CVE Index

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Proofpoint documented BlueMoon, an exploit kit that chains two Google Chrome V8 bugs with a Windows ALPC privilege escalation flaw. APT31 fired it first on August 28, 2026, and three more espionage clusters were running

Proofpoint documented BlueMoon, an exploit kit that chains two Google Chrome V8 bugs with a Windows ALPC privilege escalation flaw. APT31 fired it first on August 28, 2026, and three more espionage clusters were running

Proofpoint documented BlueMoon, an exploit kit that chains two Google Chrome V8 bugs with a Windows ALPC privilege escalation flaw. APT31 fired it first on August 28, 2026, and three more espionage clusters were running

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the rend

Proofpoint documented BlueMoon, an exploit kit that chains two Google Chrome V8 bugs with a Windows ALPC privilege escalation flaw. APT31 fired it first on August 28, 2026, and three more espionage clusters were running

Adobe patched a CVSS 10.0 unauthenticated RCE in Adobe Commerce and Magento Open Source that attackers had been exploiting since September 4, 2026. One managed store was compromised 50 minutes after the first confirmed e

Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository

Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository

Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository

Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository

Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository

Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository

A China-nexus actor tracked as Fire Ant moved from VMware hypervisors into Cisco IOS XR routers, TACACS+ servers, and Linux jump hosts. It captured traffic, stole plaintext credentials with a previously undocumented tac_

ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite

ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite

ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite

ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite

ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite

A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store w

A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store w

A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store w

PaperCut confirmed attackers are exploiting an unpatched flaw affecting all versions of PaperCut NG and MF, with confirmed customer compromises already reported. An emergency patch exists only for v25 and v26, and the ve

A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store w

PaperCut confirmed attackers are exploiting an unpatched flaw affecting all versions of PaperCut NG and MF, with confirmed customer compromises already reported. An emergency patch exists only for v25 and v26, and the ve

Vercel patched two critical Next.js bugs on August 25, 2026, both ending in unauthenticated remote code execution. CVE-2026-75604 is a CVSS 9.0 path traversal with no workaround on Windows-hosted servers, and a CVSS 9.5

CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities catalog with a federal patch deadline of August 28, 2026. The CVSS 9.8 flaw lets anyone with repository write access plant a Git hook through Gitea

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Departm

CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline.

CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline.

CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline.

CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline.

A CVSS 9.1 state validation bug in Keycloak

Attackers are chaining CVE-2026-61979 and CVE-2026-15981 in the miniOrange SAML 2.0 Single Sign On plugin for WordPress to forge SAML responses and log in as administrators. Fixes shipped in July, but the vendor advisory

Attackers are chaining CVE-2026-61979 and CVE-2026-15981 in the miniOrange SAML 2.0 Single Sign On plugin for WordPress to forge SAML responses and log in as administrators. Fixes shipped in July, but the vendor advisory

A CVSS 9.1 state validation bug in Keycloak

A CVSS 9.4 code injection in GitLab

A CVSS 9.4 code injection in GitLab

fortitool, an open-source FortiOS firmware decryption tool, documents that the CVE-2019-6693 hardcoded config-backup key stayed live years longer than believed, and publishes the AES-256 key that replaced it in 7.4. Trea

Microsoft confirmed that CVE-2026-69836, a deserialization flaw in Entra ID scoring a perfect 10.0, was exploited in the wild before disclosure. The company says it is fully mitigated and no customer action is required,

Microsoft confirmed that CVE-2026-69836, a deserialization flaw in Entra ID scoring a perfect 10.0, was exploited in the wild before disclosure. The company says it is fully mitigated and no customer action is required,

Check Point Research showed how Microsoft Defender

CERT Polska confirmed active exploitation of CVE-2026-73570, a CVSS 8.9 command injection flaw that gives unauthenticated attackers code execution on Zimbra Collaboration servers running the optional zimbra-snmp package.

CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus

CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus

CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus

CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus

Attackers began scanning for exposed MLflow Tracking Servers within hours of CVE-2026-64849 being assigned on August 17, 2026, and are already pulling cloud credentials out of internal metadata endpoints. A second flaw,

Attackers began scanning for exposed MLflow Tracking Servers within hours of CVE-2026-64849 being assigned on August 17, 2026, and are already pulling cloud credentials out of internal metadata endpoints. A second flaw,

Attackers began scanning for exposed MLflow Tracking Servers within hours of CVE-2026-64849 being assigned on August 17, 2026, and are already pulling cloud credentials out of internal metadata endpoints. A second flaw,

A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA

A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA

A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA

A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA

CERT Polska disclosed that intruders reached a Polish combined heat and power plant over the distribution operator

CERT Polska disclosed that intruders reached a Polish combined heat and power plant over the distribution operator

PortSwigger research presented at Black Hat USA 2026 shows email content escaping its message boundary to hijack the webmail interface itself. Attack chains against Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and

Attackers exploited an unauthenticated SQL injection flaw in Metabase as a zero-day, scoring a maximum CVSS 10.0 and handing them administrator access to business intelligence instances. Six release branches are affected

Attackers exploited an unauthenticated SQL injection flaw in Metabase as a zero-day, scoring a maximum CVSS 10.0 and handing them administrator access to business intelligence instances. Six release branches are affected

KerberLoss hides a duplicate service principal name behind invisible Unicode and breaks Kerberos authentication for any service an attacker picks. ResetNightmare walks a username collision through the Kerberos change-pas

KerberLoss hides a duplicate service principal name behind invisible Unicode and breaks Kerberos authentication for any service an attacker picks. ResetNightmare walks a username collision through the Kerberos change-pas

KerberLoss hides a duplicate service principal name behind invisible Unicode and breaks Kerberos authentication for any service an attacker picks. ResetNightmare walks a username collision through the Kerberos change-pas

Forescout

Attackers bypassed authentication on N-able N-central servers, took administrative control, and pivoted through Take Control into managed customer endpoints. N-able

Attackers appended a clipboard-and-DOM hijacking payload to trackpoint-async.js, a tracking script Adform serves from s2.adform[.]net to customer websites. Anyone who copied or typed a Bitcoin, Ethereum, or Tron address

Cisco confirmed active exploitation of a static-credential flaw in Secure Firewall Management Center that lets unauthenticated attackers log in as a low-privilege user. CISA added CVE-2026-20316 to the KEV catalog on Jul

A maximum-severity OS command injection flaw in on-premises Arista VeloCloud Orchestrator is being exploited in the wild, giving remote attackers privileged access to the orchestrator host. CISA added CVE-2026-16812 to t

A malvertising operation called SourTrade delivers no finished binary over the wire. The browser fetches a clean Bun runtime, then byte-copies attacker-supplied PE structures and bytecode into a unique Windows executable

XBOW found two unauthenticated command-injection bugs in Bing

XBOW found two unauthenticated command-injection bugs in Bing

A critical Fastjson 1.x flaw lets a single unauthenticated JSON request execute code inside Spring Boot fat-JAR applications, and Alibaba has no fixed 1.x release. The chain works without AutoType and without a classpath

Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller

Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller

Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller

Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller

Check Point has patched CVE-2026-16232, a CVSS 9.3 authentication bypass in the SmartConsole login flow that lets unauthenticated attackers mint admin tokens on internet-exposed Management Servers. Exploitation is confir

Check Point has patched CVE-2026-16232, a CVSS 9.3 authentication bypass in the SmartConsole login flow that lets unauthenticated attackers mint admin tokens on internet-exposed Management Servers. Exploitation is confir

Attackers are exploiting CVE-2026-6875, a CVSS 9.5 sandbox escape in the ServiceNow AI Platform that gives unauthenticated remote code execution and full instance compromise. Patches shipped in June; Defused Cyber caught

A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone

A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone

A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone

A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone

Dutch intelligence services AIVD and MIVD say at least one Russian service is systematically hijacking internet-exposed IP cameras across NATO states and Ukraine to watch weapons shipments and troop movements. In Ukraine

Dutch intelligence services AIVD and MIVD say at least one Russian service is systematically hijacking internet-exposed IP cameras across NATO states and Ukraine to watch weapons shipments and troop movements. In Ukraine

CVE-2026-63030,

Okta

Okta

Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident res

Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident res

Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident res

Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident res

Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident res

Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident res

F5 patched a critical NGINX heap overflow in the map/regex path (CVE-2026-42533, CVSS 9.2) and credited about sixteen researchers who each found it independently. That is what open-source review looks like now AI lowered

F5 patched a critical NGINX heap overflow in the map/regex path (CVE-2026-42533, CVSS 9.2) and credited about sixteen researchers who each found it independently. That is what open-source review looks like now AI lowered

SonicWall confirmed active exploitation of two zero-days in SMA 1000 series appliances, including a CVSS 10.0 unauthenticated SSRF and a post-auth code injection flaw that yields admin-level command execution. CISA added

SonicWall confirmed active exploitation of two zero-days in SMA 1000 series appliances, including a CVSS 10.0 unauthenticated SSRF and a post-auth code injection flaw that yields admin-level command execution. CISA added

NSA, FBI, CISA and 15 partner agencies across eight allied nations published joint guidance on Russian FSB Center 16 hackers, tracked as Berserk Bear and Static Tundra, who have been harvesting configs from internet-expo

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA

Progress Software has told every ShareFile customer running a self-hosted Storage Zone Controller to power the servers down over a

New research shows anyone can take a signed Git commit and mint a second copy with identical files, author, and a valid signature, but a different hash, and GitHub still stamps it Verified. Hash-based blocklists, dedup,

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within

BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with eleva

BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with eleva

BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with eleva

BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with eleva

BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with eleva

A use-after-free in Linux KVM

A use-after-free in Linux KVM

A use-after-free in Linux KVM

A use-after-free in Linux KVM

A use-after-free in Linux KVM

A use-after-free race in the Linux epoll subsystem lets any local user reach root roughly 99% of the time, works from inside the Chrome renderer sandbox, and reaches Android. Kernels built on 6.4 or newer are affected un

A use-after-free race in the Linux epoll subsystem lets any local user reach root roughly 99% of the time, works from inside the Chrome renderer sandbox, and reaches Android. Kernels built on 6.4 or newer are affected un

runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code e

runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code e

runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code e

runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code e

runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code e

runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code e

runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code e

A newly documented threat actor, Armored Likho, is hitting government agencies and electric power operators across Russia, Brazil, and Kazakhstan with a Python-based stealer called BusySnake. The campaign blends espionag

CISA added Microsoft SharePoint Server flaw CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The deserialization bug lets any authenticated user with Site Mem

Sysdig says an AI agent executed a full ransomware operation with no human at the keyboard: exploiting a patched Langflow RCE, harvesting credentials, pivoting to a production MySQL/Nacos server, and encrypting 1,342 con

Attackers began probing Progress Kemp LoadMaster load balancers on June 29, 2026, targeting a CVSS 9.6 pre-auth command injection flaw. A public PoC and watchTowr

Attackers began probing Progress Kemp LoadMaster load balancers on June 29, 2026, targeting a CVSS 9.6 pre-auth command injection flaw. A public PoC and watchTowr

Attackers began probing Progress Kemp LoadMaster load balancers on June 29, 2026, targeting a CVSS 9.6 pre-auth command injection flaw. A public PoC and watchTowr

Attackers began probing Progress Kemp LoadMaster load balancers on June 29, 2026, targeting a CVSS 9.6 pre-auth command injection flaw. A public PoC and watchTowr

A CVSS 9.8 flaw in Oracle Payments lets unauthenticated attackers take over Oracle E-Business Suite over HTTP. Honeypots caught live exploitation over the weekend, despite no public PoC. EBS 12.2.3 through 12.2.15 are af

A CVSS 9.8 flaw in Oracle Payments lets unauthenticated attackers take over Oracle E-Business Suite over HTTP. Honeypots caught live exploitation over the weekend, despite no public PoC. EBS 12.2.3 through 12.2.15 are af

An unknown actor exploited Cisco Catalyst SD-WAN as a zero-day for at least two months before disclosure, escalating a compromised admin account to full root on a communications service provider. Mandiant traced a malici

An unknown actor exploited Cisco Catalyst SD-WAN as a zero-day for at least two months before disclosure, escalating a compromised admin account to full root on a communications service provider. Mandiant traced a malici

An unknown actor exploited Cisco Catalyst SD-WAN as a zero-day for at least two months before disclosure, escalating a compromised admin account to full root on a communications service provider. Mandiant traced a malici

An unknown actor exploited Cisco Catalyst SD-WAN as a zero-day for at least two months before disclosure, escalating a compromised admin account to full root on a communications service provider. Mandiant traced a malici

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

Kaspersky

The DPRK

A security firm planted a malicious AI agent skill that passed Cisco

A 29-year-old heap over-read in the Squid web proxy, dubbed Squidbleed (CVE-2026-47729), lets any permitted proxy user leak another user

Paradigm Shift researchers published a working exploit, usbliter8, that achieves arbitrary code execution inside the SecureROM of Apple A12 and A13 chips. Burned into silicon at manufacture, the flaw cannot be patched by

FortiBleed isn

FortiBleed isn

FortiBleed isn

FortiBleed isn

Microsoft researchers detailed AutoJack, an exploit chain that lets a single attacker-controlled web page reach a privileged local service through an AI browsing agent and run arbitrary commands on the host. The flaw liv

Microsoft researchers detailed AutoJack, an exploit chain that lets a single attacker-controlled web page reach a privileged local service through an AI browsing agent and run arbitrary commands on the host. The flaw liv

A flaw in Google Cloud

Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the p

Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the p

Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the p

Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the p

Chinese APT group Velvet Ant compromised the Linux login layer itself, backdooring PAM modules and OpenSSH binaries on air-gapped networks since 2016. Sygnia researchers found nine variants recording credentials where or

University of Toronto researchers built a proof-of-concept AI worm that uses local open-weight LLMs to autonomously reason through networks, generate runtime exploits, and self-replicate, compromising 62% of test hosts w

CVE-2026-50751, a critical logic flaw in Check Point VPN certificate validation, allows unauthenticated attackers to bypass passwords in IKEv1 configurations. Exploitation tied to Qilin ransomware began May 7, targeting

CVE-2026-50751, a critical logic flaw in Check Point VPN certificate validation, allows unauthenticated attackers to bypass passwords in IKEv1 configurations. Exploitation tied to Qilin ransomware began May 7, targeting

A security startup

A security startup

A security startup

A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interac

A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interac

A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interac

A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interac

Russian FSB-linked threat group Gamaredon weaponizes CVE-2025-8088 WinRAR vulnerability to deliver modular malware framework targeting Ukrainian organizations. Attack chain deploys GammaPhish HTML applications, GammaWorm

Russian FSB-linked threat group Gamaredon weaponizes CVE-2025-8088 WinRAR vulnerability to deliver modular malware framework targeting Ukrainian organizations. Attack chain deploys GammaPhish HTML applications, GammaWorm

Russian FSB-linked threat group Gamaredon weaponizes CVE-2025-8088 WinRAR vulnerability to deliver modular malware framework targeting Ukrainian organizations. Attack chain deploys GammaPhish HTML applications, GammaWorm

Palo Alto Networks CVE-2026-0257 authentication bypass vulnerability is being actively exploited in the wild, allowing attackers to establish unauthorized VPN connections. Rapid7 confirms successful exploitation across n

Anthropic

Critical heap buffer overflow in NGINX versions 0.6.27 through 1.30.0 is being actively exploited in the wild. The vulnerability, introduced in 2008, allows unauthenticated attackers to crash worker processes or achieve

Critical heap buffer overflow in NGINX versions 0.6.27 through 1.30.0 is being actively exploited in the wild. The vulnerability, introduced in 2008, allows unauthenticated attackers to crash worker processes or achieve

Critical heap buffer overflow in NGINX versions 0.6.27 through 1.30.0 is being actively exploited in the wild. The vulnerability, introduced in 2008, allows unauthenticated attackers to crash worker processes or achieve

A newly disclosed Windows zero-day vulnerability dubbed MiniPlasma allows unprivileged users to escalate to SYSTEM-level access through a flaw in the Print Spooler service. Proof-of-concept code is now publicly available

CVE-2026-44338, a critical authentication bypass in PraisonAI

Anonymous researcher Chaotic Eclipse disclosed two critical Windows zero-days: YellowKey enables BitLocker bypass through Windows Recovery Environment in minutes, while GreenPlasma allows SYSTEM-level privilege escalatio

Anonymous researcher Chaotic Eclipse disclosed two critical Windows zero-days: YellowKey enables BitLocker bypass through Windows Recovery Environment in minutes, while GreenPlasma allows SYSTEM-level privilege escalatio

TeamPCP threat actors compromised 42 TanStack packages and infiltrated npm/PyPI repositories from Mistral AI, UiPath, OpenSearch, and Guardrails AI using GitHub Actions OIDC token hijacking. The worm produces validly att

A critical out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1) in Ollama enables unauthenticated attackers to exfiltrate entire process memory from over 300,000 servers. Two additional unpatched Windows vulnerabil

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

A critical out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1) in Ollama enables unauthenticated attackers to exfiltrate entire process memory from over 300,000 servers. Two additional unpatched Windows vulnerabil

A critical out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1) in Ollama enables unauthenticated attackers to exfiltrate entire process memory from over 300,000 servers. Two additional unpatched Windows vulnerabil

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affec

New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services

New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services

New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services

New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services

New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services

Microsoft

Microsoft

A use-after-free in Chrome

GRU-affiliated APT28 exploited unpatched TP-Link routers to perform DNS hijacking against NATO members and Ukraine, capturing M365 credentials via adversary-in-the-middle infrastructure.