Skip to content
Content Hub • Cybersecurity

Vulnerability Management - Complete Guide

Everything about Vulnerability Management: vulnerability scanning, prioritization, remediation, VM tools, CVSS, vulnerability lifecycle. Expert guides from nFlo.

642 articles 5 categories

Topics in this hub

All Vulnerability Management articles

VM 11/3/2026

CVE-2026-109593: Unauthenticated File Read in SonicWall GMS

VM 11/3/2026

CVE-2026-119977: RCE During WordPress Core Upgrades (CISA KEV)

VM 11/3/2026

CVE-2026-13594: Unauthorized Access in ManageEngine Log360 and EventLog Analyzer

VM 11/3/2026

CVE-2026-28336: Command Injection in SolarWinds Dameware

VM 11/3/2026

CVE-2026-4052: Access Control Flaw in WSO2 API Manager / Identity Server

VM 11/3/2026

CVE-2026-82158: Cross-Site Scripting in Dell Wyse Management Suite

VM 11/3/2026

CVE-2026-95731/95732/95733: Hardcoded Password and RCE in HPE Networking Fabric Composer

VM 10/30/2026

CVE-2026-111357: Privilege Escalation in Ivanti Connect Secure (Exploited)

VM 10/30/2026

CVE-2026-118527: Predictable Identifiers in Ivanti Connect Secure (Exploited)

VM 10/29/2026

CVE-2026-76418: Actively Exploited DoS in Cisco ASA and FTD SSL VPN

VM 10/29/2026

CVE-2026-84295 and 5 More: Critical Flaws in Progress WS_FTP Server

VM 10/29/2026

CVE-2026-97229: Actively Exploited RCE in GitLab CE/EE via CI/CD Regex

VM 10/28/2026

CVE-2026-46300: Actively Exploited Linux Kernel Flaw Chained with PHP2Shell

VM 10/27/2026

CVE-2026-111497 (Node2Shell): Out-of-Bounds Write in Google Brotli Decoder

VM 10/26/2026

CVE-2026-109618 (PHP2Shell): Out-of-Memory Corruption Enables RCE in PHP

VM 10/26/2026

CVE-2026-109619 (PHP2Shell): Use-After-Free via Stale Request State in PHP

VM 10/23/2026

CVE-2026-110447: Actively Exploited RCE in Collabora Online Built-in CODE Server

VM 10/22/2026

CVE-2026-110264: Unauthenticated Remote Code Execution in GitLab CE/EE

VM 10/22/2026

CVE-2026-114625: Privilege Escalation in Arista VeloCloud Orchestrator

VM 10/22/2026

CVE-2026-76299 and CVE-2026-76302: Critical Flaws in Splunk Enterprise

VM 10/22/2026

CVE-2026-76531: Files Accessible to External Parties in Splunk SOAR

VM 10/22/2026

CVE-2026-79867 and 8 More: Critical Flaws in HPE Aruba AOS-8 and AOS-10

VM 10/21/2026

CVE-2026-20043: Out-of-Bounds Write in Cisco Snort 3

VM 10/21/2026

CVE-2026-76466: Remote Command Execution as Root in Cisco Expressway

VM 10/21/2026

CVE-2026-76474 and 2 More: Critical Flaws in Cisco Unified CM and Unity Connection

VM 10/21/2026

CVE-2026-87095: Improper Authorization in Acronis Cyber Infrastructure

VM 10/21/2026

CVE-2026-92559: Credential Exposure in IBM App Connect Enterprise 13

VM 10/10/2026

CVE-2026-108474: SQL Injection in JetBrains Exposed (Kotlin)

VM 10/9/2026

CVE-2026-75875 and 2 More: Critical Flaws in IBM Guardium Data Protection 12

VM 10/9/2026

CVE-2026-96207 and 4 More: Critical Flaws in Microsoft Cloud Services

VM 10/9/2026

Continuous cloud compliance: how do CSPM, PCI DSS and automated remediation replace the once-a-year audit?

VM 10/8/2026

CVE-2026-14269 and 5 More: Critical Flaws in IBM DataPower Gateway

VM 10/7/2026

CVE-2026-59346: VM Escape in VMware Workstation and Fusion

VM 10/7/2026

CVE-2026-76480 and CVE-2026-76483: Critical Flaws in Cisco License On-Prem

VM 10/7/2026

CVE-2026-76485 and 2 More: Remote Code Execution in Cisco NX-OS NGOAM

VM 10/7/2026

CVE-2026-76498, CVE-2026-76499, CVE-2026-76500: Critical Flaws in Cisco APIC

VM 10/6/2026

CVE-2026-63688 and 5 More: Critical Flaws in Dell Container Storage Modules

VM 9/29/2026

CVE-2026-76721 and 4 more: RCE and Auth Bypass in HPE Networking Instant On APs

VM 9/29/2026

CVE-2026-8065: Authentication Bypass in Hitachi Energy RTU500 Firmware Update

VM 9/29/2026

CVE-2026-84436: Command Injection in IBM Guardium Data Protection 12.2

VM 9/29/2026

CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability

VM 9/27/2026

CVE-2026-88771: Unauthenticated Command Execution in Citrix NetScaler

VM 9/27/2026

CVE-2026-88772: Memory Buffer Flaw in Citrix NetScaler ADC and Gateway

VM 9/25/2026

CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability

VM 9/25/2026

CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability

VM 9/25/2026

CVE-2026-93641: Stored XSS via Email in Zimbra Collaboration Suite

VM 9/25/2026

CVE-2026-93643: Unauthenticated RCE in Zimbra via OnlyOffice Integration

VM 9/24/2026

CVE-2026-5430: Critical Flaw in WSO2 API Manager and API Gateways

VM 9/24/2026

CVE-2026-71362: Privilege Escalation in Adobe Commerce and Magento

VM 9/24/2026

CVE-2026-78308, CVE-2026-78312: Auth Bypass and Path Traversal in Delta DIAEnergie

VM 9/24/2026

CVE-2026-93577, CVE-2026-89078: RCE via CI/CD Regex in GitLab CE/EE

VM 9/23/2026

CVE-2026-75884: Privilege Escalation via pod_spec_override in AWX

VM 9/23/2026

CVE-2026-84719: Permission Bypass in Red Hat Ansible Automation Platform

VM 9/22/2026

CVE-2026-85102: VPN Certificate Validation RCE in Check Point Quantum Gateway

VM 9/22/2026

CVE-2026-93616: Path Traversal and RCE in Check Point Management Server

VM 9/22/2026

CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

VM 9/22/2026

CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

VM 9/21/2026

CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

VM 9/18/2026

CVE-2025-39682: Zero-Length Record Handling in the Linux Kernel TLS Receive Path

VM 9/18/2026

CVE-2025-39964: Race Condition on Concurrent AF_ALG Socket Writes in the Linux Kernel

VM 9/18/2026

CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability

VM 9/16/2026

CVE-2026-76460: Management Interface Bypass in Cisco Identity Services Engine

VM 9/14/2026

CVE-2026-76461: SQL Injection in Cisco Secure Email Gateway

VM 9/11/2026

CVE-2026-42016: Privilege Escalation via Token Scope in JFrog Artifactory

VM 9/11/2026

CVE-2026-42018: Anonymous Token Leak in JFrog Artifactory

VM 9/11/2026

CVE-2026-84869: File Transfer and Execution in ConnectWise ScreenConnect Sessions

VM 9/11/2026

CVE-2026-85706: Path Traversal in GitLab Community and Enterprise Edition

VM 9/10/2026

CVE-2026-67277: Missing Authentication in the MikroTik RouterOS btest Service

VM 9/10/2026

CVE-2026-86060: Privilege Escalation via Policy Mask in MikroTik RouterOS

VM 9/10/2026

Penetration test vs vulnerability scan: what really differs

VM 9/9/2026

CVE-2025-25249: Heap Buffer Overflow in FortiOS, FortiSwitchManager and FortiSASE

VM 9/9/2026

CVE-2026-19490: Authentication Bypass in Citrix NetScaler ADC and Gateway

VM 9/9/2026

CVE-2026-20079: Authentication Bypass in Cisco Secure Firewall Management Center

VM 9/9/2026

CVE-2026-87491: Out-of-Bounds Write in the Chromium V8 Engine

VM 9/8/2026

CVE-2026-72982 and 5 Related: Six Critical Flaws in Windows Server Components

VM 9/8/2026

CVE-2026-75650: Critical Adobe Commerce and Magento Flaw — CVSS 10, No User Interaction

VM 9/8/2026

CVE-2026-78509 and CVE-2026-78510: Critical Outlook and Word Flaws — Unauthenticated Code Execution

VM 9/8/2026

CVE-2026-81376: Security Feature Bypass in Visual Studio Code — A Flaw on Developer Workstations

VM 9/8/2026

CVE-2026-81963 and CVE-2026-85880: Two Actively Exploited Windows Privilege Escalation Flaws

VM 9/8/2026

CVE-2026-83941: Missing Authorization in Entra ID — A Flaw You Cannot Patch Yourself

VM 9/8/2026

CVE-2026-86218: Pre-Auth RCE in N-able N-central — A Flaw in the Tool That Manages Other People's Infrastructure

VM 9/4/2026

CVE-2026-85046: Actively Exploited V8 Flaw in Google Chrome

VM 9/2/2026

CVE-2026-19117: authentication bypass via FIDO2 registration in Delinea Secret Server

VM 9/2/2026

CVE-2026-20212: unauthenticated root code execution in Cisco Nexus 9000 switches

VM 9/2/2026

CVE-2026-20274 and CVE-2026-20279: Cisco IOS XR hardening release — no workarounds

VM 9/2/2026

CVE-2026-49869: Authentication Bypass in Kestra OSS — One endsWith and Full RCE as Root

VM 9/2/2026

CVE-2026-59822: Authentication Bypass in LiteLLM — The AI Gateway Let Requests Through Without a Key

VM 9/2/2026

CVE-2026-83548 and CVE-2026-83549: Two SonicWall SMA1000 Flaws — Pre-Auth SSRF and Post-Auth Command Execution

VM 9/2/2026

CVE-2026-84325 and 5 related: critical flaws in Google Chrome 152 — sandbox escape

VM 8/31/2026

CVE-2026-58574: Missing Authentication in Dell PowerStore Management Interface

VM 8/31/2026

CVE-2026-81578: Missing Authentication in PaperCut NG/MF - Active Exploitation (CISA KEV)

VM 8/31/2026

CVE-2026-82078: Actively Exploited Vulnerability in PaperCut NG/MF (CISA KEV)

VM 8/31/2026

CVE-2026-82854: SMTP Command Injection in Nodemailer

VM 8/29/2026

CVE-2026-18527: Privilege Escalation in IBM Administration Runtime Expert for i

VM 8/29/2026

CVE-2026-19295 and CVE-2026-19286: Remote Code Execution in IBM Langflow OSS

VM 8/28/2026

CVE-2026-42007: Use-After-Free in Dovecot via Sieve editheader Extension

VM 8/28/2026

CVE-2026-82266: Redpanda Admin API Treats Unauthenticated Requests as Superuser

VM 8/28/2026

CVE-2026-82277: Argo Rollouts Dashboard Exposes Mutating Operations Without Auth

VM 8/28/2026

CVE-2026-82329: Administrative Takeover in JFrog Artifactory

VM 8/27/2026

CVE-2023-49105: Authentication Bypass in ownCloud Server

VM 8/27/2026

CVE-2026-53362: Privilege Escalation via Linux Kernel IPv6 Subsystem

VM 8/27/2026

CVE-2026-59270: Spring Security Embedded LDAP Binds to All Interfaces

VM 8/27/2026

Linux Kernel: 17 Security Fixes in Networking, Ceph and MPTCP (CVE-2026-74746)

VM 8/27/2026

UniFi OS: 12 Vulnerabilities Including Authentication Bypass (CVE-2026-77550)

VM 8/27/2026

CVE-2026-81934: Use-After-Free in Redis TLS Handling

VM 8/26/2026

CVE-2015-5287: Privilege Escalation in Red Hat ABRT via Symlink Attack

VM 8/26/2026

CVE-2019-1068: Remote Code Execution in Microsoft SQL Server

VM 8/26/2026

CVE-2021-23758: Untrusted Deserialization in Ajax.NET Professional

VM 8/26/2026

CVE-2022-0995: Out-of-Bounds Write in Linux Kernel watch_queue

VM 8/26/2026

CVE-2026-8452: Memory Buffer Overflow in Citrix NetScaler ADC and Gateway

VM 8/25/2026

CVE-2026-49845: SQL injection in Hive Metastore — tampering with Apache Hive warehouse metadata

VM 8/25/2026

CVE-2026-60004: remote code execution in Gitea via the diffpatch endpoint (CISA KEV, due 28 August)

VM 8/25/2026

CVE-2026-63586: unauthenticated root code execution in Weidmüller IE-SR-2TX-WL routers

VM 8/25/2026

CVE-2026-76193, 76195, 76197: three CVSS 10 flaws in Adobe Campaign Classic leading to code execution

VM 8/24/2026

CVE-2026-21962: Oracle HTTP Server and WebLogic Proxy Plug-in takeover (actively exploited, CVSS 10)

VM 8/24/2026

CVE-2026-59568 and CVE-2026-59564: remote code execution and authentication bypass in Zscaler Client Connector

VM 8/24/2026

CVE-2026-76835: authentication bypass in OAuth2 Proxy via the X-Forwarded-Uri header (no patch available)

VM 8/21/2026

CVE-2026-17145 and 12 more: IBM's August bulletin for AIX and PowerVM VIOS

VM 8/21/2026

CVE-2026-69836 and 12 more: Microsoft's August cloud bulletin (Entra ID, Azure, Exchange Online)

VM 8/21/2026

CVE-2026-73570: Remote Code Execution in Zimbra Collaboration Suite

VM 8/20/2026

CVE-2026-11861 and CVE-2026-13097: FreeIPA authentication bypass via Active Directory trust

VM 8/20/2026

CVE-2026-76312: Four Splunk Enterprise flaws — session material exposed via embedded reports

VM 8/19/2026

CVE-2026-16816: Four critical flaws in IBM AIX and PowerVM VIOS

VM 8/19/2026

CVE-2026-20357: Three critical flaws in Cisco Crosswork — hardening release

VM 8/19/2026

CVE-2026-32475: Unrestricted file upload leading to RCE in Elementor Pro

VM 8/19/2026

CVE-2026-64849: Actively exploited SSRF in MLflow (CISA KEV)

VM 8/19/2026

CVE-2026-66794: Authentication bypass in Red Hat Multicluster Engine

VM 8/18/2026

CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability

VM 8/18/2026

CVE-2026-12564: Kubernetes service account token exfiltration from Ansible Automation Platform

VM 8/18/2026

CVE-2026-18963: Account takeover in Keycloak via forced password reset

VM 8/18/2026

CVE-2026-59310: Actively exploited VMware vCenter flaw — CISA deadline August 21

VM 8/18/2026

CVE-2026-65400: macOS Screen Sharing authentication bypass — CISA deadline August 21

VM 8/18/2026

CVE-2026-67271: Remote code execution via SMB in Dell PowerStore

VM 8/18/2026

CVE-2026-73930: Ten critical flaws in Oracle Helidon — August Oracle bulletin

VM 8/17/2026

CVE-2026-19478: Unauthenticated Data Modification in GitLab CE/EE

VM 8/17/2026

CVE-2026-66792: Privilege Escalation in Red Hat ACM (multicloud-operators-subscription)

VM 8/17/2026

CVE-2026-66795: CSR Validation Flaw in Red Hat ACM (managedcluster-import-controller)

VM 8/17/2026

CVE-2026-71472: Command Injection in Red Hat ACM (acm-search-v2)

VM 8/17/2026

CVE-2026-75045: Unauthenticated Database Backup Download in YouTrack

VM 7/24/2026

CVE-2026-50517: deserialization of untrusted data enabling code execution in M365 Copilot (CVSS 9.9)

VM 7/24/2026

CVE-2026-54120: improper input validation enabling code execution in Microsoft Surface (CVSS 9.9)

VM 7/24/2026

CVE-2026-56160: improper authorization in Azure Red Hat OpenShift (ARO) (CVSS 9.1)

VM 7/24/2026

CVE-2026-56163: missing authentication for critical function in Azure Kubernetes Service (CVSS 10.0)

VM 7/24/2026

CVE-2026-56165: heap-based buffer overflow in Microsoft Account (CVSS 9.8)

VM 7/24/2026

CVE-2026-56191: improper authentication enabling tampering in Microsoft Exchange Online (CVSS 10.0)

VM 7/24/2026

CVE-2026-57106: server-side request forgery in Microsoft Data Quality (CVSS 10.0)

VM 7/24/2026

CVE-2026-58275: missing authorization in Azure DNS (CVSS 10.0)

VM 7/24/2026

CVE-2026-58630: improper access control in Azure App Service (CVSS 10.0)

VM 7/24/2026

CVE-2026-62825: improper authentication in Azure Key Vault (CVSS 10.0)

VM 7/24/2026

CVE-2026-62835: improper authorization in Azure Portal (CVSS 9.3)

VM 7/23/2026

CVE-2026-64812: unauthorized input injection in Remote Development in JetBrains IntelliJ IDEA (CVSS 10.0)

VM 7/23/2026

CVE-2026-64813: unauthorized settings modification in Remote Development in JetBrains IntelliJ IDEA (CVSS 10.0)

VM 7/23/2026

CVE-2026-6516: unauthenticated RCE via agent API in ManageEngine ADAudit Plus (CVSS 10.0)

VM 7/23/2026

CVE-2026-65907: In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

VM 7/22/2026

CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability

VM 7/22/2026

CVE-2026-40712: Privilege Escalation in Dell PowerProtect Data Manager

VM 7/22/2026

CVE-2026-46738: Improper Input Validation in Dell PowerProtect Data Manager

VM 7/22/2026

CVE-2026-62144: Auth Bypass in Check Point Security Management

VM 7/21/2026

CVE-2021-27137: 2021 Vulnerability Now Actively Exploited (DD-WRT)

VM 7/21/2026

CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

VM 7/21/2026

CVE-2026-28302: IDOR to RCE via Group Admin in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28304: Remote Code Execution as Root in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28305: IDOR to RCE via Domain Account in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28306: Privilege Escalation to SysAdmin in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28307: Privilege Escalation to Admin Group in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28308: IDOR to RCE via Domain Admin in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28309: Broken Access Control in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28310: User Type Escalation to SysAdmin in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28312: Group Privilege Escalation to Root in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28313: IDOR to SMTP Hijacking Account Takeover in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28314: IDOR to Account Takeover in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28316: IDOR to Root Privilege Escalation in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28317: IDOR to Privilege Escalation in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-28321: Broken Access Control to Root RCE in SolarWinds Serv-U

VM 7/21/2026

CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability

VM 7/21/2026

CVE-2026-64879: command injection in Tenable Security Center (CVSS 9.9)

VM 7/20/2026

CVE-2026-16242: unauthenticated agent access via misconfigured Konnectivity proxy-server

VM 7/18/2026

CVE-2026-47865: authentication bypass granting Avi Control plane access in VMware Avi Load Balancer (CVSS 9.8)

VM 7/17/2026

CVE-2026-15091: cross-site scripting in IBM Engineering AI Hub

VM 7/17/2026

CVE-2026-53412: improper input validation enabling account takeover in Zoom clients for Windows (CVSS 9.8)

VM 7/16/2026

CVE-2026-11386: input validation and injection flaw in Canonical ubuntu-pro-client

VM 7/16/2026

CVE-2026-22752: Authentication Bypass in Spring Authorization Server

VM 7/16/2026

CVE-2026-63087: unauthenticated PluginAuthToken acquisition in Grafana OnCall (CVSS 9.8)

VM 7/15/2026

CVE-2023-4346: 2023 Vulnerability Now Actively Exploited (KNX Association)

VM 7/15/2026

CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability

VM 7/14/2026

CVE-2026-15265: path traversal in Tenable Agent plugin directory

VM 7/14/2026

CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

VM 7/14/2026

CVE-2026-15410: SonicWall SMA1000 Appliances Code Injection Vulnerability

VM 7/14/2026

CVE-2026-27690: HTTP Request Smuggling in SAP Approuter

VM 7/14/2026

CVE-2026-42990: heap-based buffer overflow in SQL Server ODBC driver (CVSS 9.8)

VM 7/14/2026

CVE-2026-44747: memory corruption via logical errors in SAP NetWeaver Application Server ABAP (CVSS 9.9)

VM 7/14/2026

CVE-2026-44761: Sample OAuth2 Credentials in SAP Commerce Cloud

VM 7/14/2026

CVE-2026-48259: SSRF Vulnerability in Adobe Experience Manager

VM 7/14/2026

CVE-2026-48356: Unrestricted File Upload in Adobe Commerce

VM 7/14/2026

CVE-2026-48358: Improper Output Encoding in Adobe Commerce

VM 7/14/2026

CVE-2026-48359: XXE Vulnerability in Adobe Experience Manager

VM 7/14/2026

CVE-2026-48561: improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot (CVSS 9.6)

VM 7/14/2026

CVE-2026-49172: heap-based buffer overflow in Windows FTP Service (CVSS 9.8)

VM 7/14/2026

CVE-2026-49798: use after free in Windows Kernel (CVSS 9.3)

VM 7/14/2026

CVE-2026-50380: Heap Buffer Overflow in Microsoft Windows GDI+ (CVSS 9.6)

VM 7/14/2026

CVE-2026-50447: heap-based buffer overflow in Windows Message Queuing (CVSS 9.8)

VM 7/14/2026

CVE-2026-50518: heap-based buffer overflow in Windows DHCP Server (CVSS 9.8)

VM 7/14/2026

CVE-2026-50522: deserialization of untrusted data in Microsoft Office SharePoint (CVSS 9.8)

VM 7/14/2026

CVE-2026-54990: heap-based buffer overflow in Remote Desktop Client (CVSS 9.8)

VM 7/14/2026

CVE-2026-55008: improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server (CVSS 9.6)

VM 7/14/2026

CVE-2026-55040: weak authentication in Microsoft Office SharePoint (CVSS 9.1)

VM 7/14/2026

CVE-2026-55944: deserialization of untrusted data in Microsoft Dynamics NAV (CVSS 9.8)

VM 7/14/2026

CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

VM 7/14/2026

CVE-2026-56159: heap-based buffer overflow in Windows DHCP Server (CVSS 9.8)

VM 7/14/2026

CVE-2026-56188: race condition enabling code execution in Windows Server Network driver (CVSS 9.8)

VM 7/14/2026

CVE-2026-56190: use of uninitialized resource in Windows RDP (CVSS 9.8)

VM 7/14/2026

CVE-2026-56451: JWT algorithm confusion enabling authentication bypass in Siemens Opcenter X (CVSS 10.0)

VM 7/14/2026

CVE-2026-57092: use after free enabling privilege escalation in Windows VMSwitch (CVSS 9.9)

VM 7/14/2026

CVE-2026-58644: deserialization of untrusted data in Microsoft Office SharePoint (CVSS 9.8)

VM 7/14/2026

CVE-2026-59083: security constraint bypass via URL encoding in Apache Tomcat rewrite valve (CVSS 9.1)

VM 7/14/2026

CVE-2026-59084: insufficient documentation for secure EncryptInterceptor setup in Apache Tomcat (CVSS 9.1)

VM 7/14/2026

CVE-2026-62422: authentication bypass in JetBrains YouTrack (CVSS 10.0)

VM 7/13/2026

CVE-2026-4769: undocumented unauthenticated diagnostic capability during boot in WAGO System I/O Field (CVSS 9.8)

VM 7/10/2026

CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

VM 7/10/2026

CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

VM 7/10/2026

CVE-2026-56688: OS Command Injection in Dell PowerFlex Manager

VM 7/10/2026

CVE-2026-59792: Path Traversal RCE in JetBrains IntelliJ IDEA

VM 7/9/2026

CVE-2026-47646: XSS in Microsoft Dynamics 365 Customer Voice

VM 7/8/2026

CVE-2026-9074: SQL Injection in IBM API Connect

VM 7/7/2026

CVE-2026-33264: unrestricted import_string in Apache Airflow DAG deserialization (CVSS 9.8)

VM 7/7/2026

CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

VM 7/7/2026

CVE-2026-53481: unauthenticated path traversal in Dell PowerProtect Data Domain (CVSS 9.8)

VM 7/7/2026

CVE-2026-53483: improper authentication enabling full system takeover in Dell PowerProtect Data Domain (CVSS 9.8)

VM 7/7/2026

CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

VM 7/7/2026

CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability

VM 7/6/2026

CVE-2026-40047: argument injection in Apache Camel Docling component (CVSS 9.1)

VM 7/6/2026

CVE-2026-48203: header-driven injection and SSRF in Apache Camel Solr component (CVSS 9.1)

VM 7/6/2026

CVE-2026-48204: header-controlled GridFS operation selection in Apache Camel MongoDB GridFS (CVSS 9.8)

VM 7/6/2026

CVE-2026-48205: header-controlled DNS parameters and SSRF in Apache Camel DNS component (CVSS 9.1)

VM 7/3/2026

CVE-2026-41106: url redirection to untrusted site ('open redirect') in M365 Copilot (CVSS 9.3)

VM 7/3/2026

CVE-2026-45499: server-side request forgery in Azure OpenAI (CVSS 9.9)

VM 7/3/2026

CVE-2026-57100: server-side request forgery in Microsoft Entra Provisioning Service (CVSS 9.9)

VM 7/1/2026

CVE-2026-45659: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

VM 6/30/2026

CVE-2026-10109: pre-auth DRDA handshake RCE in IBM Db2 (CVSS 9.8)

VM 6/30/2026

CVE-2026-11708: cross-site scripting in IBM WebSphere Application Server

VM 6/30/2026

CVE-2026-11712: cross-site scripting in IBM WebSphere Application Server

VM 6/30/2026

CVE-2026-48286: incorrect authorization leading to code execution in Adobe Campaign Classic (CVSS 10.0)

VM 6/29/2026

CVE-2026-13762: AWS WAF body inspection bypass via fragmented HTTP/2 in Amazon CloudFront (CVSS 9.8)

VM 6/29/2026

CVE-2026-13763: AWS WAF body inspection bypass via fragmented HTTP/2 in AWS Application Load Balancer (CVSS 9.8)

VM 6/25/2026

CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability

VM 6/25/2026

CVE-2026-41120: acceptance of extraneous untrusted data enabling RCE in Dell Wyse Management Suite (CVSS 9.8)

VM 6/23/2026

CVE-2025-67038: Lantronix EDS5000 Code Injection Vulnerability

VM 6/23/2026

CVE-2026-11374: SSO Token Prediction in ManageEngine ADSelfService Plus

VM 6/23/2026

CVE-2026-11807: missing authorization exposing plaintext credentials in Event-Driven Ansible websocket API (CVSS 9.6)

VM 6/22/2026

CVE-2026-12249: Cleartext HTTP Cert Enrollment in Canonical ADSys

VM 6/22/2026

CVE-2026-28381: Snowflake datasource GET/PUT commands enabling file read/write in Grafana (CVSS 9.6)

VM 6/19/2026

CVE-2026-12048: Stored XSS in pgAdmin 4 Error and Plan Rendering

VM 6/19/2026

CVE-2026-45480: improper authentication allowing privilege elevation in Azure Active Directory (CVSS 10.0)

VM 6/19/2026

CVE-2026-47647: improper access control enabling privilege escalation in Microsoft Dynamics 365 (CVSS 9.9)

VM 6/19/2026

CVE-2026-48582: missing authorization in Microsoft Exchange Online (CVSS 9.6)

VM 6/19/2026

CVE-2026-48584: execution with unnecessary privileges in Azure Synapse (CVSS 9.9)

VM 6/19/2026

CVE-2026-50242: Auth Bypass via Direct DB Access in JetBrains Hub

VM 6/19/2026

CVE-2026-54130: missing authentication for critical function in M365 Copilot (CVSS 9.8)

VM 6/19/2026

CVE-2026-56141: Account Takeover via Predictable Restore Codes in Hub

VM 6/19/2026

CVE-2026-56142: Privilege Escalation in JetBrains Hub

VM 6/17/2026

CVE-2026-20181: Authenticated Command Execution in Cisco ISE

VM 6/17/2026

CVE-2026-20266: OS Command Execution via btool in Splunk AI Toolkit

VM 6/16/2026

CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability

VM 6/15/2026

CVE-2026-54420: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

VM 6/15/2026

CVE-2026-9862: OS command injection in boks_autoregisterd in Fortra Core Privileged Access Manager (CVSS 9.8)

VM 6/10/2026

CVE-2026-20253: unauthenticated arbitrary file write via PostgreSQL sidecar in Splunk Enterprise (CVSS 9.8)

VM 6/10/2026

CVE-2026-53469: Missing Authorization in Red Hat Migration Planner

VM 6/10/2026

CVE-2026-53470: ownership check bypass exposing presigned OVA URLs in migration-planner (CVSS 9.6)

VM 6/10/2026

CVE-2026-53471: missing source_id claim validation collapsing tenant isolation in migration-planner (CVSS 9.6)

VM 6/10/2026

CVE-2026-53474: SQL injection via crafted RVTools spreadsheet in migration-planner (CVSS 9.6)

VM 6/10/2026

CVE-2026-53475: Hardcoded Insecure TLS in Red Hat Assisted Migration Agent

VM 6/10/2026

CVE-2026-53476: path traversal via crafted tarball in assisted-migration-agent (CVSS 9.6)

VM 6/9/2026

CVE-2026-10520: unauthenticated root-level OS command injection in Ivanti Sentry (CVSS 10.0)

VM 6/9/2026

CVE-2026-10523: authentication bypass allowing admin account creation in Ivanti Sentry (CVSS 9.9)

VM 6/9/2026

CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

VM 6/9/2026

CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

VM 6/9/2026

CVE-2026-25089: unauthenticated OS command injection in Fortinet FortiSandbox (CVSS 9.8)

VM 6/9/2026

CVE-2026-27671: memory corruption via crafted RFC request in SAP Kernel (CVSS 9.8)

VM 6/9/2026

CVE-2026-34691: Stored XSS in Adobe Experience Manager Forms JEE

VM 6/9/2026

CVE-2026-40128: Path Traversal in SAP NetWeaver AS Java Web Container

VM 6/9/2026

CVE-2026-42904: heap-based buffer overflow enabling privilege escalation in Windows TCP/IP (CVSS 9.6)

VM 6/9/2026

CVE-2026-44748: XML signature verification bypass in SAP NetWeaver Application Server ABAP (CVSS 9.9)

VM 6/9/2026

CVE-2026-44815: stack-based buffer overflow enabling code execution in Windows DHCP Client (CVSS 9.8)

VM 6/9/2026

CVE-2026-45447: use-after-free during PKCS#7 signature verification in OpenSSL (CVSS 9.8)

VM 6/9/2026

CVE-2026-45602: no cwe for this issue in Windows DHCP Server (CVSS 9.1)

VM 6/9/2026

CVE-2026-45657: Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.

VM 6/9/2026

CVE-2026-47281: improper input validation in Visual Studio Code (CVSS 9.6)

VM 6/9/2026

CVE-2026-47291: integer overflow enabling code execution in Windows HTTP.sys (CVSS 9.8)

VM 6/9/2026

CVE-2026-47643: external control of file name or path in Azure Stack Edge (CVSS 9.8)

VM 6/9/2026

CVE-2026-47938: SSRF leading to arbitrary code execution in Adobe Campaign Classic (CVSS 10.0)

VM 6/9/2026

CVE-2026-48303: incorrect authorization leading to arbitrary code execution in Adobe Campaign Classic (CVSS 10.0)

VM 6/8/2026

CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability

VM 6/8/2026

CVE-2026-44631: buffer underwrite via crafted configuration regexes in Apache HTTP Server (CVSS 9.8)

VM 6/8/2026

CVE-2026-50751: Auth Bypass in Check Point VPN Remote Access (IKEv1)

VM 6/8/2026

CVE-2026-50752: Site-to-Site VPN Certificate Bypass in Check Point (IKEv1)

VM 6/5/2026

CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

VM 6/5/2026

CVE-2026-48567: Authentication Bypass in Microsoft Azure HorizonDB

VM 6/5/2026

CVE-2026-48579: Improper Authorization in Microsoft Exchange Online

VM 6/4/2026

CVE-2026-10840: Excessive RBAC permissions in Red Hat OpenShift Pipelines

VM 6/4/2026

CVE-2026-20230: SSRF and Arbitrary File Write in Cisco Unified CM (CUCM)

VM 6/4/2026

CVE-2026-8037: OS command injection (RCE) in Progress LoadMaster

VM 6/4/2026

CVE-2026-9614: Privilege Escalation in Ivanti Neurons for ITSM

VM 6/3/2026

CVE-2010-0249: 2010 Vulnerability Now Actively Exploited (Microsoft)

VM 6/3/2026

CVE-2025-14771: Files accessible to external parties in ABB T-MAC Plus

VM 6/2/2026

CVE-2022-0492: 2022 Vulnerability Now Actively Exploited (Linux)

VM 6/2/2026

CVE-2025-48595: Android Framework Integer Overflow Vulnerability

VM 6/1/2026

CVE-2024-21182: 2024 Vulnerability Now Actively Exploited (Oracle)

VM 6/1/2026

CVE-2026-42252: Command Injection in Apache Airflow

VM 6/1/2026

CVE-2026-8644: IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.

VM 6/1/2026

CVE-2026-9311: Remote Code Execution in IBM WebSphere Application Server

VM 6/1/2026

CVE-2026-9319: Remote code execution in IBM WebSphere Application Server

VM 5/29/2026

CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

VM 5/28/2026

CVE-2026-32996: High-Severity Arbitrary File Write / Privilege Escalation in Veeam

VM 5/28/2026

CVE-2026-32997: High-Severity Arbitrary File Write / Privilege Escalation in Veeam

VM 5/28/2026

CVE-2026-32998: Critical RCE in Veeam Service Provider Console and Backup & Replication

VM 5/28/2026

CVE-2026-34926: Trend Micro Apex One Server Directory Traversal - Actively Exploited (ITW)

VM 5/28/2026

CVE-2026-34927: Local Privilege Escalation in Trend Micro Apex One / Vision One SEP Agent

VM 5/28/2026

CVE-2026-34928: LPE in Trend Micro Apex One / Vision One SEP Agent (Named Pipe)

VM 5/28/2026

CVE-2026-34929: LPE in Trend Micro Apex One / Vision One SEP Agent (IPC)

VM 5/28/2026

CVE-2026-34930: LPE in Trend Micro Apex One / Vision One SEP Agent (Process Protection)

VM 5/28/2026

CVE-2026-40701: High-Severity Denial of Service in NGINX (Bundle K000160932)

VM 5/28/2026

CVE-2026-42934: High-Severity Out-of-Bounds Read in NGINX (Bundle K000160932)

VM 5/28/2026

CVE-2026-42945: Critical RCE in NGINX ngx_http_rewrite_module (Public PoC Available)

VM 5/28/2026

CVE-2026-42946: High-Severity Use-After-Free in NGINX (Bundle K000160932)

VM 5/28/2026

CVE-2026-4408: Remote command execution in Samba

VM 5/28/2026

CVE-2026-45206: LPE in Trend Micro Apex One / Vision One SEP Agent

VM 5/28/2026

CVE-2026-45207: LPE in Trend Micro Apex One / Vision One SEP Agent

VM 5/28/2026

CVE-2026-45208: TOCTOU LPE in Trend Micro Apex One / Vision One SEP Agent

VM 5/27/2026

CVE-2025-12686: Buffer overflow RCE in Synology BeeStation Manager

VM 5/27/2026

CVE-2026-45321: TanStack Unspecified Vulnerability

VM 5/27/2026

CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability

VM 5/27/2026

CVE-2026-8175: Buffer overflow in IBM Aspera High-Speed Transfer Server

VM 5/26/2026

CVE-2026-23652: Command injection in Microsoft Power Pages

VM 5/26/2026

CVE-2026-2651: Broken access control in MLflow artifact upload

VM 5/26/2026

CVE-2026-33843: Authentication bypass in Microsoft Azure Active Directory B2C

VM 5/26/2026

CVE-2026-39821: Privilege escalation in Go golang.org/x/net/idna

VM 5/26/2026

CVE-2026-40411: Improper Input Validation in Azure Virtual Network Gateway

VM 5/26/2026

CVE-2026-40412: Unrestricted File Upload in Azure Orbital Spatio

VM 5/26/2026

CVE-2026-41090: Command injection in Microsoft Copilot

VM 5/26/2026

CVE-2026-41104: Untrusted Data Deserialization in Microsoft Planetary Computer Pro

VM 5/26/2026

CVE-2026-42901: Origin Validation Error in Microsoft Entra ID

VM 5/26/2026

CVE-2026-44930: LDAP Injection in Apache CXF (XKMS server)

VM 5/26/2026

CVE-2026-47280: Improper authentication in Microsoft Azure Resource Manager

VM 5/26/2026

CVE-2026-48172: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

VM 5/26/2026

CVE-2026-8633: Remote code execution in IBM WebSphere Application Server

VM 5/22/2026

CVE-2026-33000: Command injection in Ubiquiti UniFi OS

VM 5/22/2026

CVE-2026-34908: Improper access control in Ubiquiti UniFi OS

VM 5/22/2026

CVE-2026-34909: Path traversal in Ubiquiti UniFi OS

VM 5/22/2026

CVE-2026-34910: Command injection in Ubiquiti UniFi OS

VM 5/22/2026

CVE-2026-6960: Arbitrary file upload in WordPress BookingPress Pro plugin

VM 5/22/2026

CVE-2026-9082: Drupal Core SQL Injection Vulnerability

VM 5/21/2026

CVE-2026-5433: Command injection in Honeywell Control Network Module (CNM)

VM 5/21/2026

CVE-2026-6279: Unauthenticated RCE in WordPress Avada Builder plugin

VM 5/20/2026

CVE-2008-4250: 2008 Vulnerability Now Actively Exploited (Microsoft)

VM 5/20/2026

CVE-2009-1537: 2009 Vulnerability Now Actively Exploited (Microsoft)

VM 5/20/2026

CVE-2009-3459: 2009 Vulnerability Now Actively Exploited (Adobe)

VM 5/20/2026

CVE-2010-0806: 2010 Vulnerability Now Actively Exploited (Microsoft)

VM 5/20/2026

CVE-2026-20223: Critical Authentication Bypass in Cisco Secure Workload

VM 5/20/2026

CVE-2026-24207: Authentication bypass in NVIDIA Triton Inference Server

VM 5/20/2026

CVE-2026-41091: Microsoft Defender Link Following Vulnerability

VM 5/20/2026

CVE-2026-45444: Arbitrary file upload in Gift Cards For WooCommerce Pro (plugin)

VM 5/20/2026

CVE-2026-6555: Arbitrary File Upload in WordPress ProSolution WP Client (plugin)

VM 5/20/2026

CVE-2026-7637: PHP Object Injection in WordPress Boost (plugin)

VM 5/20/2026

CVE-2026-8495: Missing Authorization in Drupal Date iCal

VM 5/20/2026

CVE-2026-8598: Unauthenticated config export port in ZKTeco CCTV Camera

VM 5/19/2026

CVE-2026-2586: Authenticated RCE in Eclipse GlassFish Admin Console

VM 5/19/2026

CVE-2026-2587: Server-side EL injection RCE in Eclipse GlassFish

VM 5/19/2026

CVE-2026-2611: Improper origin validation RCE in MLflow Assistant

VM 5/19/2026

CVE-2026-31986: Hard-coded cryptographic key in Apache OFBiz

VM 5/19/2026

CVE-2026-41919: LDAP Injection in Apache OFBiz

VM 5/19/2026

CVE-2026-43633: Unauthenticated Deserialization RCE in HestiaCP

VM 5/19/2026

CVE-2026-4883: Arbitrary File Upload in WordPress Piotnet Forms plugin

VM 5/19/2026

CVE-2026-4885: Arbitrary File Upload in WordPress Piotnet Addons for Elementor Pro

VM 5/19/2026

CVE-2026-8948: Same-Origin Policy Bypass in Mozilla Firefox

VM 5/19/2026

CVE-2026-8953: Use-after-free sandbox escape in Mozilla Firefox

VM 5/19/2026

CVE-2026-8959: Sandbox Escape in Mozilla Firefox

VM 5/19/2026

CVE-2026-8974: Memory safety bugs in Mozilla Firefox

VM 5/18/2026

CVE-2026-7301: Unauthenticated RCE in SGLang multimodal runtime

VM 5/18/2026

CVE-2026-7304: Unauthenticated RCE in SGLang custom logit processor

VM 5/17/2026

CVE-2018-25332: Unauthenticated RCE in GitBucket

VM 5/15/2026

CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability

VM 5/15/2026

CVE-2026-5229: Authentication Bypass in WordPress Form Notify plugin

VM 5/15/2026

CVE-2026-8398: Supply chain attack trojanizing DAEMON Tools Lite installers

VM 5/14/2026

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

VM 5/14/2026

CVE-2026-41615: Information Disclosure in Microsoft Authenticator

VM 5/14/2026

CVE-2026-6510: Privilege Escalation in WordPress InfusedWoo Pro plugin

VM 5/14/2026

CVE-2026-8181: Authentication bypass in WordPress Burst Statistics (plugin)

VM 5/14/2026

CVE-2026-8511: Use-after-free in UI in Google Chrome (sandbox escape)

VM 5/14/2026

CVE-2026-8580: Use-after-free in Mojo in Google Chrome (sandbox escape)

VM 5/13/2026

CVE-2025-11159: Remote Code Execution via JDBC in Hitachi Vantara Pentaho

VM 5/13/2026

CVE-2026-41225: Arbitrary Command Execution in F5 BIG-IP iControl REST

VM 5/12/2026

CVE-2025-40949: Unauthenticated RCE in Siemens RUGGEDCOM ROX

VM 5/12/2026

CVE-2026-22924: Resource Exhaustion DoS in Siemens SIMATIC CN 4100

VM 5/12/2026

CVE-2026-25786: Stored XSS via PLC Name in Siemens SIMATIC Web Interface

VM 5/12/2026

CVE-2026-25787: Stored XSS via Technology Object Name in Siemens SIMATIC

VM 5/12/2026

CVE-2026-26083: Missing authorization in Fortinet FortiSandbox

VM 5/12/2026

CVE-2026-29204: Insufficient ownership checks in cPanel clientarea.php

VM 5/12/2026

CVE-2026-33117: Improper authentication in Azure SDK allows security feature bypass

VM 5/12/2026

CVE-2026-34260: SQL Injection in SAP S/4HANA Enterprise Search for ABAP

VM 5/12/2026

CVE-2026-34263: Unauthenticated Code Injection in SAP Commerce Cloud

VM 5/12/2026

CVE-2026-40379: Sensitive Information Exposure in Azure Entra ID

VM 5/12/2026

CVE-2026-40402: Use-After-Free Privilege Escalation in Microsoft Windows Hyper-V

VM 5/12/2026

CVE-2026-41089: Stack-based Buffer Overflow in Microsoft Windows Netlogon

VM 5/12/2026

CVE-2026-41096: Heap-based Buffer Overflow in Microsoft Windows DNS

VM 5/12/2026

CVE-2026-41551: Path Traversal in Siemens ROS#

VM 5/12/2026

CVE-2026-42823: Improper Access Control in Azure Logic Apps

VM 5/12/2026

CVE-2026-42833: Execution with Unnecessary Privileges in Microsoft Dynamics 365

VM 5/12/2026

CVE-2026-42898: Code Injection in Microsoft Dynamics 365 (on-premises)

VM 5/12/2026

CVE-2026-44277: Improper Access Control in Fortinet FortiAuthenticator

VM 5/12/2026

CVE-2026-8043: File name external control in Ivanti Xtraction

VM 5/11/2026

CVE-2026-40636: Hard-coded Credentials in Dell ECS and ObjectScale

VM 5/8/2026

CVE-2026-33109: Improper access control in Azure Managed Instance for Apache Cassandra

VM 5/8/2026

CVE-2026-33823: Improper authorization in Microsoft Teams allows information disclosure

VM 5/8/2026

CVE-2026-33844: Improper Input Validation in Azure Managed Instance for Apache Cassandra

VM 5/8/2026

CVE-2026-35428: Command Injection in Azure Cloud Shell

VM 5/8/2026

CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability

VM 5/8/2026

CVE-2026-42826: Sensitive Information Exposure in Azure DevOps

VM 5/7/2026

CVE-2026-40982: Directory Traversal in VMware Spring Cloud Config

VM 5/7/2026

CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

VM 5/6/2026

CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

VM 5/6/2026

CVE-2026-28780: Heap-based buffer overflow in Apache HTTP Server mod_proxy_ajp

VM 5/4/2026

CVE-2026-25293: Buffer overflow in Qualcomm PLC Firmware

VM 5/4/2026

CVE-2026-42376: Hardcoded telnet backdoor in D-Link DIR-456U

VM 5/4/2026

CVE-2026-42796: Unauthenticated RCE in Arelle (/rest/configure)

VM 5/4/2026

CVE-2026-42809: Privilege escalation in Apache Polaris via vended storage credentials

VM 5/4/2026

CVE-2026-42812: Metadata validation bypass in Apache Polaris (Iceberg)

VM 5/4/2026

CVE-2026-7482: Heap out-of-bounds read in Ollama (GGUF loader)

VM 5/2/2026

CVE-2026-4882: Arbitrary file upload in WordPress User Registration Advanced Fields

VM 5/2/2026

CVE-2026-7458: Authentication bypass in WordPress User Verification by PickPlugins

VM 5/1/2026

CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

VM 5/1/2026

CVE-2026-42483: Heap buffer overflow in hashcat Kerberos hash parser

VM 5/1/2026

CVE-2026-42778: Incomplete deserialization fix in Apache MINA (2.1.X/2.2.X branches)

VM 5/1/2026

CVE-2026-42779: Deserialization allowlist bypass in Apache MINA (2.1.X/2.2.X)

VM 5/1/2026

CVE-2026-7567: Authentication bypass in WordPress Temporary Login plugin

VM 4/29/2026

CVE-2026-41940: Authentication bypass in cPanel & WHM login flow

VM 4/29/2026

CVE-2026-42523: Stored XSS in Jenkins GitHub Plugin

VM 4/28/2026

CVE-2024-1708: 2024 Vulnerability Now Actively Exploited (ConnectWise)

VM 4/28/2026

CVE-2026-40976: Spring Boot default web security ineffective, allows unauthorized access

VM 4/27/2026

CVE-2026-33453: Header injection in Apache Camel camel-coap leads to RCE

VM 4/27/2026

CVE-2026-33454: Header injection in Apache Camel camel-mail

VM 4/27/2026

CVE-2026-40453: Incomplete header filter fix in Apache Camel

VM 4/27/2026

CVE-2026-40860: Unsafe JMS ObjectMessage deserialization in Apache Camel

VM 4/24/2026

CVE-2024-57726: 2024 Vulnerability Now Actively Exploited (SimpleHelp )

VM 4/24/2026

CVE-2024-57728: 2024 Vulnerability Now Actively Exploited (SimpleHelp )

VM 4/24/2026

CVE-2024-7399: 2024 Vulnerability Now Actively Exploited (Samsung)

VM 4/24/2026

CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability

VM 4/24/2026

CVE-2026-1952: Denial of service in Delta Electronics AS320T

VM 4/24/2026

CVE-2026-21515: Privilege escalation in Microsoft Azure IoT Central

VM 4/24/2026

CVE-2026-24303: Privilege escalation in Microsoft Partner Center via improper access control

VM 4/24/2026

CVE-2026-32210: SSRF in Microsoft Dynamics 365 (Online)

VM 4/24/2026

CVE-2026-33102: Open redirect in Microsoft M365 Copilot

VM 4/24/2026

CVE-2026-33819: Deserialization of untrusted data in Microsoft Bing - RCE

VM 4/24/2026

CVE-2026-35431: SSRF in Microsoft Entra ID Entitlement Management

VM 4/23/2026

CVE-2026-29198: NoSQL injection and account takeover in Rocket.Chat

VM 4/23/2026

CVE-2026-39987: Marimo Remote Code Execution Vulnerability

VM 4/22/2026

CVE-2026-1555: Arbitrary file upload in WebStack theme for WordPress

VM 4/22/2026

CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability

VM 4/21/2026

CVE-2026-34279: Scope-change compromise in Oracle Enterprise Manager Event Management

VM 4/21/2026

CVE-2026-34286: Unauthenticated data tampering in Oracle Identity Manager Connector (Fusion Middleware)

VM 4/21/2026

CVE-2026-40050: Unauthenticated path traversal in CrowdStrike LogScale

VM 4/21/2026

CVE-2026-6768: Mitigation bypass in Firefox Networking Cookies component

VM 4/20/2026

CVE-2023-27351: 2023 Vulnerability Now Actively Exploited (PaperCut)

VM 4/20/2026

CVE-2024-27199: 2024 Vulnerability Now Actively Exploited (JetBrains)

VM 4/20/2026

CVE-2025-2749: Kentico Xperience Path Traversal Vulnerability

VM 4/20/2026

CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

VM 4/20/2026

CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

VM 4/20/2026

CVE-2026-33557: SASL OAuth JWT validation flaw in Apache Kafka

VM 4/18/2026

CVE-2026-25917: XCom arbitrary code execution by DAG authors in Apache Airflow

VM 4/16/2026

CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability

VM 4/15/2026

CVE-2025-41118: Data handling vulnerability in Grafana Pyroscope

VM 4/15/2026

CVE-2026-20147: Authenticated command execution in Cisco ISE

VM 4/15/2026

CVE-2026-20180: Authenticated command execution in Cisco Identity Services Engine

VM 4/15/2026

CVE-2026-20184: SSO impersonation in Cisco Webex Services Control Hub

VM 4/15/2026

CVE-2026-20186: Authenticated command execution in Cisco Identity Services Engine

VM 4/15/2026

CVE-2026-27304: Improper input validation leading to RCE in Adobe ColdFusion

VM 4/15/2026

CVE-2026-6296: Buffer overflow in Google Chrome

VM 4/14/2026

CVE-2009-0238: 2009 Vulnerability Now Actively Exploited (Microsoft)

VM 4/14/2026

CVE-2026-26149: Security feature bypass in Microsoft Power Apps

VM 4/14/2026

CVE-2026-27681: Critical SQL Injection Vulnerability in SAP Business Planning and Consolidation and SAP Business

VM 4/14/2026

CVE-2026-32201: Microsoft SharePoint Server Improper Input Validation Vulnerability

VM 4/14/2026

CVE-2026-33824: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

VM 4/14/2026

CVE-2026-34256: Missing Authorization Check in SAP ERP and SAP S/4HANA

VM 4/14/2026

CVE-2026-38526: Arbitrary file upload in Krayin Krayin CRM

VM 4/14/2026

CVE-2026-39808: OS command injection in Fortinet FortiSandbox

VM 4/14/2026

CVE-2026-39813: Path traversal in Fortinet FortiSandbox

VM 4/14/2026

CVE-2026-5752: Sandbox escape via prototype chain in Terrarium

VM 4/13/2026

CVE-2012-1854: 2012 Vulnerability Now Actively Exploited (Microsoft)

VM 4/13/2026

CVE-2020-9715: 2020 Vulnerability Now Actively Exploited (Adobe)

VM 4/13/2026

CVE-2023-21529: 2023 Vulnerability Now Actively Exploited (Microsoft)

VM 4/13/2026

CVE-2023-36424: 2023 Vulnerability Now Actively Exploited (Microsoft)

VM 4/13/2026

CVE-2025-60710: Microsoft Windows Link Following Vulnerability

VM 4/13/2026

CVE-2026-21643: Fortinet SQL Injection Vulnerability

VM 4/11/2026

CVE-2026-34621: Prototype pollution leading to RCE in Adobe Acrobat Reader

VM 4/10/2026

CVE-2026-33784: Default password in Juniper Networks Support Insights

VM 4/10/2026

CVE-2026-34424: Backdoored Smart Slider 3 Pro plugin for WordPress

VM 4/10/2026

CVE-2026-6057: Arbitrary file upload in FalkorDB Browser

VM 4/9/2026

CVE-2025-57735: JWT token reuse after logout in Apache Airflow

VM 4/9/2026

CVE-2026-0233 and CVE-2026-0234: Critical Vulnerabilities in Palo Alto Networks Cortex XSOAR, XSIAM and ADEM - Immediate Update Required

VM 4/9/2026

CVE-2026-4112: Critical Privilege Escalation Vulnerability in SonicWall SMA 1000 - Immediate Update Required

VM 4/8/2026

CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

VM 4/8/2026

CVE-2026-1346: Local privilege escalation to root in IBM Security Verify Access

VM 4/8/2026

CVE-2026-25776: Perl code injection in Movable Type

VM 4/8/2026

CVE-2026-3535: Arbitrary file upload in WordPress

VM 4/7/2026

CVE-2021-4473: Command injection in Tianxin Internet Behavior Management System

VM 4/7/2026

CVE-2026-0740: Arbitrary file upload in Ninja Forms File Uploads plugin for WordPress

VM 4/7/2026

CVE-2026-22679: Unauthenticated RCE via Dubbo debug endpoint in Weaver E-cology

VM 4/7/2026

CVE-2026-23696: SQL injection in Windmill

VM 4/7/2026

CVE-2026-4631: SSH command injection via login endpoint in Cockpit

VM 4/4/2026

CVE-2018-25236: Authentication bypass in Hirschmann HiOS/HiSecOS management

VM 4/4/2026

CVE-2018-25237: Buffer overflow in Hirschmann HiSecOS

VM 4/4/2026

CVE-2021-4477: IPv6 IPsec firewall bypass in Hirschmann HiLCOS OpenBAT

VM 4/4/2026

CVE-2026-35616: Access control bypass in Fortinet Forticlientems

VM 4/3/2026

CVE-2017-20237: Authentication bypass in Hirschmann Industrial HiVision

VM 4/3/2026

CVE-2026-0545: Unauthenticated RCE via job endpoints in MLflow

VM 4/3/2026

CVE-2026-26135: SSRF in Microsoft Azure Custom Locations Resource Provider

VM 4/3/2026

CVE-2026-32211: Missing authentication in Azure MCP Server

VM 4/3/2026

CVE-2026-32213: Improper authorization in Azure AI Foundry

VM 4/3/2026

CVE-2026-33105: Improper authorization in Microsoft Azure Kubernetes Service

VM 4/3/2026

CVE-2026-33107: SSRF in Azure Databricks

VM 4/3/2026

Vulnerability Scanner — What It Is, How It Works and Which Tools to Choose

VM 4/2/2026

CVE-2026-2699: Unauthenticated configuration access in Citrix ShareFile Storage Zones Controller

VM 4/2/2026

CVE-2026-2701: Authenticated file upload RCE in Citrix ShareFile Storage Zones Controller

VM 4/2/2026

CVE-2026-3502: TrueConf Client Download of Code Without Integrity Check Vulnerability

VM 4/2/2026

What is vulnerability assessment? Vulnerability evaluation — process, tools, and best practices

VM 4/1/2026

CVE-2026-20093: Authentication bypass in Cisco Integrated Management Controller

VM 4/1/2026

CVE-2026-20160: Unauthenticated command execution in Cisco Smart Software Manager On-Prem

VM 4/1/2026

CVE-2026-29014: Unauthenticated PHP code injection in MetInfo CMS

VM 4/1/2026

CVE-2026-5281: Google Dawn Use-After-Free Vulnerability

VM 4/1/2026

CVE-2026-5290: Use-after-free in Google Chrome

VM 3/31/2026

CVE-2026-1579: Unauthenticated command execution via unsigned MAVLink in PX4 Autopilot

VM 3/31/2026

CVE-2026-33579: Privilege escalation in Openclaw

VM 3/22/2026

Cyber Resilience Act (CRA): 3 vulnerability definitions you need to know

VM 3/15/2026

CVE-2026-3300: PHP code injection RCE in Everest Forms Pro plugin for WordPress

VM 3/14/2026

CVE-2026-4257: Remote code execution in WordPress

VM 3/13/2026

CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability

VM 3/11/2026

CVE-2026-34714: Code execution via crafted file in Vim

VM 3/6/2026

CVE-2026-22738: SpEL injection in Spring AI SimpleVectorStore

VM 3/5/2026

CVE-2026-27876: Remote code execution in Grafana

VM 2/26/2026

CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability

VM 2/24/2026

CVE-2026-4809: Arbitrary file upload in Laravel

VM 2/23/2026

CVE-2026-20688: Sandbox escape via path handling in Apple iOS/iPadOS

VM 2/15/2026

CVE-2026-28827: Sandbox escape via directory path parsing in Apple macOS

VM 2/14/2026

CVE-2026-28858: Critical Vulnerability in Apple iOS - Immediate Update Required

VM 2/5/2026

CVE-2026-33017: Langflow Code Injection Vulnerability

VM 2/4/2026

CVE-2026-4001: Critical Vulnerability in WordPress Woocommerce Custom Product Addons Pro - Immediate Update Required

VM 1/15/2026

CVE-2026-3587: Critical Vulnerability in Embedded Device CLI - Immediate Update Required

VM 1/12/2026

CVE-2026-21992: Critical Vulnerability in Oracle Oracle Identity Manager - Immediate Update Required

VM 1/11/2026

CVE-2026-22732: Critical Vulnerability in VMware Spring Security - Immediate Update Required

VM 1/10/2026

CVE-2026-32194: Critical Vulnerability in Microsoft Bing Images - Immediate Update Required

VM 1/6/2026

CVE-2026-20131: unauthenticated RCE as root in Cisco Secure Firewall Management Center (CVSS 10.0)

VM 1/5/2026

CVE-2026-22557: Critical Path Traversal in Ubiquiti UniFi Network (CVSS 10.0)

VM 1/4/2026

CVE-2026-22558: Ubiquiti UniFi Network NoSQL Injection Vulnerability (CVSS 7.7)

VM 1/3/2026

CVE-2026-23554: Critical Citrix XenServer Vulnerability - Host Memory Leak from Guest VM

VM 12/29/2025

CVE-2026-27542: Critical Vulnerability in Woocommerce Wholesale Lead Capture - Immediate Update Required

VM 12/25/2025

CVE-2026-20963: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

VM 12/19/2025

CVE-2026-3909: Google Skia Out-of-Bounds Write Vulnerability

VM 12/18/2025

CVE-2026-3910: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

VM 12/17/2025

CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

VM 12/16/2025

CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability

VM 12/12/2025

CVE-2026-28363: tools.exec.safeBins validation bypass in OpenClaw

VM 12/10/2025

CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

VM 12/9/2025

CVE-2026-25108: Soliton Systems K.K FileZen OS Command Injection Vulnerability

VM 12/5/2025

CVE-2026-26980: Unauthenticated database read in Ghost CMS

VM 12/4/2025

CVE-2026-22769: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

VM 12/3/2025

CVE-2026-2441: Google Chromium CSS Use-After-Free Vulnerability

VM 11/28/2025

CVE-2026-1731: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

VM 11/26/2025

CVE-2026-20700: Apple Multiple Buffer Overflow Vulnerability

VM 11/24/2025

CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability

VM 11/23/2025

CVE-2026-21513: Microsoft Internet Explorer Protection Mechanism Failure Vulnerability

VM 11/22/2025

CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

VM 11/21/2025

CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability

VM 11/20/2025

CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability

VM 11/17/2025

CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

VM 11/14/2025

CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

VM 11/11/2025

CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

VM 11/8/2025

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

VM 11/7/2025

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

VM 11/6/2025

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

VM 9/20/2025

CVE-2025-15036: Path traversal in MLflow extract_archive_to_dir

VM 9/19/2025

CVE-2025-15379: Command injection in MLflow model serving

VM 9/18/2025

CVE-2025-53521: F5 BIG-IP Unspecified Vulnerability

VM 9/14/2025

CVE-2025-71275: Critical Vulnerability in Zimbra Zimbra Collaboration Suite - Immediate Update Required

VM 9/13/2025

CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability

VM 9/12/2025

CVE-2025-32432: High-Risk Craft CMS Vulnerability (EPSS: 79%)

VM 9/11/2025

CVE-2025-43510: Apple Multiple Products Improper Locking Vulnerability

VM 9/10/2025

CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability

VM 9/9/2025

CVE-2025-54068: Laravel Livewire Code Injection Vulnerability

VM 8/23/2025

CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

VM 7/27/2025

CVE-2025-68613: High-Risk n8n Vulnerability (EPSS: 79%)

VM 7/26/2025

CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

VM 7/24/2025

RidgeBot 6.2: Native Directory Brute-Force Scanning, Expanded WAP Support and Unauthenticated SMTP Relay

VM 7/19/2025

CVE-2025-40538: Access control bypass in Solarwinds Serv-U

VM 7/18/2025

CVE-2025-40539: Type confusion leading to RCE in SolarWinds Serv-U

VM 7/17/2025

CVE-2025-40540: Type confusion leading to RCE in SolarWinds Serv-U

VM 7/16/2025

CVE-2025-40541: IDOR leading to RCE in SolarWinds Serv-U

VM 7/12/2025

CVE-2025-49113: High-Risk Webmail Vulnerability (EPSS: 90%)

VM 7/11/2025

CVE-2025-68461: RoundCube Webmail Cross-site Scripting Vulnerability

VM 7/9/2025

CVE-2025-13590: Remote code execution in Wso2 Api Control Plane

VM 7/8/2025

CVE-2025-15556: Notepad++ Download of Code Without Integrity Check Vulnerability

VM 7/7/2025

CVE-2025-40536: SolarWinds Web Help Desk Security Control Bypass Vulnerability

VM 7/5/2025

CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability

VM 7/4/2025

CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

VM 7/3/2025

CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability

VM 6/30/2025

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

VM 2/23/2025

CVE-2017-20229: Buffer overflow in Invisible Island Mawk

VM 2/20/2025

CVE-2018-25223: Buffer overflow in Ftnapps Crashmail Ii

VM 2/15/2025

CVE-2006-10003: Critical buffer overflow in Perl XML::Parser - Immediate Update Required

VM 10/5/2024

CVE-2021-22054: 2021 Vulnerability Now Actively Exploited (Omnissa)

VM 9/30/2024

CVE-2017-7921: 2017 Vulnerability Now Actively Exploited (Hikvision)

VM 9/29/2024

CVE-2021-22681: 2021 Vulnerability Now Actively Exploited (Rockwell)

VM 9/28/2024

CVE-2021-30952: 2021 Vulnerability Now Actively Exploited (Apple)

VM 9/27/2024

CVE-2023-41974: 2023 Vulnerability Now Actively Exploited (Apple)

VM 9/26/2024

CVE-2023-43000: 2023 Vulnerability Now Actively Exploited (Apple)

VM 9/14/2024

CVE-2022-20775: 2022 Vulnerability Now Actively Exploited (Cisco)

VM 9/10/2024

CVE-2008-0015: 2008 Vulnerability Now Actively Exploited (Microsoft)

VM 9/9/2024

CVE-2020-7796: 2020 Vulnerability Now Actively Exploited (Synacor)

VM 9/8/2024

CVE-2024-7694: 2024 Vulnerability Now Actively Exploited (TeamT5)

VM 9/7/2024

CVE-2024-43468: 2024 Vulnerability Now Actively Exploited (Microsoft)

VM 9/4/2024

CVE-2019-19006: 2019 Vulnerability Now Actively Exploited (Sangoma)

VM 9/2/2024

What Is CVSS (Common Vulnerability Scoring System)? A Complete Guide to Vulnerability Assessment

VM 9/1/2024

What is CWE? Guide to Common Weakness Enumeration

VM 8/31/2024

Vulnerability Disclosure - How to Responsibly Report Security Flaws

VM 8/29/2024

CVE-2018-14634: 2018 Vulnerability Now Actively Exploited (Linux)

VM 6/9/2024

Source Code Vulnerability Analysis

VM 6/7/2024

Vulnerability scanners: How to choose the right tool and effectively manage the results?

VM 5/13/2024

Risk assessment in OT: Why is CVSS not enough and how to assess the real risk to the production process?

VM 4/23/2024

OT Vulnerability Management: Legacy Systems — My PLC Controller Can't Be Updated

VM 3/23/2024

What Is CSRF (Cross-Site Request Forgery)? Detection, How It Works, and Prevention

VM 1/27/2024

Verified Risk vs Vulnerabilities: How RidgeBot Eliminates False Alarms Through Exploit Validation

VM 1/19/2024

What Is SQL Injection? A Complete Guide to Web Application Vulnerabilities and Protections

VM 1/17/2024

Vulnerability Management Lifecycle - Complete Guide

VM 1/8/2024

Vulnerability prioritization in practice

VM 1/7/2024

Micro Focus Fortify – Automatic Code Vulnerability Testing

VM 1/3/2024

Automation in vulnerability management

VM 12/28/2023

Tenable: Solutions and Support for Proactive Vulnerability Management

VM 12/18/2023

Comprehensive Vulnerability Management: Your organization's proactive shield against cyber attacks

VM 9/3/2023

Why Does Your Pentest Report Gather Dust? The Remediation Gap Problem

VM 8/17/2023

Retesting and Remediation Validation After Pentests: Why and How to Verify Fixes

VM 8/11/2023

Vulnerability Management Lifecycle

VM 6/22/2023

Vulnerability Management: What Is It and How Does It Work?

VM 5/29/2023

What is CVE (Common Vulnerabilities and Exposures)? - Key Information

VM 4/11/2023

Network Penetration Testing - Security Testing Process, Vulnerability Identification, and Threat Detection

Need help with Vulnerability Management?

nFlo offers full Vulnerability Management services: vulnerability scanning, prioritization, remediation support.

Want to Reduce IT Risk and Costs?

Book a free consultation - we respond within 24h

Response in 24h Free quote No obligations