnerability CVE-2026-59310 in VMware vCenter, enabling remote code execution and requiring immediate attention from defenders.
Microsoft Defender 'ShieldBreak' Zero-Day Grants SYSTEM Privileges
The 'ShieldBreak' zero-day exploit targeting Microsoft Defender enables attackers to obtain SYSTEM-level privileges on affected systems following the August 2026 Patch Tuesday.
AI-Assisted Exploit Enables Unauthenticated RCE on SharePoint Servers
A critical SharePoint vulnerability (CVE-2026-55040) enables unauthenticated remote code execution, facilitated by AI, affecting several SharePoint Server versions.
Cisco Warns of High-Severity VPN Flaw Actively Exploited to Crash Devices
Cisco alerts on a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense VPN software actively exploited to crash devices, threatening enterprise network stability.
Microsoft August 2026 Patch Tuesday fixes 400 flaws including 3 zero-days
Microsoft's August 2026 Patch Tuesday addresses 400 security flaws, including one actively exploited zero-day and two publicly disclosed zero-day vulnerabilities.
CISA Adds Critical Progress LoadMaster Command Injection to KEV Catalog
CISA has added CVE-2026-8037, a critical Progress LoadMaster command injection vulnerability actively exploited in the wild, to its Known Exploited Vulnerabilities Catalog, requiring prioritized remediation by federal agencies under BOD 26-04.
Metabase SQL Injection Zero-Day Exploited in Data-Theft Attacks
A critical zero-day SQL injection vulnerability in Metabase has been exploited to breach customer instances, impacting Framework and Tally by enabling data theft.
Cisco Patches 12 Critical SD-WAN and IOS XE Vulnerabilities
Cisco released patches for 12 critical vulnerabilities in Catalyst SD-WAN and IOS XE software impacting devices in all configurations.
Critical Vulnerabilities Found in ABB Ability Zenon IIoT Services with MongoDB
High-severity vulnerabilities in ABB Ability Zenon IIoT services using MongoDB 4.2 allow unauthorized access, denial of service, and potential data compromise.
Veeam, Terraform MCP, and Django Patch Critical Vulnerabilities Including CVSS 10.0 Bug
HashiCorp, Veeam, and the Django Software Foundation released patches for 11 vulnerabilities, including a critical CVSS 10.0 cross-tenant bug affecting Terraform MCP Server, Veeam Service Provider Console, and Django software.
Critical cPanel Flaw Lets Hosting Customers Run SQL as Database Root
A critical vulnerability in cPanel (CVE-2026-58048) allowed authenticated hosting customers to execute SQL commands with root database privileges, risking full database control.
Critical Integrity Flaw in Thermo Fisher Genetic Analyzers Could Alter DNA Data
A high-severity vulnerability in Thermo Fisher Applied Biosystems Genetic Analyzers allows modification of DNA data output files, risking inaccurate test results in healthcare settings.
CISA Adds Critical N-able N-central Vulnerability to KEV Catalog
CISA added CVE-2026-18577, an authentication bypass vulnerability in N-able N-central, to its Known Exploited Vulnerabilities Catalog due to active exploitation, prioritizing federal agency remediation under BOD 26-04.
Coldcard Hardware Wallet Flaw Linked to $70M Bitcoin Theft
A firmware vulnerability in Coldcard hardware wallets enabled attackers to steal approximately $70 million in Bitcoin by draining over 1,000 addresses in under an hour.
Adobe Campaign Classic CVSS 10.0 Flaw Enables Code Execution Without User Action
Adobe Campaign Classic includes a critical CVSS 10.0 vulnerability (CVE-2026-48449) that allows arbitrary code execution without user interaction.
Azure Cosmos DB Flaw Exposed Platform-Wide Access Key
A critical vulnerability in Azure Cosmos DB enabled attackers to escape the Gremlin query sandbox and gain full read/write access to multiple customer databases.
JetBrains warns of critical TeamCity remote code execution flaw
JetBrains disclosed a critical authentication bypass vulnerability in TeamCity On-Premises that enables remote code execution, posing significant risk to enterprise environments.
Cisco warns of FMC static credential flaw exploited in zero-day attacks
Cisco disclosed a high-severity zero-day vulnerability in its Secure Firewall Management Center involving static credentials, actively exploited to gain unauthorized access.
Critical Ruby on Rails Flaw Lets Attackers Read Server Files via Image Uploads
A critical Active Storage vulnerability in Ruby on Rails allows unauthenticated attackers to read arbitrary server files through malicious image uploads, risking exposure of sensitive data.
Critical Ruflo MCP Flaw Enables Remote Code Execution and AI Memory Poisoning
A critical vulnerability in the Ruflo open-source agent platform allows unauthenticated remote code execution and poisoning of AI memory, posing significant risks to AI model operations.
Three Critical VMware Flaws Enable Auth Bypass and VM Escape
Broadcom published updates for critical VMware vulnerabilities in ESX, vCenter, Workstation, and Fusion enabling authentication bypass and VM escape with high severity.
Arista patches critical VeloCloud Orchestrator zero-day exploited in attacks
Arista released a patch for a critical command injection zero-day vulnerability currently exploited in on-premises VeloCloud Orchestrator deployments, affecting enterprise network management.
Critical OpenSSL Buffer Overflow in Siemens Desigo CC Affects Multiple Versions
A critical stack buffer overflow in OpenSSL affects Siemens Desigo CC versions V7, V8, and V9 before 9.0.1, posing risks of remote code execution or denial of service.
Critical OpenWrt DHCPv6 Flaw Lets Attackers Execute Code as Root
A critical DHCPv6 stack overflow vulnerability in OpenWrt's default network service odhcpd allows unauthenticated remote root code execution.
Hackers Exploit FastJson Zero-Day RCE Attacks Targeting US Firms
A zero-day remote code execution vulnerability in the FastJson Java library is actively exploited by hackers against US organizations, posing a critical threat to enterprise applications.
vBulletin fixes critical pre-auth RCE flaw with public exploit
A critical pre-authentication remote code execution vulnerability in vBulletin forum software has been patched following the public release of an exploit, enabling unauthenticated attackers to execute arbitrary PHP code.
Fastjson 1.x RCE Vulnerability Actively Targeted, No Patch Available
Attackers are exploiting a critical remote code execution vulnerability in Fastjson 1.x used in Spring Boot applications, enabling unauthenticated code execution with Java process privileges and no patch currently available.
Certighost Exploit Allows Low-Privileged AD Users to Impersonate Domain Controllers
The Certighost exploit enables low-privileged Active Directory users to obtain Domain Controller certificates and authenticate as domain controllers, risking critical Kerberos credential compromise.
Critical Bing Image Flaw Allows SVGs to Execute Commands as SYSTEM
A crafted SVG submitted to Bing image search can execute commands as NT AUTHORITY\SYSTEM on Microsoft’s production servers, impacting multiple hosts with critical security implications.
Critical Privilege Escalation Vulnerabilities Found in Weintek cMT3092X HMI
Multiple high-severity vulnerabilities in Weintek cMT3092X HMI may allow attackers to escalate privileges and steal credentials, impacting critical manufacturing environments.
CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog
CISA has added CVE-2026-16232 and CVE-2026-50522 to its Known Exploited Vulnerabilities Catalog following evidence of active exploitation targeting Check Point SmartConsole and Microsoft SharePoint.
CISA urgent patch order for exploited Langflow RCE vulnerability
CISA has mandated U.S. federal agencies to urgently address a remote code execution vulnerability actively exploited in Langflow, posing critical risks to infrastructure security.
Critical Authentication Bypass in Tycon Systems TPDIN-Monitor-WEB2
A critical authentication bypass vulnerability in Tycon Systems TPDIN-Monitor-WEB2 allows unauthenticated attackers full administrative control, risking critical infrastructure disruptions.
Critical SharePoint RCE CVE-2026-50522 Actively Exploited
Microsoft patched a critical SharePoint Server vulnerability, CVE-2026-50522, now actively exploited after a public proof-of-concept was released, enabling remote code execution via deserialization of untrusted data.
WordPress Core SQL Injection Vulnerability CVE-2026-63030 Exploited
A critical SQL injection vulnerability identified as CVE-2026-63030 affects WordPress Core and is actively exploited, allowing unauthenticated remote code execution.
Critical NGINX Vulnerability Risks Worker Crashes and Remote Code Execution
F5 released patches for CVE-2026-42533, a critical nginx flaw allowing remote, unauthenticated attackers to trigger a heap buffer overflow that can crash workers or enable remote code execution.
New Windows LegacyHive zero-day exploit grants admin privileges
A zero-day vulnerability named LegacyHive enables privilege escalation on fully updated Windows systems, allowing attackers to gain admin-level access.
CISA Urges Immediate Patching of Exploited Fortinet FortiSandbox Flaws
CISA has directed federal agencies to urgently patch two actively exploited vulnerabilities in Fortinet FortiSandbox, highlighting critical risks to government and enterprise environments.
Critical wp2shell WordPress Flaw Allows Unauthenticated Code Execution
A critical vulnerability in WordPress core enables unauthenticated attackers to execute code on default installations, prompting urgent patch releases.
CISA Warns to Patch Actively Exploited SharePoint Vulnerabilities
CISA issued a warning about three actively exploited vulnerabilities in Internet-exposed on-premises SharePoint Server instances that allow remote compromise.
Zoom warns of critical account takeover vulnerability
Zoom has disclosed a critical vulnerability in its Windows desktop client and SDK that enables unauthenticated attackers to hijack user accounts, posing a significant security risk.
Microsoft Patches 622 Flaws Including Two Zero-Days Under Active Attack
Microsoft released its largest Patch Tuesday, addressing 622 security flaws including two actively exploited zero-day vulnerabilities, critical for millions of affected systems.
SAP Patches Critical CVSS 9.9 Flaw in NetWeaver ABAP
SAP released updates fixing a critical CVSS 9.9 out-of-bounds write vulnerability in NetWeaver ABAP that may allow authenticated attackers to corrupt memory and manipulate data.
SonicWall alerts on critical SMA1000 zero-day flaws in active attacks
SonicWall disclosed two critical zero-day vulnerabilities in SMA1000 devices being exploited in active attacks, highlighting urgent risk to enterprise network security.
CISA warns of active RCE flaws in Joomla iCagenda and Balbooa Forms extensions
CISA warns that remote code execution vulnerabilities are actively exploited in Joomla iCagenda and Balbooa Forms extensions through arbitrary file uploads, risking full compromise of affected sites.
Progress Warns ShareFile Customers to Shutdown Storage Zone Controllers
Progress Software advises ShareFile customers to shut down Windows servers running Storage Zone Controllers due to a credible security threat, disabling account access as a precaution.
Critical Authenticated File Write Vulnerability in OpenPLC v3 Affects Industrial Systems
OpenPLC v3 contains a critical authenticated arbitrary file write vulnerability that can lead to native code execution through compiling malicious files. This affects critical infrastructure sectors worldwide and requires urgent mitigation.
Study Finds Traffic Leaks and Security Flaws in 281 Free Android VPN Apps
Researchers tested 281 popular free Android VPN apps and discovered many leak user traffic, transmit unencrypted data, and include tracking. These apps, collectively installed over 2.4 billion times, fail to meet basic privacy and security standards.
Ubiquiti Patches Critical UniFi Flaws in Multiple Key Products
Ubiquiti released updates to fix critical vulnerabilities in UniFi Connect, Talk, Access, Protect, and OS. These flaws could allow privilege escalation and arbitrary command execution.
Threat Actors Probe Critical Gitea Docker Flaw CVE-2026-20896
Threat actors are actively attempting to exploit a critical vulnerability in Gitea Docker images less than two weeks after it was patched. The flaw allows unauthenticated clients to escalate privileges by abusing the 'X-WEBAUTH-USER' header.
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host
A critical use-after-free flaw in Linux's KVM hypervisor allows guest VMs on Intel and AMD systems to corrupt host kernel memory, potentially escaping the virtual environment. The vulnerability, known as Januscape (CVE-2026-53359), includes a public PoC that crashes hosts with a more impactful exploit reportedly in development.
Max severity Adobe ColdFusion flaw actively exploited in attacks
A critical Adobe ColdFusion vulnerability, CVE-2026-48282, is now being actively exploited in cyberattacks, according to KEVIntel. This flaw demands immediate attention due to its maximum severity rating.
Bad Epoll Linux Kernel Flaw Lets Unprivileged Users Gain Root Access
A new Linux kernel vulnerability, Bad Epoll (CVE-2026-46242), allows unprivileged users to escalate to root, impacting Linux desktops, servers, and Android devices. A patch has already been released.
Unpatched Flaws Found in FatFs Filesystem Affecting Millions of Devices
Security firm runZero disclosed seven vulnerabilities in FatFs, a widely used filesystem library in embedded devices including security cameras and drones. These flaws pose a risk due to FatFs's ubiquity in consumer and industrial firmware.
Critical Oracle E-Business Suite Flaw Now Exploited in Attacks
Attackers have started exploiting a critical CVE-2026-46817 vulnerability in the Oracle E-Business Suite financial application, as reported by Defused. This flaw poses significant risk to enterprises using Oracle EBS.
Critical SimpleHelp Flaw Exploited to Deploy New Djinn Stealer Malware
Hackers are actively exploiting a critical vulnerability in SimpleHelp (CVE-2026-48558) to distribute Djinn Stealer, a new cross-platform information stealer targeting Windows, macOS, and Linux. This campaign represents a novel threat leveraging an undocumented malware strain.
CISA Issues Urgent Patch Deadline for Exploited Cisco Flaw
CISA has set a Sunday deadline for federal agencies to patch a critical vulnerability in Cisco Unified Communications Manager Server actively exploited in attacks. Immediate action is urged to prevent further compromise.
CISA Warns of Actively Exploited Lantronix EDS5000 Critical Flaw
CISA has issued a warning about an actively exploited critical code injection vulnerability, CVE-2025-67038, affecting Lantronix EDS5000 Series devices. Federal agencies are urged to apply patches by June 26, 2026, to prevent potential remote code execution.
CISA warns of critical Ubiquiti flaws exploited in active attacks
CISA has issued a warning about hackers actively exploiting severe vulnerabilities in Ubiquiti UniFi OS and Lantronix serial-to-ethernet servers. These flaws carry a maximum severity rating and pose significant risk to affected organizations.
Mandiant details Cisco SD-WAN zero-day exploitation for root access
Mandiant has exposed how attackers exploited a zero-day CVE-2026-20245 in Cisco Catalyst SD-WAN to create rogue root accounts on devices, raising serious security concerns. This vulnerability enables full control of targeted network appliances, potentially impacting enterprise operations.
Cisco Unified CM SSRF Flaw CVE-2026-20230 Exploited in Attacks
A high-severity Server-Side Request Forgery vulnerability in Cisco Unified Communications Manager Server, tracked as CVE-2026-20230, is actively being exploited in the wild. Security teams should prioritize detection and mitigation to prevent potential compromise.