Vulnerebility Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME |
Info | CATEG. |
WEB |
|
13.10.26 |
CVE-2026-102255: Critical SonicWall SMA1000 SSRF | SonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances. | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
CVE-2026-85097: Bricksforge Flaw Exploited for Unauthenticated RCE | Threat actors are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in the Bricksforge plugin for WordPress. The flaw lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites, resulting in remote code execution (RCE). | Vulnerebility blog | SOCRADAR |
|
10.10.26 |
Why API Security Belongs in ECB Cyber Action Plans | An undocumented partner endpoint or an outdated mobile-banking API can expose customer information even after newer services receive stronger protections. As AI accelerates vulnerability discovery and exploitation, banks need a clearer view of these gaps and a practical way to reduce them. | Vulnerebility blog | Akamai |
|
10.10.26 |
CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. | Vulnerebility blog | Akamai |
|
10.10.26 |
Upcoming Next.js Security Update for Upstream Vulnerabilities | Next Wednesday, October 14, 2026, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination. | Vulnerebility blog | Next.js |
|
10.10.26 |
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. | Vulnerebility blog | Huntress |
|
10.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). | Vulnerebility blog | SOPHOS |
|
10.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | Seqrite |
|
10.10.26 |
CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | MLflow is one of the most widely deployed open-source platforms for managing the machine learning lifecycle, from experiment tracking and model versioning to deployment and registry management. | Vulnerebility blog | SonicWall |
|
10.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Adobe Commerce and Magento StyleSmuggler RCE - CVE-2026-75650 | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-75650, assessed its impact, and developed mitigation measures. The flaw, also known as StyleSmuggler, is a critical vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It lets an unauthenticated attacker run arbitrary code on a store by smuggling a template directive through the styles parameters of the storefront API. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
10.10.26 |
Microsoft, Adobe, Apple, and Foxit vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. | Vulnerebility blog | CISCO TALOS |
|
10.10.26 |
Windows Exploitation Techniques: Dangling COM Object Registrations | This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. | Vulnerebility blog | PROJECT ZERO |
|
7.10.26 |
CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters | As early as the beginning of September 2026, eSentire's Threat Response Unit (TRU) observed multiple threat actor clusters exploiting CVE-2026-88771, a zero-day vulnerability later disclosed in Citrix's September 27, 2026 security bulletin CTX697096. | Vulnerebility blog | eSentire |
|
6.10.26 |
CVE-2026-90970: GitLab AI Gateway RCE | GitLab has patched CVE-2026-90970, a critical vulnerability in the Self-Hosted AI Gateway that can allow an authenticated user with Duo Agent Platform access to execute arbitrary commands on the gateway. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Introducing the SysQL Skill: Ask your security graph anything | Dashboards answer the questions someone already decided to build a screen for. Every other question — the one a new CVE just made urgent, or the one no vendor anticipated — waits until someone writes a report or files a ticket. | Vulnerebility blog | Sysdig |
|
3.10.26 |
Separating Signal from Slop: Triaging CVEs in the Age of… | Tools that can read a codebase, identify a vulnerability, and generate a working proof-of-concept have lowered the skill floor for vulnerability research. They also produce a wave of bugs that look terrifying on paper (remote code execution, popular software, no authentication,) yet they often depend on a configuration rarely enabled in real deployments. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
One Port to Root: Weaponizing Check Point Management… | The Check Point management server is the brain of a Check Point firewall estate: it holds the policy every gateway enforces, the administrator credentials, and the certificate authority the whole deployment trusts. A flaw already used in real attacks lets anyone who can reach that server take it over completely without logging in. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
CVE-2026-86950: The Great Glyph Grift | Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics (CVE-2026-86950). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was actually exploited in the wild. | Vulnerebility blog | Calif |
|
3.10.26 |
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators | CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Citrix and security researchers have already documented the vulnerability and its underlying exploitation mechanism. This analysis focuses instead on exploitation activity identified by LevelBlue's Threat Hunt Operations & Research (THOR) team while hunting across multiple customer environments. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler Zero-Day Exploited Globally | On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities (KEV) list. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Hackers exploit FortiMail zero-day before a patch exists | Fortinet says attackers are already exploiting a critical flaw in FortiMail, its email security gateway, and the fixed software has not shipped yet. The bug, tracked as CVE-2026-104286 and rated 9.8 on CVSS v3, lets an attacker with no login write arbitrary files to the appliance using crafted HTTP or HTTPS requests. Fortinet rates its impact as executing unauthorized code or commands. | Vulnerebility blog | IntelFusions |
|
3.10.26 |
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) | On Wednesday, September 30, Cisco dropped an out-of-band security advisory highlighting CVE-2026-76504, a brand new critical authentication bypass in the SD-WAN vManage line of products that was disclosed as an exploited zero-day vulnerability. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
JCTables for Joomla: When "Already Escaped" Means Injectable | Today VulnCheck is disclosing CVE-2026-76570, an unauthenticated arbitrary SQL read and write in JCTables, the Joomla data-table component published by JoomCode, that chains to remote code execution as the web user. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
CVE-2026-86950: Apple CoreGraphics Zero-Day | Apple has issued an urgent security patch for CVE-2026-86950, a critical zero-day out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution via malicious files. Exploited in targeted, highly sophisticated attacks against specific individuals, this flaw presents an immediate threat across affected Apple platforms. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
CVE-2026-76504: Cisco SD-WAN Flaw Exploited | Cisco has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, formerly known as vManage. The flaw allows an unauthenticated remote attacker to access the management API with administrator privileges. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
TeamViewer Fixes Five Remote Access Flaws | TeamViewer has patched five high-severity vulnerabilities in its Full Client and Host applications for Windows, Linux, and macOS. The flaws include local privilege escalation, potential code execution, and remote session access control bypass. The company strongly recommends that all users update to the latest available version as soon as possible. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation | On September 27, 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two of these vulnerabilities are critical (CVSS score of 9.5) and can allow an unauthenticated remote attacker to execute code: | Vulnerebility blog | SOPHOS |
|
3.10.26 |
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 | Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring authentication or user interaction. | Vulnerebility blog | Microsoft blog |
|
3.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
3.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
3.10.26 |
Trust and the enticing consultancy offer | In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by those who require our services, but also by threat actors. | Vulnerebility blog | CISCO TALOS |
|
30.9.26 |
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | On August 31, 2026, eSentire's Threat Response Unit (TRU) detected exploitation of zero-day vulnerabilities disclosed in our security advisory, PaperCut Discloses Zero-Day Vulnerabilities (CVE-2026-82078 and CVE-2026-81578), published on September 3, 2026 affecting a customer in the Education industry. | Vulnerebility blog | eSentire |
|
30.9.26 |
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) | NetScaler, from Citrix (now under Cloud Software Group), is an application delivery controller - some believe it qualifies to be described as a security appliance. | Vulnerebility blog | LABS WATCHTOWR |
|
29.9.26 |
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772 | Citrix has released emergency security updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two critical zero-days already exploited in the wild. | Vulnerebility blog | SOCRADAR |
|
29.9.26 |
Citrix NetScaler Zero-Day RCE vulnerabilities: FAQ | CVE-2026-88771 and CVE-2026-88772, two zero-day vulnerabilities in Citrix NetScaler, have been confirmed as exploited in the wild. Citrix released patches on September 27, 2026. | Vulnerebility blog | TENABLE |
|
29.9.26 |
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability | The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a web shell; in the second incident, the attacker ran a scanner tool to search for additional Attack Targets. | Vulnerebility blog | ASEC |
|
27.9.26 |
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites | This blog post is about a Cross-Site Request Forgery vulnerability in the Elementor Website Builder plugin. One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform. On a stock installation, an administrator clicking the link creates a second administrator account for the attacker. | Vulnerebility blog | Patchstack |
|
26.9.26 |
MCP Config Poisoning: Text file to RCE | Attackers can weaponize your AI agent tooling just by sneaking a text file into the right place on your system, putting developers and other users at risk. Learn how this works and how to protect yourself and your organization. | Vulnerebility blog | Checkmarx Zero |
|
26.9.26 |
Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core | WordPress 7.1.1 fixes CVE-2026-93485, an unauthenticated stored XSS in wpautop(). The fix was backported to every supported branch from 4.7 onward, so a site below its own branch's patched version is still affected. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
PCI DSS Gap: Relying on SAQ A Changes Exposes E-commerce | Cyberattacks targeting e-commerce payment flows continue to escalate, exposing a critical flaw in how online retailers manage client-side security. Ongoing Magecart campaigns are abusing dynamic hosting, ranging from decentralized blockchain infrastructure to trusted third-party platforms, to inject stealthy skimming code across payment networks. | Vulnerebility blog | JSCRAMBLE |
|
26.9.26 |
The Major Shift in Security Vulnerability Management | Security vulnerabilities use a numbering system called CVE (Common Vulnerabilities and Exposures). The CVE number itself is an identifier that distinguishes vulnerabilities. For example, a number like 'CVE-2026-12345' refers to the exact same vulnerability anywhere in the world. | Vulnerebility blog | Enki White Hat |
|
26.9.26 |
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers | On September 4, 2026, Oren Yomtov, a security researcher from Accomplish, responsibly reported a vulnerability affecting Cloudflare Containers and Cloudflare Sandboxes (which is built on Containers), through Cloudflare’s bug bounty program. Cloudflare has fully remediated the vulnerability, and we have no evidence that customer data has been compromised. | Vulnerebility blog | Cloudflare Blog |
|
26.9.26 |
CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack | CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. Exploitation requires network access to a virtual server configured with an APM access policy and an OAuth profile, with APM operating as an OAuth Authorization Server. | Vulnerebility blog | PICUSSECURITY |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE | Back in early August 2026, I was 0-day bug hunting in Cisco Smart Software Manager (CSSM). This was where I came across a post-auth RCE vulnerability. This vulnerability, located in the nginx certificate upload, involved command injection via TLS certificates. Unfortunately, a week before I finished the report, the vulnerability was silently patched in their 10-202608 upgrade uploaded on 10 Aug 2026. This short blog will detail the exploit, along with how it got patched. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Shopware fixes Store API vulnerability allowing administrator takeover | A Shopware vulnerability can lead to administrator takeover and remote code execution. Shopware merchants should install the security update now. | Vulnerebility blog | Sansec |
|
26.9.26 |
Upcoming Next.js September Security Release | Next.js is preparing a scheduled security release for September 30, 2026. This advance notice gives teams time to plan upgrades before patches are published. | Vulnerebility blog | Next.js |
|
26.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
26.9.26 |
Trust and the enticing consultancy offer | In this week’s newsletter Martin muses over a very suspicious elicitation over social media and the true value of trust within the cyber ecosystem. Hubris might be the real vulnerability that the cyber industry must worry about. | Vulnerebility blog | CISCO TALOS |
|
24.9.26 |
CVE-2026-76461 | Learn about CVE-2026-76461, an actively exploited Cisco Secure Email Gateway vulnerability that enables unauthenticated remote code execution and full system compromise through a malicious email. | Vulnerebility blog | Arctic Wolf |
|
24.9.26 |
CVE-2026-87902 in WordPress Enables Conditional RCE | Security updates released for WordPress address CVE-2026-87902, a severe unauthenticated path traversal flaw within its page-template resolution mechanism. The weakness allows the CMS to load arbitrary readable PHP files outside designated theme directories, potentially resulting in Remote Code Execution (RCE) under tailored server and theme setups. | Vulnerebility blog | SOCRADAR |
|
23.9.26 |
Virtualizor: The Login Parameter That Skips the Login | Today VulnCheck's Initial Access Intelligence team is detailing an unauthenticated remote root code execution in Virtualizor, Softaculous' commercial VPS and hypervisor control panel. It provisions and manages KVM/OpenVZ/LXC guests, so its web layer runs as root, which is exactly why a web bug here ends at uid=0 instead of www-data. | Vulnerebility blog | VULNCHECK |
|
22.9.26 |
Click2Shell: WordPress Flaw Enables RCE Chain | Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator’s browser to be manipulated into installing and previewing a theme without explicit consent. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-76460: Cisco ISE Flaw Actively Exploited | CVE-2026-76460 represents a critical security flaw in Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Because the vulnerability bypasses authentication without requiring user interaction, it opens the door to severe compromise across affected network infrastructure. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-91843: Check Point Root RCE | Check Point has patched CVE-2026-91843, a critical stack-based buffer overflow flaw in the login process of its Security Management and Log Server products. If exploited, an unauthenticated remote attacker could execute arbitrary code with root privileges. | Vulnerebility blog | SOCRADAR |
|
18.9.26 |
What is Style Smuggler (CVE-2026-75650)? | Sansec discovered the vulnerability in Adobe Commerce & Magento and found it being exploited in the wild prior to patches being released, as early as September 4th, 2026 | Vulnerebility blog | Fastly |
|
18.9.26 |
How Cobalt Brings Real-Time Exploit and Threat Intelligence to Vulnerability Findings | Common Vulnerabilities and Exposures (CVE) identify known vulnerabilities in specific components. They don't confirm whether you're exposed or whether attackers are actively exploiting a vulnerability. The additional context from adding reliable threat intelligence and known CVE information to your pentest findings can make the difference between wasting time on research and triage and quickly identifying pressing risks that your business needs to address. | Vulnerebility blog | COBALT.IO |
|
18.9.26 |
CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | We have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability. | Vulnerebility blog | AKAMAI |
|
18.9.26 |
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild | On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions. | Vulnerebility blog | RAPID7 |
|
18.9.26 |
CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild | On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance. | Vulnerebility blog | RAPID7 |
|
18.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
18.9.26 |
PaperCut NG/MF Unauthenticated Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threats CVE-2026-81578 and CVE-2026-82078, assessed their impact, and developed mitigation measures. Chained together, these two flaws in PaperCut NG and PaperCut MF, a widely deployed print management platform, give an unauthenticated remote attacker code execution on the Application Server. | Vulnerebility blog | SonicWall |
|
17.9.26 |
ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell | Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. | Vulnerebility blog | JFROG |
|
15.9.26 |
GitLab CVE-2026-85706 Added to CISA KEV | CVE-2026-85706 represents a severe path traversal flaw in GitLab CE and EE, permitting unauthenticated remote actors to retrieve arbitrary files from affected self-managed deployments. Following GitLab’s patch release on September 10, 2026, CISA incorporated the security issue into its KEV catalog the next day. | Vulnerebility blog | SOCRADAR |
|
15.9.26 |
Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676 | A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, three bytes of length. `SslClientHelloHandler` has to read both before it knows how much ClientHello to expect, and the standard permits a handshake message to be split across several records, so it must be prepared for the header to arrive incomplete. | Vulnerebility blog | OX SECURITY |
|
12.9.26 |
ShieldCrash PoC: Microsoft Defender Fix Bypass | Microsoft recently fixed CVE-2026-69414 (ShieldBreak), a High-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Cisco FMC CVE-2026-20079 Actively Exploited | Cisco has confirmed active exploitation of CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) with a maximum CVSS score of 10.0. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) | Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild | Vulnerebility blog | TENABLE |
|
12.9.26 |
FileRun: Four More Ways to Run Your Files | Today VulnCheck is disclosing four vulnerabilities in FileRun, the self-hosted file manager and sharing platform. They are being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy, and all four were allocated through the VulnCheck CNA. Each one ends in remote code execution as the web-server user: | Vulnerebility blog | VULNCHECK |
|
12.9.26 |
CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox | OX Research found and disclosed a critical vulnerability in DeepSeek Harness, DeepSeek’s open-source AI coding-agent harness, that allowed a sandboxed AI agent to disable its own confinement with a single shell command – on shipped defaults, with no network exposure and no credentials. | Vulnerebility blog | OX SECURITY |
|
12.9.26 |
Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source | TL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. | Vulnerebility blog | IMPERVA |
|
12.9.26 |
UK Council Attack Linked to SonicWall SMA 1000 Campaign | Disclosure note: Hunt.io notified the UK National Cyber Security Centre (NCSC) and other relevant national CERTs ahead of publication, so that affected organisations identified during the research could be contacted. | Vulnerebility blog | HUNT.IO |
|
12.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
12.9.26 |
This SonicWall bug is 2 years old. Akira ransomware is still exploiting it. | The Akira ransomware gang is still breaking into networks through a firewall bug SonicWall fixed two years ago. The critical vulnerability, CVE-2024-40766, carries a CVSS score of 9.3 out of 10. | Vulnerebility blog | THREATDOWN |
|
12.9.26 |
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." | Vulnerebility blog | CISCO TALOS |
|
11.9.26 |
DCOM Service PsmServiceExtHost LPE - SSD Secure Disclosure | Threre is a heap buffer overflow vulnerability in a DCOM service that can be leveraged to achieve LPE from a Medium IL standard user to System IL. | Vulnerebility blog | SSD-DISCLOSURE |
|
10.9.26 |
September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days | Microsoft’s September 2026 Patch Tuesday release addresses 974 vulnerabilities, including two actively exploited zero-days. Both zero-days are Windows elevation of privilege flaws, and both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access | SOCRadar Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database sale, an alleged Vedicline customer database sale, and a claimed Langflow 1.12.0 zero-day RCE exploit. Other posts advertised an alleged ASUS database and shell access to an Indian energy sector organization. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT | One of the most common entry points for attackers is the exploitation of public-facing edge devices (such as VPNs, routers, and firewalls). Over the years, FortiGate firewalls have remained a consistent target, as evidenced by the recent widespread FortiBleed campaign conducted jointly by the INC and Lynx ransomware groups. | Vulnerebility blog | SOCRADAR |
|
9.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
7.9.26 |
N-able N-central HF4 Patches Critical Pre-Auth RCE | N-able has released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to fix CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in its remote monitoring and management platform. The update supersedes three hotfixes issued between August 2 and September 5 and is the current security baseline for the 2026.3 branch. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-73749: HPE ArubaOS-CX RCE | HPE patched CVE-2026-73749, a critical unauthenticated Remote Code Execution (RCE) vulnerability in HPE Aruba Networking AOS-CX, also known as ArubaOS-CX. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-20212: Cisco Nexus 9000 RCE Flaw | Cisco has disclosed a critical vulnerability, CVE-2026-20212, in the Silicon One integration used by certain Nexus 9000 switches. The flaw allows an unauthenticated remote attacker who can access the affected service to execute code with root privileges. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
Elementor Pro RCE Flaw Under Active Attack | A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload files through the plugin’s Forms module. Tracked as CVE-2026-32475, the flaw could lead to remote code execution on affected sites. Wordfence reported blocked exploitation attempts beginning August 19, 2026, the same day Elementor released a fix. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
Video encoders can be rooted and no patch is coming | Taking over a QVidium Opera11 video encoder takes one web request, and there is nobody left to ship a fix. The company that built the devices has gone out of business. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
ServiceNow flaws let strangers run code on an instance | ServiceNow has fixed four security flaws in the platform many large organizations use to run their IT service desks, and its own security team scored every one of them at the top of the scale: CVSS 10.0. Three of the four can be reached by someone with no account and no password at all. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models | Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? | Vulnerebility blog | CLOUDFLARE |
|
5.9.26 |
Contagious Interview steps outside the developer workflow | Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. | Vulnerebility blog | JAMF |
|
5.9.26 |
SonicWall CVE-2026-83548 Leads to CISA Alert | SonicWall disclosed two actively exploited vulnerabilities in SMA1000 Series appliances: CVE-2026-83548, a pre-authentication server-side request forgery flaw, and CVE-2026-83549, a post-authentication OS command injection flaw. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
JFrog Artifactory CVE-2026-82329 Exploited | A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329, is under active exploitation, posing an immediate threat to self-managed software supply chains worldwide. Under default configurations, unauthenticated network attackers can gain full administrative control over exposed instances. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
FalconFlank: CrowdStrike Falcon 0-Day PoC | FalconFlank is an alleged privilege escalation zero-day vulnerability in CrowdStrike Falcon Sensor for Windows, published with working Proof-of-Concept (PoC) code by researcher Chaotic Eclipse. The concern: a security product running with elevated privileges may be tricked, through its own malicious-macro remediation workflow, into acting on an attacker’s behalf. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
One Blank Field Bypasses Direct Send Control | This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest’s own environment. Nothing in this report should be read as a vulnerability in ReliaQuest’s systems or data. | Vulnerebility blog | RELIAQUEST |
|
5.9.26 |
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help | Microsoft's August 2026 Patch Tuesday included a fix for CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The severity has a CVSS score of 8.0 from Microsoft. | Vulnerebility blog | Zscaler |
|
5.9.26 |
Oracle HTTP & WebLogic Servers Proxy Plug-in Authentication Bypass | The SonicWall Capture Labs threat research team became aware of an unauthenticated authentication bypass vulnerability in Oracle HTTP & WebLogic Servers, assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
|
5.9.26 |
The Bug Report – August 2026 Edition | This blog will walk through the complete kill chain: an attacker enumerates domain-wide SPNs, identifies a vulnerable user account, and silently requests a Kerberos Ticket Granting Service (TGS) ticket encrypted with the weak RC4-HMAC algorithm. | Vulnerebility blog | TRELLIX |
|
3.9.26 |
Langflow and Rails Exploitation Raises Credential Risks | Attackers are exploiting two separate critical vulnerabilities affecting Langflow and Ruby on Rails. CVE-2026-0768 allows unauthenticated attackers to execute Python code on affected Langflow deployments, while CVE-2026-66066 can expose files and application secrets through Rails Active Storage. | Vulnerebility blog | SOCRADAR |
|
31.8.26 |
ServiceNow Patches Multiple CVSS 10.0 Flaws | ServiceNow disclosed four vulnerabilities affecting its AI Platform and related Now Platform components on August 27, 2026. Three received vendor-assigned CVSS v4.0 scores of 10.0, while a fourth was rated 8.7 High. | Vulnerebility blog | |
|
31.8.26 |
PaperCut RCE Chain: CVE-2026-82078 Exploited | PaperCut disclosed two vulnerabilities in PaperCut NG and PaperCut MF that can be chained into a pre-authentication Remote Code Execution (RCE) path against vulnerable Application Servers. | Vulnerebility blog | SOCRADAR |
|
29.8.26 |
The August 2026 security release is now available. Upgrade to 16.3.3 (Active LTS) or 15.5.24 (Maintenance LTS) now to address two Critical severity vulnerabilities. |
|||
|
29.8.26 |
Next.js is moving the August security release forward to August 25, 2026. |
|||
|
29.8.26 |
A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream. |
|||
|
29.8.26 |
On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. |
|||
|
29.8.26 |
A critical vulnerability chain tracked as CVE-2026-18431 affects the Avada WordPress theme and its required Fusion Builder plugin, now branded as Avada Builder. The flaw carries a CVSS score of 9.8 and can allow an unauthenticated attacker to write and execute arbitrary PHP files, potentially leading to complete site compromise. |
|||
|
29.8.26 |
Cisco released security updates for Cisco Crosswork and Cisco Secure Workload, addressing nine vulnerabilities across the two product families. |
|||
|
29.8.26 |
GitLab has patched CVE-2026-19478, a critical code injection vulnerability affecting self-managed Community Edition (CE) and Enterprise Edition (EE) instances. Under certain conditions, an unauthenticated remote attacker could leverage a GraphQL directive to modify or delete public projects and user data. |
|||
|
29.8.26 |
Microsoft recently disclosed CVE-2026-69836, a critical Remote Code Execution (RCE) vulnerability in Microsoft Entra ID (formerly Azure Active Directory). Because this issue affected a Microsoft-hosted cloud service, remediation was applied on the backend rather than through a traditional customer patch. |
|||
|
29.8.26 |
What CISA's FY2024-2025 Vulnerability Review Means for Runtime Security |
CISA's new Vulnerability Review for Fiscal Years 2024 and 2025 opens by correcting a widely held assumption. Cybersecurity conversations naturally gravitate toward nation-state adversaries and novel zero-days, but most compromises have not relied on advanced techniques. |
||
| 29.8.26 | Not another Log4Shell: inside the Log4j 2 deserialization allowlist bypass | We reproduced this java deserialization vulnerability against official Log4j 2.26.1 JARs. Getting to command execution took two more things that Log4j itself does not ship. Here is how the bypass works, which versions carry it, and what to hunt for. | Vulnerebility blog | ELASTIC |
| 27.8.26 | Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain | Blog | VulnCheck | VulnCheck’s Initial Access Intelligence team shipped an exploit last week chaining two recently disclosed Microsoft SharePoint CVEs that, when used together, allow a remote unauthenticated adversary to bypass authentication and execute code on vulnerable target SharePoint servers. | Vulnerebility blog | VULNCHECK |
| 27.8.26 | Tenable & SentinelOne: 93 CVEs Expose Edge Risk | Tenable® | A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication. | Vulnerebility blog | TENABLE |
| 22.8.26 | CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway | On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges. | Vulnerebility blog | RAPID7 |
|
22.8.26 |
Critical infrastructure security Is back in the headlines | Recent cyber threats affecting water infrastructure and industrial control systems have renewed attention on the cybersecurity challenges facing critical infrastructure across the United States. This article examines emerging risks to water utilities, proposed legislation aimed at improving resilience and the ongoing debate over how critical infrastructure security should be funded and managed. | Vulnerebility blog | BARRACUDA |
| 22.8.26 | Threat Spotlight: The average web application has 20 security vulnerabilities | Barracuda research finds the average web application has 20 security vulnerabilities. Learn the seven most common flaw types and how to reduce risk. | Vulnerebility blog | BARRACUDA |
|
22.8.26 |
CVE-2026-19490: NetScaler Auth Bypass Patched | CVE-2026-19490: NetScaler Auth Bypass Patched Cloud Software Group released a critical security bulletin for customer-managed NetScaler ADC and NetScaler Gateway deployments, fixing two vulnerabilitie... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
CVE-2026-69836: Microsoft Entra ID RCE Exploited | CVE-2026-69836: Microsoft Entra ID RCE Exploited Microsoft has disclosed CVE-2026-69836, a maximum-severity Remote Code Execution (RCE) vulnerability in Microsoft Entra ID, the cloud identity and acce... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
Windows IKE CVE-2026-33824 Added to CISA KEV | Windows IKE CVE-2026-33824 Added to CISA KEV Windows IKE CVE-2026-33824 is now in CISA’s Known Exploited Vulnerabilities catalog, giving defenders a short deadline to verify patching and exposure. CIS... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
July 2026: OpenAI Agent Incident, KDDI Breach | July 2026: OpenAI Agent Incident, KDDI Breach July 2026 brought a mix of large scale data exposures, supply chain access risks, credential-driven activity, and a new kind of AI-related incident respon... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
Can NVD Modernization Keep Pace With AI? | Can NVD Modernization Keep Pace With AI? AI can help security teams find vulnerabilities faster. That sounds entirely positive until we consider what happens after those vulnerabilities are found. Eve... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs | Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates. | Vulnerebility blog | TENABLE |
|
22.8.26 |
FileRun: When Your File Manager Runs Your Files | Today VulnCheck is disclosing CVE-2026-14863, an OS command injection to remote code execution in FileRun, a commercial self-hosted file manager. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. FileRun’s thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated. | Vulnerebility blog | VULNCHECK |
|
22.8.26 |
Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive | Two flaws in GitLab’s GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user’s own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. | Vulnerebility blog | OX |
|
22.8.26 |
Critical vm2 Vulnerability Allows Host DNS Hijacking and Information Disclosure | vm2’s sandbox denylist forgot two modules: “os” and “dns.” Under the wildcard config vm2’s own docs recommend, that gap lets sandboxed code read the host process owner’s identity and hijack the host’s DNS with a single call — a change that outlives the sandbox run and never notifies the embedder. Patched in 3.11.6. | Vulnerebility blog | OX |
|
22.8.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
15.8.26 |
NightmareEclipse releases new PoC, ShieldBreak, exploits same weakness as RoguePlanet | NightmareEclipse claims Microsoft did not properly patch RoguePlanet vulnerability | Vulnerebility blog | THREATLOCKER |
|
15.8.26 |
FileRun: When Your File Manager Runs Your Files | Today VulnCheck is disclosing CVE-2026-14863, an OS command injection to remote code execution in FileRun, a commercial self-hosted file manager. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. FileRun’s thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated. | Vulnerebility blog | VULNCHECK |
|
8.8.26 |
XSS2Shell (CVE-2026-64638): Patch WordPress Now | XSS2Shell (CVE-2026-64638): Patch WordPress Now A new WordPress Core vulnerability chain called XSS2Shell turns a login page XSS bug into a much more serious risk for exposed WordPress sites. The issu... | Vulnerebility blog | SOCRADAR |
|
7.8.26 |
CVE-2026-44613: Turning a CSRF into Silent Unauthorized Actions | Apache Zeppelin’s default CORS configuration allowed cross-origin, credentialed, state-changing requests (and accepted text/plain request bodies), letting a remote attacker who lures an authenticated user to a malicious site perform unauthorized actions through Zeppelin’s REST and WebSocket endpoints. | Vulnerebility blog | OX |
|
8.8.26 |
Secure Agent Harness Execution: Preventing Escape | CrowdStrike uses a defense-in-depth architecture, consisting of seven independent control layers, to prevent autonomous AI agents from taking unintended actions. | Vulnerebility blog | CROWDSTRIKE |
|
8.8.26 |
N-able N-central exploitation results in RMM tool deployment | After compromising systems via CVE-2026-18577, threat actors use the additional RMM tools and network tunnels to establish persistent remote access | Vulnerebility blog | SOPHOS |
|
1.8.26 |
Apple Libnotify/notifyd Stack Overflow (CVE-2026-64739) — Discovered by ThreatBook XGPT | On July 27, 2026, Apple released security updates for iOS 26.6 and iPadOS 26.6, fixing vulnerabilities across several components — Accessibility, Kernel, Libnotify, and WebKit. Among them is CVE-2026-64739, a stack-based buffer overflow in Libnotify/notifyd found and reported to Apple by ThreatBook XGPT. | Vulnerebility blog | THREATBOOK |
|
1.8.26 |
DbGate JSON Script Runner Unauthenticated Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-47668, assessed its impact, and developed mitigation measures. The flaw, also known as the DbGate JSON Script Runner Unauthenticated Remote Code Execution, is a critical vulnerability affecting the DbGate web-based database manager (dbgate/dbgate, distributed on npm as dbgate-serve) in all versions up to and including 7.1.8 | Vulnerebility blog | SonicWall |
|
25.7.26 |
In code we trust? Why the most trusted software receives the least scrutiny. | Recent CVEs across GitHub, Anthropic, Google, dbt, and MISP expose a simple truth: the most trusted code is often the least questioned. As organizations connect AI agents to production systems, those overlooked assumptions can become powerful new attack paths. | Vulnerebility blog | SOPHOS |
|
25.7.26 |
Volume Is Not Risk: Making Sense of the 'Vulnpocalypse' | A briefing for security leaders on separating vulnerability disclosure volume from exploitable risk in 2026. | Vulnerebility blog | Trend Micro |
|
25.7.26 |
Joomla Multiple COM Extensions Unauthenticated File Uploads to RCE | Joomla! Multiple COM_Extensions Unauthenticated File Uploads to RCE | Vulnerebility blog | SonicWall |
|
18.7.26 |
SonicWall SMA1000 vulnerabilities in active exploitation | On July 14, 2026, SonicWall disclosed two vulnerabilities in SonicWall SMA1000 appliances. Models 6210, 7210, and 8200v are affected. | Vulnerebility blog | SOPHOS |
|
18.7.26 |
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy | We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure. | Vulnerebility blog | Palo Alto |
|
18.7.26 |
Begun, the Patch Wars have | Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story. | Vulnerebility blog | CISCO TALOS |
|
18.7.26 |
Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical." | Vulnerebility blog | CISCO TALOS |
|
18.7.26 |
WolfSSL, GeoVision, VTK vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in WolfSSF, fourteen in GeoVision, and one vulnerability in VTK-DICOM. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to | Vulnerebility blog | CISCO TALOS |
| 11.7.26 | rclone Remote-Control API Unauthenticated Command Execution | rclone Remote-Control API Unauthenticated Command Execution (CVE-2026-41179) | Vulnerebility blog | SonicWall |
| 4.7.26 | Joomla Content Editor Remote Code Execution | The SonicWall Capture Labs threat research team became aware of a PHP code upload and execution vulnerability in Joomla products, assessed its impact, and developed mitigation measures. Joomla is a free, open-source Content Management System (CMS) used to build and manage websites and online applications. It serves as a powerful, flexible alternative to platforms like WordPress, offering extensive customization through thousands of extensions and templates. | Vulnerebility blog | SonicWall |
| 27.6.26 | Mythos Finds Vulnerabilities. But Can Anyone Patch Fast Enough? | Security teams are scrambling to reprioritize their security plans based on the revelation of Anthropic’s Mythos model, and its ability to rapidly discover security vulnerabilities. T | Vulnerebility blog | Eclypsium |
| 27.6.26 | CISA BOD 26-04: What it Means and How Eclypsium Can Help | The new CISA BOD 26-04 shifts the focus from simply patching vulnerabilities to actively identifying and replacing internet-facing edge devices that are at or beyond vendor support. | Vulnerebility blog | Eclypsium |
| 27.6.26 | CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | The SonicWall Capture Labs threat research team has identified active exploitation attempts targeting CVE-2025-7544, a critical stack-based buffer overflow vulnerability affecting Tenda AC1206 routers running firmware version 15.03.06.23. | Vulnerebility blog | SonicWall |
| 19.6.26 | No Patch Coming: The Arista EOS Tunnel Bug Your Scanner Will Miss | CVE-2026-7473 allows an attacker to sneak traffic into your network; there is no fix planned, and because the flaw lives in configuration rather than in a version number, your scanner will likely miss it. | Vulnerebility blog | Eclypsium |
| 19.6.26 | File Browser Hook Command Runner OS Command Injection | File Browser Hook Command Runner OS Command Injection (CVE-2026-35585) | Vulnerebility blog | SonicWall |
| 13.6.26 | Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open | Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships. | Vulnerebility blog | Trend Micro |
| 13.6.26 | Microsoft Security Bulletin Coverage for June 2026 | Microsoft’s June 2026 Patch Tuesday has 210 vulnerabilities, of which 67 are Elevation of Privilege. SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of June 2026 and has produced coverage for 14 of the reported vulnerabilities. | Vulnerebility blog | SonicWall |
| 13.6.26 | Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 | Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS® software, which could allow unauthorized attackers to circumvent security controls and initiate VPN connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 29. | Vulnerebility blog | Palo Alto |
| 6.6.26 | NGINX Rift Rewrite Module Remote Code Execution | The SonicWall Capture Labs threat research team became aware of a heap buffer overflow vulnerability in NGINX products, assessed its impact and developed mitigation measures. NGINX is the top web server and reverse proxy globally. | Vulnerebility blog | SonicWall |
| 6.6.26 | Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 | Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. | Vulnerebility blog | Palo Alto |
| 6.6.26 | Less panic patching, more precision | In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter. | Vulnerebility blog | CISCO TALOS |
| 6.6.26 | MediaArea heap-based buffer overflow vulnerabilities | EvidenceForge generates high-quality, realistic, and consistent datasets across multiple log formats, enabling teams to effectively train personnel and validate detection models without the need for complex manual simulations. | Vulnerebility blog | CISCO TALOS |
| 6.6.26 | Lessons for life: Why children’s data is a long-term identity risk | Your child’s first data breach may happen before they’ve even opened a bank account. Here’s how to keep their digital life safe. | Vulnerebility blog | Eset |
| 30.5.26 | H2O-3 Unauthenticated RCE via PostgreSQL JDBC socketFactory | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-3960, assessed its impact, and developed mitigation measures for this vulnerability. The flaw, also known as the H2O-3 ImportSQLTable PostgreSQL JDBC SocketFactory RCE, is a critical remote code execution vulnerability affecting the open-source H2O-3 machine learning platform (h2oai/h2o-3) in all releases up to and including 3.46.0.9 | Vulnerebility blog | SonicWall |
| 30.5.26 | MediaArea heap-based buffer overflow vulnerabilities | Talos researchers find 4 heap-based buffer overflow vulnerabilities in MediaArea's MediaInfoLib. | Vulnerebility blog | CISCO TALOS |
| 16.5.26 | Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for May 2026, which includes 137 vulnerabilities affecting a range of products, including 16 that Microsoft marked as “critical”. | Vulnerebility blog | CISCO TALOS |
| 16.5.26 | On the Effectiveness of Mutational Grammar Fuzzing | Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the samples gets maintained by the mutation process. | Vulnerebility blog | Project Zero |
| 9.5.26 | Pull the Plug: FIRESTARTER Survives Patches, Reboots, and Your Incident Response Plan | You patched your Cisco ASA. You rebooted it. Your vulnerability scanner shows green. You closed the ticket. However, the backdoor is still there! | Vulnerebility blog | Eclypsium |
| 9.5.26 | Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution | On May 6, 2026, Palo Alto Networks released a security advisory for CVE-2026-0300, identifying a buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software. Vulnerable systems allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. | Vulnerebility blog | Palo Alto |
| 9.5.26 | Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years | On April 29, 2026, researchers publicly disclosed a highly reliable local privilege escalation (LPE) vulnerability tracked as CVE-2026-31431. This vulnerability is commonly referred to as Copy Fail. Discovered in about an hour through an AI-assisted process, this logic flaw allows an unprivileged local attacker to consistently escalate their access to root across virtually all major Linux distributions released since 2017. | Vulnerebility blog | Palo Alto |
| 2.5.26 | CISA’s Advisory On Botnets: Why Banning SOHO Routers Won’t Fix Critical Infrastructure Cyber Risk | CISA recently released a new cybersecurity advisory focused on defending against botnets built from compromised consumer and small-office/home-office (SOHO) routers. The advisory highlights how threat actors are actively exploiting vulnerable, internet-exposed devices to build large-scale proxy networks. | Vulnerebility blog | Eclypsium |
| 25.4.26 | The calm before the ransom: What you see is not all there is | A breach claims the systems as well as the confidence that was, in retrospect, a major vulnerability | Vulnerebility blog | Eset |
| 18.4.26 | The Week in Vulnerabilities: Azure AI, Spring AI, Fortinet, and Critical ICS Exposure | Cyble’s weekly vulnerability report tracked 1,431 vulnerabilities and 6 ICS flaws last week. Know more... | Vulnerebility blog | Cyble |
| 18.4.26 | A Deep Dive Into Attempted Exploitation of CVE-2023-33538 | We identified active, automated scans and probes attempting to exploit CVE-2023-33538, a vulnerability in several end-of-life TP-Link Wi-Fi router models: | Vulnerebility blog | Palo Alto |
| 18.4.26 | The Q1 vulnerability pulse | Thor provides an overview of the Q1 2026 vulnerability statistics, highlighting key trends in legacy CVEs and the evolving impact of AI on the threat landscape. | Vulnerebility blog | CISCO TALOS |
| 18.4.26 | Foxit, LibRaw vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed one Foxit Reader vulnerability, and six LibRaw file reader vulnerabilities. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s thir | Vulnerebility blog | CISCO TALOS |
| 11.4.26 | Eclypsium Detects F5 BIG-IP Remote Code Execution Vulnerability (CVE-2025-53521) | A vulnerability in F5 BIG-IP systems that allows unauthenticated remote code execution by attackers has been added to the CISA Known Exploited Vulnerabilities catalog. CVE-2025-53521 was disclosed on October 15, 2025, but only added to the KEV on March 27, 2026. The vulnerability was originally given a severity score of 7.5, but was adjusted upward to 9.8 when new information emerged in March. | Vulnerebility blog | Eclypsium |
| 11.4.26 | The Week in Vulnerabilities: OpenClaw, FreeBSD, F5 BIG-IP, and Critical ICS Bugs | Vulnerabilities in OpenClaw, FreeBSD, F5 BIG-IP, and industrial control systems show risks growing across enterprise and critical infrastructure environments. | Vulnerebility blog | Cyble |
| 11.4.26 | Year in Review: Vulnerabilities old and new and something React2 | The year was characterized by an unending beat-down on infrastructure that relied on older enmeshed dependencies (e.g., Log4j and PHPUnit), while React2Shell rocketed to the highest percentage of attacks for the entire year within the last three weeks of 2025. | Vulnerebility blog | CISCO TALOS |
| 4.4.26 | Eclypsium Detects F5 BIG-IP Remote Code Execution Vulnerability (CVE-2025-53521) | A vulnerability in F5 BIG-IP systems that allows unauthenticated remote code execution by attackers has been added to the CISA Known Exploited Vulnerabilities catalog. CVE-2025-53521 was disclosed on October 15, 2025, but only added to the KEV on March 27, 2026. | Vulnerebility blog | Eclypsium |
| 4.4.26 | Three Decades for a 3-Line Fix: The Critical telnetd Bug Hiding in Plain Sight (CVE-2026-32746) | The SonicWall Capture Labs threat research team became aware of an out-of-bounds write vulnerability in the Telnet server shipped with GNU Inetutils, assessed its impact and developed mitigation measures. Telnetd hardly needs an introduction. It is one of the oldest and most widely distributed network utilities on Linux systems. | Vulnerebility blog | SonicWall |
| 28.3.26 | Juniper JunOS Evolved Pre-authenticated Remote Code Execution (CVE-2026-21902) | The SonicWall Capture Labs threat research team became aware of a severe unauthenticated Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved (PTX Series), assessed their impact, and developed mitigation measures. | Vulnerebility blog | SonicWall |
| 28.3.26 | Three Decades for a 3-Line Fix: The Critical telnetd Bug Hiding in Plain Sight (CVE-2026-32746) | The SonicWall Capture Labs threat research team became aware of an out-of-bounds write vulnerability in the Telnet server shipped with GNU Inetutils, assessed its impact and developed mitigation measures. Telnetd hardly needs an introduction. It is one of the oldest and most widely distributed network utilities on Linux systems. | Vulnerebility blog | SonicWall |
| 28.3.26 | Google Authenticator: The Hidden Mechanisms of Passwordless Authentication | Passwordless authentication is often presented as the end of account takeover. But to understand the real threat landscape, we need to examine how passwordless is actually deployed in the real world. Attackers do not break protocols in theory. | Vulnerebility blog | Palo Alto |
| 28.3.26 | TP-Link, Canva, HikVision vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed a vulnerability in HikVision, as well as 10 in TP-Link, and 19 in Canva. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-p | Vulnerebility blog | CISCO TALOS |
| 21.3.26 | Your KVM is the Weak Link: How $30 Devices Can Own Your Entire Network | 9 vulnerabilities across 4 vendors turn low-cost IP-KVMs into attack platforms | Vulnerebility blog | Eclypsium |
| 21.3.26 | The Week in Vulnerabilities: Juniper, Cisco SD-WAN, and Critical ICS Exposure | Critical Juniper, Cisco SD-WAN, and EV charging infrastructure vulnerabilities surfaced on underground forums, while ICS flaws impacted Energy and Transportation sectors. | Vulnerebility blog | Cyble |
| 21.3.26 | Juniper JunOS Evolved Pre-authenticated Remote Code Execution (CVE-2026-21902) | The SonicWall Capture Labs threat research team became aware of a severe unauthenticated Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved (PTX Series), assessed their impact, and developed mitigation measures. Juniper PTX Series routers are high-performance core and peering routers built for high throughput, low latency, and scale. They are commonly used by internet service providers, telecommunication services, and cloud network applications. | Vulnerebility blog | SonicWall |
| 21.3.26 | A Deep Dive into the GetProcessHandleFromHwnd API | In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. | Vulnerebility blog | PROJECT ZERO |
| 14.3.26 | DirectX, OpenFOAM, Libbiosig vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in the BioSig Project Libbiosig library and OpenCFD OpenFOAM, as well as an unpatched vulnerability in Microsoft DirectX. The vulnerabilities mentioned in this blog post have been patched | Vulnerebility blog | CISCO TALOS |
| 14.3.26 | Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for March 2026 which includes 79 vulnerabilities, including three that Microsoft marked as “critical.” | Vulnerebility blog | CISCO TALOS |
| 7.3.26 | Budibase Cloud View Filter Eval Injection Allows Full Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-27702, assessed its impact, and developed mitigation measures for this vulnerability. CVE-2026-27702, also known as Budibase Cloud View Filter Map Function RCE, is a critical remote code execution vulnerability affecting Budibase in versions prior to 3.30.4. | Vulnerebility blog | SonicWall |
| 7.3.26 | Patch, track, repeat: The 2025 CVE retrospective | Thor analyzes CVE data from 2025 and provides recommendations for where and how organizations should strengthen their defenses. | Vulnerebility blog | CISCO TALOS |
| 28.2.26 | Cisco SD-WAN vulnerabilities (CVE-2026-20127, CVE-2022-20775) in active exploitation | On February 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and UK National Cyber Security Centre warned that vulnerabilities affecting Cisco software-defined wide-area network (SD-WAN) systems (CVE-2026-20127 and CVE-2022-20775) are actively being exploited. | Vulnerebility blog | SOPHOS |
| 28.2.26 | Mandiant and Google Threat Intelligence Group (GTIG) have identified the zero-day exploitation of a high-risk vulnerability in Dell RecoverPoint for Virtual Machines, tracked as CVE-2026-22769, with a CVSSv3.1 score of 10.0 | Vulnerebility blog | GTI | |
| 28.2.26 | The Week in Vulnerabilities: WordPress, BeyondTrust, and Critical ICS Bugs | Critical WordPress, BeyondTrust, Honeywell CCTV, and PUSR router vulnerabilities surfaced on underground forums, while CISA issued 8 ICS advisories impacting critical manufacturing sectors. | Vulnerebility blog | Cyble |
| 28.2.26 | From Token Theft to Full System Takeover: Breaking OpenClaw’s RCE Flaw (CVE-2026-25253) | The SonicWall Capture Labs threat research team became aware of an authentication token theft vulnerability in OpenClaw, assessed its impact and developed mitigation measures. OpenClaw is a widely used open-source AI assistant platform that integrates with numerous messaging services and provides deep system-level capabilities. | Vulnerebility blog | SonicWall |
| 28.2.26 | Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852 | Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. | Vulnerebility blog | CHECKPOINT |
| 28.2.26 | Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 | Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. | Vulnerebility blog | CISCO TALOS |
| 28.2.26 | “Good enough” emulation: Fuzzing a single thread to uncover vulnerabilities | A Talos researcher used targeted emulation of the Socomec DIRIS M-70 gateway’s Modbus thread to uncover six patched vulnerabilities, showcasing efficient tools and methods for IoT security testing. | Vulnerebility blog | CISCO TALOS |
| 21.2.26 | The Week in Vulnerabilities: SolarWinds, Ivanti, and Critical ICS Exposure | Critical SolarWinds, Ivanti EPMM, Microsoft Office, and Siemens ICS vulnerabilities are being discussed on underground forums, while 15 CISA ICS advisories impacted Energy and Critical Manufacturing sectors. | Vulnerebility blog | Cyble |
| 21.2.26 | VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) | On Feb. 6, 2026, BeyondTrust released a security advisory regarding CVE-2026-1731. BeyondTrust is an identity and access management platform. This specific vulnerability involves a pre-authentication remote code execution (RCE) issue within BeyondTrust remote support software. | Vulnerebility blog | Palo Alto |
| 21.2.26 | Critical Vulnerabilities in Ivanti EPMM Exploited | Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) affecting Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild, affecting enterprise mobile fleets and corporate networks. These vulnerabilities allow unauthenticated attackers to remotely execute arbitrary code on target servers, granting them full control over mobile device management (MDM) infrastructure without requiring user interaction or credentials. | Vulnerebility blog | Palo Alto |
| 14.2.26 | The Week in Vulnerabilities: SolarWinds, AI Fixes Urged by Cyble | SolarWinds Web Help Desk and OpenClaw flaws are among the vulnerabilities, drawing significant interest by threat actors. | Vulnerebility blog | Cyble |
| 14.2.26 | The Bug Report - January 2026 Edition | New Year, new exploits! We break down critical January CVEs in Microsoft Office, n8n, and AI tools. Don't let your resolution be a breach—read the report. | Vulnerebility blog | Trelix |
| 7.2.2026 | The Week in Vulnerabilities: Open-Sources Fixes Urged by Cyble | Vulnerabilities affecting n8n, OpenSSL and GNU Inetutils are among the flaws being noticed by threat actors and security researchers alike. | Vulnerebility blog | Cyble |
| 7.2.2026 | Living Off Legit Tools: Stealthy Installation of Remote Monitoring Agents Using SmartScreen Bypass | Recently, the SonicWall Capture Labs threat research team has observed a new campaign delivering batch files leading to unwanted installation of remote connect software like ScreenConnect or Action1 Agent. Once installed, a service is created so, threat actors may get control of the infected system. | Vulnerebility blog | SonicWall |
| 1.2.26 | Microsoft Office vulnerability (CVE-2026-21509) in active exploitation | On January 26, 2026, Microsoft released an out-of-band update to address a high-severity (CVSS score of 7.8) vulnerability affecting multiple Microsoft Office products. This vulnerability, tracked as CVE-2026-21509, is being actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog. | Vulnerebility blog | SOPHOS |
| 1.2.26 | Fortinet Under Fire: Why Your Network Edge Remains Attackers' Favorite Entry Point | Fortinet’s January patch for CVE-2025-59718 didn’t hold. On January 21, FortiGate admins began reporting that patched systems were still being exploited. Two days later, Fortinet confirmed the patch had failed to fully remediate the vulnerability. As reported by BleepingComputer, Fortinet is now recommending that admins restrict administrative access and disable FortiCloud SSO while they work on a follow-up fix. | Vulnerebility blog | Eclypsium |
| 1.2.26 | Fortinet Under Fire: Why Your Network Edge Remains Attackers' Favorite Entry Point | Fortinet’s January patch for CVE-2025-59718 didn’t hold. On January 21, FortiGate admins began reporting that patched systems were still being exploited. Two days later, Fortinet confirmed the patch had failed to fully remediate the vulnerability. As reported by BleepingComputer, Fortinet is now recommending that admins restrict administrative access and disable FortiCloud SSO while they work on a follow-up fix. | Vulnerebility blog | Eclypsium |
| 1.2.26 | The Week in Vulnerabilities: Cyble Urges Oracle, OpenStack Fixes | Oracle, OpenStack, SAP, Salesforce and ServiceNow are among the high-profile enterprise products with vulnerabilities in need of attention by security teams. | Vulnerebility blog | Cyble |
| 1.2.26 | "Ni8mare" - RCE Vulnerability in N8n AI Workflow Automation (CVE-2026-21858) | The SonicWall Capture Labs threat research team became aware of a Critical unauthenticated file read vulnerability in n8n – a flexible AI workflow automation platform, assessed their impact, and developed mitigation measures. | Vulnerebility blog | SonicWall |
| 1.2.26 | Multiple vulnerabilities in SolarWinds Web Help Desk Leading to RCE: CVE-2025-40551 | The SonicWall Capture Labs threat research team became aware of a critical vulnerability chain in SolarWinds Web Help Desk (WHD), assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
| 1.2.26 | Foxit, Epic Games Store, MedDreams vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in Foxit PDF Editor, one in the Epic Games Store, and twenty-one in MedDream PACS.. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, al | Vulnerebility blog | CISCO TALOS |
| 1.2.26 | Microsoft releases update to address zero-day vulnerability in Microsoft Office | Microsoft has published three out-of-band (OOB) updates so far in January 2026. One of these updates was released to address a vulnerability, CVE-2026-21509, affecting Microsoft Office that has been reportedly exploited in the wild. | Vulnerebility blog | CISCO TALOS |
| 1.2.26 | Bypassing Windows Administrator Protection | A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrator privileges only when necessary. | Vulnerebility blog | Project Zero |
| 24.1.26 | Foxit, Epic Games Store, MedDreams vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in Foxit PDF Editor, one in the Epic Games Store, and twenty-one in MedDream PACS.. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, al | Vulnerebility blog | CISCO TALOS |
| 17.1.26 | Executive Summary Check Point Research identified active, large-scale exploitation of CVE-2025-37164, a critical remote code ... | Vulnerebility blog | CHECKPOINT | |
| 17.1.26 | Threat Brief: MongoDB Vulnerability (CVE-2025-14847) | On Dec. 19, 2025, MongoDB publicly disclosed MongoBleed, a security vulnerability (CVE-2025-14847) that allows unauthenticated attackers to leak sensitive heap memory by exploiting a trust issue in how MongoDB Server handles zlib-compressed network messages. This flaw occurs prior to authentication, meaning an attacker only needs network access to the database's default port to trigger it. | Vulnerebility blog | Palo Alto |
| 17.1.26 | Analyzing React2Shell Threat Actors | In this installment of the Sensor Intel Series, we provide an analysis of the most exploited vulnerabilities, highlighting trends and significant activity, with a deep-dive into React2Shell exploitation attempts, methods and tactics. This article focuses on the top 10 CVEs, their rankings, and long-term trends, offering insights into the evolving threat landscape. | Vulnerebility blog | F5 |
| 10.1.26 | The Week in Vulnerabilities: 2026 Starts with 100 PoCs and New Exploits | The year may be a little more than a week old, but threat actors have already amassed nearly 100 Proof of Concepts and newly exploited vulnerabilities. | Vulnerebility blog | |
| 10.1.26 | Singapore Cyber Agency Warns of Critical IBM API Connect Vulnerability (CVE-2025-13915) | A critical authentication bypass flaw, CVE-2025-13915, affects IBM API Connect. Singapore issues alert as IBM releases fixes. | Vulnerebility blog | |
| 10.1.26 | Fortinet Under Fire: Why Your Network Edge Remains Attackers' Favorite Entry Point | CVE-2020-12812, a five-year-old authentication bypass flaw that should have been relegated to history, is being actively exploited. Coming on the heels of two brand-new SAML authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) discovered in late 2025, Fortinet administrators must be on high alert and work to remediate them as quickly as possible, as the trend of network device exploitation is continuing. | Vulnerebility blog | Eclypsium |
| 10.1.26 | MongoBleed MongoDB SBE Use-After-Free (CVE-2025-6706 / CVE-2025-14847) | SonicWall Capture Labs threat research team became aware of the threats CVE-2025-6706 and CVE-2025-14847, assessed their impact, and developed mitigation measures for these vulnerabilities. CVE-2025-6706, also known as MongoDB SBE Use-After-Free, is a critical memory corruption vulnerability affecting MongoDB Server in versions 7.0.0 through 7.0.16. | Vulnerebility blog | SonicWall |