Security Alerts
We monitor threats 24/7. We publish alerts about critical vulnerabilities based on CISA KEV and NVD.
Critical (CVSS 9.0+)
CVE-2026-109593
CVE-2026-109593: Unauthenticated File Read in SonicWall GMS
CVE-2026-13594
CVE-2026-13594: Unauthorized Access in ManageEngine Log360 and EventLog Analyzer
CVE-2026-28336
CVE-2026-28336: Command Injection in SolarWinds Dameware
CVE-2026-4052
CVE-2026-4052: Access Control Flaw in WSO2 API Manager / Identity Server
CVE-2026-82158
CVE-2026-82158: Cross-Site Scripting in Dell Wyse Management Suite
CVE-2026-95731
CVE-2026-95731/95732/95733: Hardcoded Password and RCE in HPE Networking Fabric Composer
CVE-2026-84295
CVE-2026-84295 and 5 More: Critical Flaws in Progress WS_FTP Server
CVE-2026-97229
CVE-2026-97229: Actively Exploited RCE in GitLab CE/EE via CI/CD Regex
CVE-2026-111497
CVE-2026-111497 (Node2Shell): Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-109618
CVE-2026-109618 (PHP2Shell): Out-of-Memory Corruption Enables RCE in PHP
CVE-2026-110447
CVE-2026-110447: Actively Exploited RCE in Collabora Online Built-in CODE Server
CVE-2026-110264
CVE-2026-110264: Unauthenticated Remote Code Execution in GitLab CE/EE
CVE-2026-114625
CVE-2026-114625: Privilege Escalation in Arista VeloCloud Orchestrator
CVE-2026-76299
CVE-2026-76299 and CVE-2026-76302: Critical Flaws in Splunk Enterprise
CVE-2026-76531
CVE-2026-76531: Files Accessible to External Parties in Splunk SOAR
CVE-2026-79867
CVE-2026-79867 and 8 More: Critical Flaws in HPE Aruba AOS-8 and AOS-10
CVE-2026-20043
CVE-2026-20043: Out-of-Bounds Write in Cisco Snort 3
CVE-2026-76466
CVE-2026-76466: Remote Command Execution as Root in Cisco Expressway
CVE-2026-76474
CVE-2026-76474 and 2 More: Critical Flaws in Cisco Unified CM and Unity Connection
CVE-2026-87095
CVE-2026-87095: Improper Authorization in Acronis Cyber Infrastructure
CVE-2026-92559
CVE-2026-92559: Credential Exposure in IBM App Connect Enterprise 13
CVE-2026-108474
CVE-2026-108474: SQL Injection in JetBrains Exposed (Kotlin)
CVE-2026-75875
CVE-2026-75875 and 2 More: Critical Flaws in IBM Guardium Data Protection 12
CVE-2026-96207
CVE-2026-96207 and 4 More: Critical Flaws in Microsoft Cloud Services
CVE-2026-14269
CVE-2026-14269 and 5 More: Critical Flaws in IBM DataPower Gateway
CVE-2026-59346
CVE-2026-59346: VM Escape in VMware Workstation and Fusion
CVE-2026-76480
CVE-2026-76480 and CVE-2026-76483: Critical Flaws in Cisco License On-Prem
CVE-2026-76485
CVE-2026-76485 and 2 More: Remote Code Execution in Cisco NX-OS NGOAM
CVE-2026-76498
CVE-2026-76498, CVE-2026-76499, CVE-2026-76500: Critical Flaws in Cisco APIC
CVE-2026-63688
CVE-2026-63688 and 5 More: Critical Flaws in Dell Container Storage Modules
CVE-2026-76721
CVE-2026-76721 and 4 more: RCE and Auth Bypass in HPE Networking Instant On APs
CVE-2026-8065
CVE-2026-8065: Authentication Bypass in Hitachi Energy RTU500 Firmware Update
CVE-2026-84436
CVE-2026-84436: Command Injection in IBM Guardium Data Protection 12.2
CVE-2026-88771
CVE-2026-88771: Unauthenticated Command Execution in Citrix NetScaler
CVE-2026-88772
CVE-2026-88772: Memory Buffer Flaw in Citrix NetScaler ADC and Gateway
CVE-2026-93641
CVE-2026-93641: Stored XSS via Email in Zimbra Collaboration Suite
CVE-2026-93643
CVE-2026-93643: Unauthenticated RCE in Zimbra via OnlyOffice Integration
CVE-2026-5430
CVE-2026-5430: Critical Flaw in WSO2 API Manager and API Gateways
CVE-2026-71362
CVE-2026-71362: Privilege Escalation in Adobe Commerce and Magento
CVE-2026-78308
CVE-2026-78308, CVE-2026-78312: Auth Bypass and Path Traversal in Delta DIAEnergie
CVE-2026-93577
CVE-2026-93577, CVE-2026-89078: RCE via CI/CD Regex in GitLab CE/EE
CVE-2026-75884
CVE-2026-75884: Privilege Escalation via pod_spec_override in AWX
CVE-2026-84719
CVE-2026-84719: Permission Bypass in Red Hat Ansible Automation Platform
CVE-2026-85102
CVE-2026-85102: VPN Certificate Validation RCE in Check Point Quantum Gateway
CVE-2026-93616
CVE-2026-93616: Path Traversal and RCE in Check Point Management Server
CVE-2026-93952
CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
CVE-2026-94127
CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
CVE-2025-39682
CVE-2025-39682: Zero-Length Record Handling in the Linux Kernel TLS Receive Path
CVE-2026-76460
CVE-2026-76460: Management Interface Bypass in Cisco Identity Services Engine
CVE-2026-76461
CVE-2026-76461: SQL Injection in Cisco Secure Email Gateway
CVE-2026-84869
CVE-2026-84869: File Transfer and Execution in ConnectWise ScreenConnect Sessions
CVE-2026-85706
CVE-2026-85706: Path Traversal in GitLab Community and Enterprise Edition
CVE-2026-86060
CVE-2026-86060: Privilege Escalation via Policy Mask in MikroTik RouterOS
CVE-2026-19490
CVE-2026-19490: Authentication Bypass in Citrix NetScaler ADC and Gateway
CVE-2026-20079
CVE-2026-20079: Authentication Bypass in Cisco Secure Firewall Management Center
CVE-2026-72982
CVE-2026-72982 and 5 Related: Six Critical Flaws in Windows Server Components
CVE-2026-75650
CVE-2026-75650: Critical Adobe Commerce and Magento Flaw — CVSS 10, No User Interaction
CVE-2026-78509
CVE-2026-78509 and CVE-2026-78510: Critical Outlook and Word Flaws — Unauthenticated Code Execution
CVE-2026-81376
CVE-2026-81376: Security Feature Bypass in Visual Studio Code — A Flaw on Developer Workstations
CVE-2026-83941
CVE-2026-83941: Missing Authorization in Entra ID — A Flaw You Cannot Patch Yourself
CVE-2026-86218
CVE-2026-86218: Pre-Auth RCE in N-able N-central — A Flaw in the Tool That Manages Other People's Infrastructure
CVE-2026-19117
CVE-2026-19117: authentication bypass via FIDO2 registration in Delinea Secret Server
CVE-2026-20212
CVE-2026-20212: unauthenticated root code execution in Cisco Nexus 9000 switches
CVE-2026-20274
CVE-2026-20274 and CVE-2026-20279: Cisco IOS XR hardening release — no workarounds
CVE-2026-49869
CVE-2026-49869: Authentication Bypass in Kestra OSS — One endsWith and Full RCE as Root
CVE-2026-83548
CVE-2026-83548 and CVE-2026-83549: Two SonicWall SMA1000 Flaws — Pre-Auth SSRF and Post-Auth Command Execution
CVE-2026-84325
CVE-2026-84325 and 5 related: critical flaws in Google Chrome 152 — sandbox escape
CVE-2026-58574
CVE-2026-58574: Missing Authentication in Dell PowerStore Management Interface
CVE-2026-82854
CVE-2026-82854: SMTP Command Injection in Nodemailer
CVE-2026-18527
CVE-2026-18527: Privilege Escalation in IBM Administration Runtime Expert for i
CVE-2026-19295
CVE-2026-19295 and CVE-2026-19286: Remote Code Execution in IBM Langflow OSS
CVE-2026-42007
CVE-2026-42007: Use-After-Free in Dovecot via Sieve editheader Extension
CVE-2026-82266
CVE-2026-82266: Redpanda Admin API Treats Unauthenticated Requests as Superuser
CVE-2026-82277
CVE-2026-82277: Argo Rollouts Dashboard Exposes Mutating Operations Without Auth
CVE-2026-82329
CVE-2026-82329: Administrative Takeover in JFrog Artifactory
CVE-2023-49105
CVE-2023-49105: Authentication Bypass in ownCloud Server
CVE-2026-59270
CVE-2026-59270: Spring Security Embedded LDAP Binds to All Interfaces
CVE-2026-74746
Linux Kernel: 17 Security Fixes in Networking, Ceph and MPTCP (CVE-2026-74746)
CVE-2026-77550
UniFi OS: 12 Vulnerabilities Including Authentication Bypass (CVE-2026-77550)
CVE-2026-81934
CVE-2026-81934: Use-After-Free in Redis TLS Handling
CVE-2026-8452
CVE-2026-8452: Memory Buffer Overflow in Citrix NetScaler ADC and Gateway
CVE-2026-49845
CVE-2026-49845: SQL injection in Hive Metastore — tampering with Apache Hive warehouse metadata
CVE-2026-60004
CVE-2026-60004: remote code execution in Gitea via the diffpatch endpoint (CISA KEV, due 28 August)
CVE-2026-63586
CVE-2026-63586: unauthenticated root code execution in Weidmüller IE-SR-2TX-WL routers
CVE-2026-76193
CVE-2026-76193, 76195, 76197: three CVSS 10 flaws in Adobe Campaign Classic leading to code execution
CVE-2026-21962
CVE-2026-21962: Oracle HTTP Server and WebLogic Proxy Plug-in takeover (actively exploited, CVSS 10)
CVE-2026-59568
CVE-2026-59568 and CVE-2026-59564: remote code execution and authentication bypass in Zscaler Client Connector
CVE-2026-76835
CVE-2026-76835: authentication bypass in OAuth2 Proxy via the X-Forwarded-Uri header (no patch available)
CVE-2026-17145
CVE-2026-17145 and 12 more: IBM's August bulletin for AIX and PowerVM VIOS
CVE-2026-69836
CVE-2026-69836 and 12 more: Microsoft's August cloud bulletin (Entra ID, Azure, Exchange Online)
CVE-2026-11861
CVE-2026-11861 and CVE-2026-13097: FreeIPA authentication bypass via Active Directory trust
CVE-2026-76312
CVE-2026-76312: Four Splunk Enterprise flaws — session material exposed via embedded reports
CVE-2026-16816
CVE-2026-16816: Four critical flaws in IBM AIX and PowerVM VIOS
CVE-2026-20357
CVE-2026-20357: Three critical flaws in Cisco Crosswork — hardening release
CVE-2026-32475
CVE-2026-32475: Unrestricted file upload leading to RCE in Elementor Pro
CVE-2026-64849
CVE-2026-64849: Actively exploited SSRF in MLflow (CISA KEV)
CVE-2026-66794
CVE-2026-66794: Authentication bypass in Red Hat Multicluster Engine
CVE-2026-12564
CVE-2026-12564: Kubernetes service account token exfiltration from Ansible Automation Platform
CVE-2026-18963
CVE-2026-18963: Account takeover in Keycloak via forced password reset
CVE-2026-59310
CVE-2026-59310: Actively exploited VMware vCenter flaw — CISA deadline August 21
CVE-2026-65400
CVE-2026-65400: macOS Screen Sharing authentication bypass — CISA deadline August 21
CVE-2026-67271
CVE-2026-67271: Remote code execution via SMB in Dell PowerStore
CVE-2026-73930
CVE-2026-73930: Ten critical flaws in Oracle Helidon — August Oracle bulletin
CVE-2026-19478
CVE-2026-19478: Unauthenticated Data Modification in GitLab CE/EE
CVE-2026-66792
CVE-2026-66792: Privilege Escalation in Red Hat ACM (multicloud-operators-subscription)
CVE-2026-66795
CVE-2026-66795: CSR Validation Flaw in Red Hat ACM (managedcluster-import-controller)
CVE-2026-71472
CVE-2026-71472: Command Injection in Red Hat ACM (acm-search-v2)
CVE-2026-75045
CVE-2026-75045: Unauthenticated Database Backup Download in YouTrack
CVE-2026-50517
CVE-2026-50517: deserialization of untrusted data enabling code execution in M365 Copilot (CVSS 9.9)
CVE-2026-54120
CVE-2026-54120: improper input validation enabling code execution in Microsoft Surface (CVSS 9.9)
CVE-2026-56160
CVE-2026-56160: improper authorization in Azure Red Hat OpenShift (ARO) (CVSS 9.1)
CVE-2026-56163
CVE-2026-56163: missing authentication for critical function in Azure Kubernetes Service (CVSS 10.0)
CVE-2026-56165
CVE-2026-56165: heap-based buffer overflow in Microsoft Account (CVSS 9.8)
CVE-2026-56191
CVE-2026-56191: improper authentication enabling tampering in Microsoft Exchange Online (CVSS 10.0)
CVE-2026-57106
CVE-2026-57106: server-side request forgery in Microsoft Data Quality (CVSS 10.0)
CVE-2026-58275
CVE-2026-58275: missing authorization in Azure DNS (CVSS 10.0)
CVE-2026-58630
CVE-2026-58630: improper access control in Azure App Service (CVSS 10.0)
CVE-2026-62825
CVE-2026-62825: improper authentication in Azure Key Vault (CVSS 10.0)
CVE-2026-62835
CVE-2026-62835: improper authorization in Azure Portal (CVSS 9.3)
CVE-2026-64812
CVE-2026-64812: unauthorized input injection in Remote Development in JetBrains IntelliJ IDEA (CVSS 10.0)
CVE-2026-64813
CVE-2026-64813: unauthorized settings modification in Remote Development in JetBrains IntelliJ IDEA (CVSS 10.0)
CVE-2026-6516
CVE-2026-6516: unauthenticated RCE via agent API in ManageEngine ADAudit Plus (CVSS 10.0)
CVE-2026-65907
CVE-2026-65907: In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
CVE-2026-16232
CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability
CVE-2026-40712
CVE-2026-40712: Privilege Escalation in Dell PowerProtect Data Manager
CVE-2026-46738
CVE-2026-46738: Improper Input Validation in Dell PowerProtect Data Manager
CVE-2026-62144
CVE-2026-62144: Auth Bypass in Check Point Security Management
CVE-2026-0770
CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
CVE-2026-28302
CVE-2026-28302: IDOR to RCE via Group Admin in SolarWinds Serv-U
CVE-2026-28304
CVE-2026-28304: Remote Code Execution as Root in SolarWinds Serv-U
CVE-2026-28305
CVE-2026-28305: IDOR to RCE via Domain Account in SolarWinds Serv-U
CVE-2026-28306
CVE-2026-28306: Privilege Escalation to SysAdmin in SolarWinds Serv-U
CVE-2026-28307
CVE-2026-28307: Privilege Escalation to Admin Group in SolarWinds Serv-U
CVE-2026-28308
CVE-2026-28308: IDOR to RCE via Domain Admin in SolarWinds Serv-U
CVE-2026-28309
CVE-2026-28309: Broken Access Control in SolarWinds Serv-U
CVE-2026-28310
CVE-2026-28310: User Type Escalation to SysAdmin in SolarWinds Serv-U
CVE-2026-28312
CVE-2026-28312: Group Privilege Escalation to Root in SolarWinds Serv-U
CVE-2026-28313
CVE-2026-28313: IDOR to SMTP Hijacking Account Takeover in SolarWinds Serv-U
CVE-2026-28314
CVE-2026-28314: IDOR to Account Takeover in SolarWinds Serv-U
CVE-2026-28316
CVE-2026-28316: IDOR to Root Privilege Escalation in SolarWinds Serv-U
CVE-2026-28317
CVE-2026-28317: IDOR to Privilege Escalation in SolarWinds Serv-U
CVE-2026-28321
CVE-2026-28321: Broken Access Control to Root RCE in SolarWinds Serv-U
CVE-2026-63030
CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
CVE-2026-64879
CVE-2026-64879: command injection in Tenable Security Center (CVSS 9.9)
CVE-2026-16242
CVE-2026-16242: unauthenticated agent access via misconfigured Konnectivity proxy-server
CVE-2026-47865
CVE-2026-47865: authentication bypass granting Avi Control plane access in VMware Avi Load Balancer (CVSS 9.8)
CVE-2026-15091
CVE-2026-15091: cross-site scripting in IBM Engineering AI Hub
CVE-2026-53412
CVE-2026-53412: improper input validation enabling account takeover in Zoom clients for Windows (CVSS 9.8)
CVE-2026-11386
CVE-2026-11386: input validation and injection flaw in Canonical ubuntu-pro-client
CVE-2026-22752
CVE-2026-22752: Authentication Bypass in Spring Authorization Server
CVE-2026-63087
CVE-2026-63087: unauthenticated PluginAuthToken acquisition in Grafana OnCall (CVSS 9.8)
CVE-2026-46817
CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability
CVE-2026-15265
CVE-2026-15265: path traversal in Tenable Agent plugin directory
CVE-2026-27690
CVE-2026-27690: HTTP Request Smuggling in SAP Approuter
CVE-2026-42990
CVE-2026-42990: heap-based buffer overflow in SQL Server ODBC driver (CVSS 9.8)
CVE-2026-44747
CVE-2026-44747: memory corruption via logical errors in SAP NetWeaver Application Server ABAP (CVSS 9.9)
CVE-2026-44761
CVE-2026-44761: Sample OAuth2 Credentials in SAP Commerce Cloud
CVE-2026-48259
CVE-2026-48259: SSRF Vulnerability in Adobe Experience Manager
CVE-2026-48356
CVE-2026-48356: Unrestricted File Upload in Adobe Commerce
CVE-2026-48358
CVE-2026-48358: Improper Output Encoding in Adobe Commerce
CVE-2026-48359
CVE-2026-48359: XXE Vulnerability in Adobe Experience Manager
CVE-2026-48561
CVE-2026-48561: improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot (CVSS 9.6)
CVE-2026-49172
CVE-2026-49172: heap-based buffer overflow in Windows FTP Service (CVSS 9.8)
CVE-2026-49798
CVE-2026-49798: use after free in Windows Kernel (CVSS 9.3)
CVE-2026-50380
CVE-2026-50380: Heap Buffer Overflow in Microsoft Windows GDI+ (CVSS 9.6)
CVE-2026-50447
CVE-2026-50447: heap-based buffer overflow in Windows Message Queuing (CVSS 9.8)
CVE-2026-50518
CVE-2026-50518: heap-based buffer overflow in Windows DHCP Server (CVSS 9.8)
CVE-2026-50522
CVE-2026-50522: deserialization of untrusted data in Microsoft Office SharePoint (CVSS 9.8)
CVE-2026-54990
CVE-2026-54990: heap-based buffer overflow in Remote Desktop Client (CVSS 9.8)
CVE-2026-55008
CVE-2026-55008: improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server (CVSS 9.6)
CVE-2026-55040
CVE-2026-55040: weak authentication in Microsoft Office SharePoint (CVSS 9.1)
CVE-2026-55944
CVE-2026-55944: deserialization of untrusted data in Microsoft Dynamics NAV (CVSS 9.8)
CVE-2026-56159
CVE-2026-56159: heap-based buffer overflow in Windows DHCP Server (CVSS 9.8)
CVE-2026-56188
CVE-2026-56188: race condition enabling code execution in Windows Server Network driver (CVSS 9.8)
CVE-2026-56190
CVE-2026-56190: use of uninitialized resource in Windows RDP (CVSS 9.8)
CVE-2026-56451
CVE-2026-56451: JWT algorithm confusion enabling authentication bypass in Siemens Opcenter X (CVSS 10.0)
CVE-2026-57092
CVE-2026-57092: use after free enabling privilege escalation in Windows VMSwitch (CVSS 9.9)
CVE-2026-58644
CVE-2026-58644: deserialization of untrusted data in Microsoft Office SharePoint (CVSS 9.8)
CVE-2026-59083
CVE-2026-59083: security constraint bypass via URL encoding in Apache Tomcat rewrite valve (CVSS 9.1)
CVE-2026-59084
CVE-2026-59084: insufficient documentation for secure EncryptInterceptor setup in Apache Tomcat (CVSS 9.1)
CVE-2026-62422
CVE-2026-62422: authentication bypass in JetBrains YouTrack (CVSS 10.0)
CVE-2026-4769
CVE-2026-4769: undocumented unauthenticated diagnostic capability during boot in WAGO System I/O Field (CVSS 9.8)
CVE-2026-48939
CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-56291
CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-56688
CVE-2026-56688: OS Command Injection in Dell PowerFlex Manager
CVE-2026-59792
CVE-2026-59792: Path Traversal RCE in JetBrains IntelliJ IDEA
CVE-2026-47646
CVE-2026-47646: XSS in Microsoft Dynamics 365 Customer Voice
CVE-2026-9074
CVE-2026-9074: SQL Injection in IBM API Connect
CVE-2026-33264
CVE-2026-33264: unrestricted import_string in Apache Airflow DAG deserialization (CVSS 9.8)
CVE-2026-48908
CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-53481
CVE-2026-53481: unauthenticated path traversal in Dell PowerProtect Data Domain (CVSS 9.8)
CVE-2026-53483
CVE-2026-53483: improper authentication enabling full system takeover in Dell PowerProtect Data Domain (CVSS 9.8)
CVE-2026-55255
CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
CVE-2026-56290
CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability
CVE-2026-40047
CVE-2026-40047: argument injection in Apache Camel Docling component (CVSS 9.1)
CVE-2026-48203
CVE-2026-48203: header-driven injection and SSRF in Apache Camel Solr component (CVSS 9.1)
CVE-2026-48204
CVE-2026-48204: header-controlled GridFS operation selection in Apache Camel MongoDB GridFS (CVSS 9.8)
CVE-2026-48205
CVE-2026-48205: header-controlled DNS parameters and SSRF in Apache Camel DNS component (CVSS 9.1)
CVE-2026-41106
CVE-2026-41106: url redirection to untrusted site ('open redirect') in M365 Copilot (CVSS 9.3)
CVE-2026-45499
CVE-2026-45499: server-side request forgery in Azure OpenAI (CVSS 9.9)
CVE-2026-57100
CVE-2026-57100: server-side request forgery in Microsoft Entra Provisioning Service (CVSS 9.9)
CVE-2026-10109
CVE-2026-10109: pre-auth DRDA handshake RCE in IBM Db2 (CVSS 9.8)
CVE-2026-11708
CVE-2026-11708: cross-site scripting in IBM WebSphere Application Server
CVE-2026-11712
CVE-2026-11712: cross-site scripting in IBM WebSphere Application Server
CVE-2026-48286
CVE-2026-48286: incorrect authorization leading to code execution in Adobe Campaign Classic (CVSS 10.0)
CVE-2026-13762
CVE-2026-13762: AWS WAF body inspection bypass via fragmented HTTP/2 in Amazon CloudFront (CVSS 9.8)
CVE-2026-13763
CVE-2026-13763: AWS WAF body inspection bypass via fragmented HTTP/2 in AWS Application Load Balancer (CVSS 9.8)
CVE-2026-41120
CVE-2026-41120: acceptance of extraneous untrusted data enabling RCE in Dell Wyse Management Suite (CVSS 9.8)
CVE-2026-11374
CVE-2026-11374: SSO Token Prediction in ManageEngine ADSelfService Plus
CVE-2026-11807
CVE-2026-11807: missing authorization exposing plaintext credentials in Event-Driven Ansible websocket API (CVSS 9.6)
CVE-2026-12249
CVE-2026-12249: Cleartext HTTP Cert Enrollment in Canonical ADSys
CVE-2026-28381
CVE-2026-28381: Snowflake datasource GET/PUT commands enabling file read/write in Grafana (CVSS 9.6)
CVE-2026-12048
CVE-2026-12048: Stored XSS in pgAdmin 4 Error and Plan Rendering
CVE-2026-45480
CVE-2026-45480: improper authentication allowing privilege elevation in Azure Active Directory (CVSS 10.0)
CVE-2026-47647
CVE-2026-47647: improper access control enabling privilege escalation in Microsoft Dynamics 365 (CVSS 9.9)
CVE-2026-48582
CVE-2026-48582: missing authorization in Microsoft Exchange Online (CVSS 9.6)
CVE-2026-48584
CVE-2026-48584: execution with unnecessary privileges in Azure Synapse (CVSS 9.9)
CVE-2026-50242
CVE-2026-50242: Auth Bypass via Direct DB Access in JetBrains Hub
CVE-2026-54130
CVE-2026-54130: missing authentication for critical function in M365 Copilot (CVSS 9.8)
CVE-2026-56141
CVE-2026-56141: Account Takeover via Predictable Restore Codes in Hub
CVE-2026-56142
CVE-2026-56142: Privilege Escalation in JetBrains Hub
CVE-2026-20181
CVE-2026-20181: Authenticated Command Execution in Cisco ISE
CVE-2026-20266
CVE-2026-20266: OS Command Execution via btool in Splunk AI Toolkit
CVE-2026-9862
CVE-2026-9862: OS command injection in boks_autoregisterd in Fortra Core Privileged Access Manager (CVSS 9.8)
CVE-2026-20253
CVE-2026-20253: unauthenticated arbitrary file write via PostgreSQL sidecar in Splunk Enterprise (CVSS 9.8)
CVE-2026-53469
CVE-2026-53469: Missing Authorization in Red Hat Migration Planner
CVE-2026-53470
CVE-2026-53470: ownership check bypass exposing presigned OVA URLs in migration-planner (CVSS 9.6)
CVE-2026-53471
CVE-2026-53471: missing source_id claim validation collapsing tenant isolation in migration-planner (CVSS 9.6)
CVE-2026-53474
CVE-2026-53474: SQL injection via crafted RVTools spreadsheet in migration-planner (CVSS 9.6)
CVE-2026-53475
CVE-2026-53475: Hardcoded Insecure TLS in Red Hat Assisted Migration Agent
CVE-2026-53476
CVE-2026-53476: path traversal via crafted tarball in assisted-migration-agent (CVSS 9.6)
CVE-2026-10520
CVE-2026-10520: unauthenticated root-level OS command injection in Ivanti Sentry (CVSS 10.0)
CVE-2026-10523
CVE-2026-10523: authentication bypass allowing admin account creation in Ivanti Sentry (CVSS 9.9)
CVE-2026-25089
CVE-2026-25089: unauthenticated OS command injection in Fortinet FortiSandbox (CVSS 9.8)
CVE-2026-27671
CVE-2026-27671: memory corruption via crafted RFC request in SAP Kernel (CVSS 9.8)
CVE-2026-34691
CVE-2026-34691: Stored XSS in Adobe Experience Manager Forms JEE
CVE-2026-40128
CVE-2026-40128: Path Traversal in SAP NetWeaver AS Java Web Container
CVE-2026-42904
CVE-2026-42904: heap-based buffer overflow enabling privilege escalation in Windows TCP/IP (CVSS 9.6)
CVE-2026-44748
CVE-2026-44748: XML signature verification bypass in SAP NetWeaver Application Server ABAP (CVSS 9.9)
CVE-2026-44815
CVE-2026-44815: stack-based buffer overflow enabling code execution in Windows DHCP Client (CVSS 9.8)
CVE-2026-45447
CVE-2026-45447: use-after-free during PKCS#7 signature verification in OpenSSL (CVSS 9.8)
CVE-2026-45602
CVE-2026-45602: no cwe for this issue in Windows DHCP Server (CVSS 9.1)
CVE-2026-45657
CVE-2026-45657: Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.
CVE-2026-47281
CVE-2026-47281: improper input validation in Visual Studio Code (CVSS 9.6)
CVE-2026-47291
CVE-2026-47291: integer overflow enabling code execution in Windows HTTP.sys (CVSS 9.8)
CVE-2026-47643
CVE-2026-47643: external control of file name or path in Azure Stack Edge (CVSS 9.8)
CVE-2026-47938
CVE-2026-47938: SSRF leading to arbitrary code execution in Adobe Campaign Classic (CVSS 10.0)
CVE-2026-48303
CVE-2026-48303: incorrect authorization leading to arbitrary code execution in Adobe Campaign Classic (CVSS 10.0)
CVE-2026-44631
CVE-2026-44631: buffer underwrite via crafted configuration regexes in Apache HTTP Server (CVSS 9.8)
CVE-2026-50751
CVE-2026-50751: Auth Bypass in Check Point VPN Remote Access (IKEv1)
CVE-2026-48567
CVE-2026-48567: Authentication Bypass in Microsoft Azure HorizonDB
CVE-2026-48579
CVE-2026-48579: Improper Authorization in Microsoft Exchange Online
CVE-2026-10840
CVE-2026-10840: Excessive RBAC permissions in Red Hat OpenShift Pipelines
CVE-2026-8037
CVE-2026-8037: OS command injection (RCE) in Progress LoadMaster
CVE-2025-14771
CVE-2025-14771: Files accessible to external parties in ABB T-MAC Plus
CVE-2026-42252
CVE-2026-42252: Command Injection in Apache Airflow
CVE-2026-8644
CVE-2026-8644: IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.
CVE-2026-9311
CVE-2026-9311: Remote Code Execution in IBM WebSphere Application Server
CVE-2026-9319
CVE-2026-9319: Remote code execution in IBM WebSphere Application Server
CVE-2026-0257
CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
CVE-2026-32998
CVE-2026-32998: Critical RCE in Veeam Service Provider Console and Backup & Replication
CVE-2026-42945
CVE-2026-42945: Critical RCE in NGINX ngx_http_rewrite_module (Public PoC Available)
CVE-2026-4408
CVE-2026-4408: Remote command execution in Samba
CVE-2025-12686
CVE-2025-12686: Buffer overflow RCE in Synology BeeStation Manager
CVE-2026-45321
CVE-2026-45321: TanStack Unspecified Vulnerability
CVE-2026-8175
CVE-2026-8175: Buffer overflow in IBM Aspera High-Speed Transfer Server
CVE-2026-23652
CVE-2026-23652: Command injection in Microsoft Power Pages
CVE-2026-2651
CVE-2026-2651: Broken access control in MLflow artifact upload
CVE-2026-33843
CVE-2026-33843: Authentication bypass in Microsoft Azure Active Directory B2C
CVE-2026-39821
CVE-2026-39821: Privilege escalation in Go golang.org/x/net/idna
CVE-2026-40411
CVE-2026-40411: Improper Input Validation in Azure Virtual Network Gateway
CVE-2026-40412
CVE-2026-40412: Unrestricted File Upload in Azure Orbital Spatio
CVE-2026-41090
CVE-2026-41090: Command injection in Microsoft Copilot
CVE-2026-41104
CVE-2026-41104: Untrusted Data Deserialization in Microsoft Planetary Computer Pro
CVE-2026-42901
CVE-2026-42901: Origin Validation Error in Microsoft Entra ID
CVE-2026-44930
CVE-2026-44930: LDAP Injection in Apache CXF (XKMS server)
CVE-2026-47280
CVE-2026-47280: Improper authentication in Microsoft Azure Resource Manager
CVE-2026-48172
CVE-2026-48172: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
CVE-2026-8633
CVE-2026-8633: Remote code execution in IBM WebSphere Application Server
CVE-2026-33000
CVE-2026-33000: Command injection in Ubiquiti UniFi OS
CVE-2026-34908
CVE-2026-34908: Improper access control in Ubiquiti UniFi OS
CVE-2026-34909
CVE-2026-34909: Path traversal in Ubiquiti UniFi OS
CVE-2026-34910
CVE-2026-34910: Command injection in Ubiquiti UniFi OS
CVE-2026-6960
CVE-2026-6960: Arbitrary file upload in WordPress BookingPress Pro plugin
CVE-2026-9082
CVE-2026-9082: Drupal Core SQL Injection Vulnerability
CVE-2026-5433
CVE-2026-5433: Command injection in Honeywell Control Network Module (CNM)
CVE-2026-6279
CVE-2026-6279: Unauthenticated RCE in WordPress Avada Builder plugin
CVE-2008-4250
CVE-2008-4250: 2008 Vulnerability Now Actively Exploited (Microsoft)
CVE-2009-1537
CVE-2009-1537: 2009 Vulnerability Now Actively Exploited (Microsoft)
CVE-2009-3459
CVE-2009-3459: 2009 Vulnerability Now Actively Exploited (Adobe)
CVE-2010-0806
CVE-2010-0806: 2010 Vulnerability Now Actively Exploited (Microsoft)
CVE-2026-20223
CVE-2026-20223: Critical Authentication Bypass in Cisco Secure Workload
CVE-2026-24207
CVE-2026-24207: Authentication bypass in NVIDIA Triton Inference Server
CVE-2026-45444
CVE-2026-45444: Arbitrary file upload in Gift Cards For WooCommerce Pro (plugin)
CVE-2026-6555
CVE-2026-6555: Arbitrary File Upload in WordPress ProSolution WP Client (plugin)
CVE-2026-7637
CVE-2026-7637: PHP Object Injection in WordPress Boost (plugin)
CVE-2026-8495
CVE-2026-8495: Missing Authorization in Drupal Date iCal
CVE-2026-8598
CVE-2026-8598: Unauthenticated config export port in ZKTeco CCTV Camera
CVE-2026-2586
CVE-2026-2586: Authenticated RCE in Eclipse GlassFish Admin Console
CVE-2026-2587
CVE-2026-2587: Server-side EL injection RCE in Eclipse GlassFish
CVE-2026-2611
CVE-2026-2611: Improper origin validation RCE in MLflow Assistant
CVE-2026-31986
CVE-2026-31986: Hard-coded cryptographic key in Apache OFBiz
CVE-2026-41919
CVE-2026-41919: LDAP Injection in Apache OFBiz
CVE-2026-43633
CVE-2026-43633: Unauthenticated Deserialization RCE in HestiaCP
CVE-2026-4883
CVE-2026-4883: Arbitrary File Upload in WordPress Piotnet Forms plugin
CVE-2026-4885
CVE-2026-4885: Arbitrary File Upload in WordPress Piotnet Addons for Elementor Pro
CVE-2026-8948
CVE-2026-8948: Same-Origin Policy Bypass in Mozilla Firefox
CVE-2026-8953
CVE-2026-8953: Use-after-free sandbox escape in Mozilla Firefox
CVE-2026-8959
CVE-2026-8959: Sandbox Escape in Mozilla Firefox
CVE-2026-8974
CVE-2026-8974: Memory safety bugs in Mozilla Firefox
CVE-2026-7301
CVE-2026-7301: Unauthenticated RCE in SGLang multimodal runtime
CVE-2026-7304
CVE-2026-7304: Unauthenticated RCE in SGLang custom logit processor
CVE-2018-25332
CVE-2018-25332: Unauthenticated RCE in GitBucket
CVE-2026-5229
CVE-2026-5229: Authentication Bypass in WordPress Form Notify plugin
CVE-2026-8398
CVE-2026-8398: Supply chain attack trojanizing DAEMON Tools Lite installers
CVE-2026-20182
CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
CVE-2026-41615
CVE-2026-41615: Information Disclosure in Microsoft Authenticator
CVE-2026-6510
CVE-2026-6510: Privilege Escalation in WordPress InfusedWoo Pro plugin
CVE-2026-8181
CVE-2026-8181: Authentication bypass in WordPress Burst Statistics (plugin)
CVE-2026-8511
CVE-2026-8511: Use-after-free in UI in Google Chrome (sandbox escape)
CVE-2026-8580
CVE-2026-8580: Use-after-free in Mojo in Google Chrome (sandbox escape)
CVE-2025-11159
CVE-2025-11159: Remote Code Execution via JDBC in Hitachi Vantara Pentaho
CVE-2026-41225
CVE-2026-41225: Arbitrary Command Execution in F5 BIG-IP iControl REST
CVE-2025-40949
CVE-2025-40949: Unauthenticated RCE in Siemens RUGGEDCOM ROX
CVE-2026-22924
CVE-2026-22924: Resource Exhaustion DoS in Siemens SIMATIC CN 4100
CVE-2026-25786
CVE-2026-25786: Stored XSS via PLC Name in Siemens SIMATIC Web Interface
CVE-2026-25787
CVE-2026-25787: Stored XSS via Technology Object Name in Siemens SIMATIC
CVE-2026-26083
CVE-2026-26083: Missing authorization in Fortinet FortiSandbox
CVE-2026-29204
CVE-2026-29204: Insufficient ownership checks in cPanel clientarea.php
CVE-2026-33117
CVE-2026-33117: Improper authentication in Azure SDK allows security feature bypass
CVE-2026-34260
CVE-2026-34260: SQL Injection in SAP S/4HANA Enterprise Search for ABAP
CVE-2026-34263
CVE-2026-34263: Unauthenticated Code Injection in SAP Commerce Cloud
CVE-2026-40379
CVE-2026-40379: Sensitive Information Exposure in Azure Entra ID
CVE-2026-40402
CVE-2026-40402: Use-After-Free Privilege Escalation in Microsoft Windows Hyper-V
CVE-2026-41089
CVE-2026-41089: Stack-based Buffer Overflow in Microsoft Windows Netlogon
CVE-2026-41096
CVE-2026-41096: Heap-based Buffer Overflow in Microsoft Windows DNS
CVE-2026-41551
CVE-2026-41551: Path Traversal in Siemens ROS#
CVE-2026-42823
CVE-2026-42823: Improper Access Control in Azure Logic Apps
CVE-2026-42833
CVE-2026-42833: Execution with Unnecessary Privileges in Microsoft Dynamics 365
CVE-2026-42898
CVE-2026-42898: Code Injection in Microsoft Dynamics 365 (on-premises)
CVE-2026-44277
CVE-2026-44277: Improper Access Control in Fortinet FortiAuthenticator
CVE-2026-8043
CVE-2026-8043: File name external control in Ivanti Xtraction
CVE-2026-40636
CVE-2026-40636: Hard-coded Credentials in Dell ECS and ObjectScale
CVE-2026-33109
CVE-2026-33109: Improper access control in Azure Managed Instance for Apache Cassandra
CVE-2026-33823
CVE-2026-33823: Improper authorization in Microsoft Teams allows information disclosure
CVE-2026-33844
CVE-2026-33844: Improper Input Validation in Azure Managed Instance for Apache Cassandra
CVE-2026-35428
CVE-2026-35428: Command Injection in Azure Cloud Shell
CVE-2026-42826
CVE-2026-42826: Sensitive Information Exposure in Azure DevOps
CVE-2026-40982
CVE-2026-40982: Directory Traversal in VMware Spring Cloud Config
CVE-2026-28780
CVE-2026-28780: Heap-based buffer overflow in Apache HTTP Server mod_proxy_ajp
CVE-2026-25293
CVE-2026-25293: Buffer overflow in Qualcomm PLC Firmware
CVE-2026-42376
CVE-2026-42376: Hardcoded telnet backdoor in D-Link DIR-456U
CVE-2026-42796
CVE-2026-42796: Unauthenticated RCE in Arelle (/rest/configure)
CVE-2026-42809
CVE-2026-42809: Privilege escalation in Apache Polaris via vended storage credentials
CVE-2026-42812
CVE-2026-42812: Metadata validation bypass in Apache Polaris (Iceberg)
CVE-2026-7482
CVE-2026-7482: Heap out-of-bounds read in Ollama (GGUF loader)
CVE-2026-4882
CVE-2026-4882: Arbitrary file upload in WordPress User Registration Advanced Fields
CVE-2026-7458
CVE-2026-7458: Authentication bypass in WordPress User Verification by PickPlugins
CVE-2026-42483
CVE-2026-42483: Heap buffer overflow in hashcat Kerberos hash parser
CVE-2026-42778
CVE-2026-42778: Incomplete deserialization fix in Apache MINA (2.1.X/2.2.X branches)
CVE-2026-42779
CVE-2026-42779: Deserialization allowlist bypass in Apache MINA (2.1.X/2.2.X)
CVE-2026-7567
CVE-2026-7567: Authentication bypass in WordPress Temporary Login plugin
CVE-2026-41940
CVE-2026-41940: Authentication bypass in cPanel & WHM login flow
CVE-2026-42523
CVE-2026-42523: Stored XSS in Jenkins GitHub Plugin
CVE-2026-40976
CVE-2026-40976: Spring Boot default web security ineffective, allows unauthorized access
CVE-2026-33453
CVE-2026-33453: Header injection in Apache Camel camel-coap leads to RCE
CVE-2026-33454
CVE-2026-33454: Header injection in Apache Camel camel-mail
CVE-2026-40453
CVE-2026-40453: Incomplete header filter fix in Apache Camel
CVE-2026-40860
CVE-2026-40860: Unsafe JMS ObjectMessage deserialization in Apache Camel
CVE-2024-57726
CVE-2024-57726: 2024 Vulnerability Now Actively Exploited (SimpleHelp )
CVE-2026-1952
CVE-2026-1952: Denial of service in Delta Electronics AS320T
CVE-2026-21515
CVE-2026-21515: Privilege escalation in Microsoft Azure IoT Central
CVE-2026-24303
CVE-2026-24303: Privilege escalation in Microsoft Partner Center via improper access control
CVE-2026-32210
CVE-2026-32210: SSRF in Microsoft Dynamics 365 (Online)
CVE-2026-33102
CVE-2026-33102: Open redirect in Microsoft M365 Copilot
CVE-2026-33819
CVE-2026-33819: Deserialization of untrusted data in Microsoft Bing - RCE
CVE-2026-35431
CVE-2026-35431: SSRF in Microsoft Entra ID Entitlement Management
CVE-2026-29198
CVE-2026-29198: NoSQL injection and account takeover in Rocket.Chat
CVE-2026-1555
CVE-2026-1555: Arbitrary file upload in WebStack theme for WordPress
CVE-2026-34279
CVE-2026-34279: Scope-change compromise in Oracle Enterprise Manager Event Management
CVE-2026-34286
CVE-2026-34286: Unauthenticated data tampering in Oracle Identity Manager Connector (Fusion Middleware)
CVE-2026-40050
CVE-2026-40050: Unauthenticated path traversal in CrowdStrike LogScale
CVE-2026-6768
CVE-2026-6768: Mitigation bypass in Firefox Networking Cookies component
CVE-2025-32975
CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
CVE-2026-33557
CVE-2026-33557: SASL OAuth JWT validation flaw in Apache Kafka
CVE-2026-25917
CVE-2026-25917: XCom arbitrary code execution by DAG authors in Apache Airflow
CVE-2025-41118
CVE-2025-41118: Data handling vulnerability in Grafana Pyroscope
CVE-2026-20147
CVE-2026-20147: Authenticated command execution in Cisco ISE
CVE-2026-20180
CVE-2026-20180: Authenticated command execution in Cisco Identity Services Engine
CVE-2026-20184
CVE-2026-20184: SSO impersonation in Cisco Webex Services Control Hub
CVE-2026-20186
CVE-2026-20186: Authenticated command execution in Cisco Identity Services Engine
CVE-2026-27304
CVE-2026-27304: Improper input validation leading to RCE in Adobe ColdFusion
CVE-2026-6296
CVE-2026-6296: Buffer overflow in Google Chrome
CVE-2026-39808
Critical Vulnerabilities in Fortinet Products – FortiSandbox, FortiDDoS-F, and FortiAnalyzer Cloud (April 2026)
CVE-2009-0238
CVE-2009-0238: 2009 Vulnerability Now Actively Exploited (Microsoft)
CVE-2026-26149
CVE-2026-26149: Security feature bypass in Microsoft Power Apps
CVE-2026-27681
CVE-2026-27681: Critical SQL Injection Vulnerability in SAP Business Planning and Consolidation and SAP Business
CVE-2026-33824
CVE-2026-33824: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-38526
CVE-2026-38526: Arbitrary file upload in Krayin Krayin CRM
CVE-2026-39808
CVE-2026-39808: OS command injection in Fortinet FortiSandbox
CVE-2026-39813
CVE-2026-39813: Path traversal in Fortinet FortiSandbox
CVE-2026-5752
CVE-2026-5752: Sandbox escape via prototype chain in Terrarium
CVE-2026-21643
CVE-2026-21643: Fortinet SQL Injection Vulnerability
CVE-2026-34621
CVE-2026-34621: Prototype pollution leading to RCE in Adobe Acrobat Reader
CVE-2026-33784
CVE-2026-33784: Default password in Juniper Networks Support Insights
CVE-2026-34424
CVE-2026-34424: Backdoored Smart Slider 3 Pro plugin for WordPress
CVE-2026-6057
CVE-2026-6057: Arbitrary file upload in FalkorDB Browser
CVE-2025-57735
CVE-2025-57735: JWT token reuse after logout in Apache Airflow
CVE-2026-1340
CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
CVE-2026-1346
CVE-2026-1346: Local privilege escalation to root in IBM Security Verify Access
CVE-2026-25776
CVE-2026-25776: Perl code injection in Movable Type
CVE-2026-3535
CVE-2026-3535: Arbitrary file upload in WordPress
CVE-2021-4473
CVE-2021-4473: Command injection in Tianxin Internet Behavior Management System
CVE-2026-0740
CVE-2026-0740: Arbitrary file upload in Ninja Forms File Uploads plugin for WordPress
CVE-2026-22679
CVE-2026-22679: Unauthenticated RCE via Dubbo debug endpoint in Weaver E-cology
CVE-2026-23696
CVE-2026-23696: SQL injection in Windmill
CVE-2026-4631
CVE-2026-4631: SSH command injection via login endpoint in Cockpit
CVE-2018-25236
CVE-2018-25236: Authentication bypass in Hirschmann HiOS/HiSecOS management
CVE-2018-25237
CVE-2018-25237: Buffer overflow in Hirschmann HiSecOS
CVE-2021-4477
CVE-2021-4477: IPv6 IPsec firewall bypass in Hirschmann HiLCOS OpenBAT
CVE-2026-35616
CVE-2026-35616: Access control bypass in Fortinet Forticlientems
CVE-2017-20237
CVE-2017-20237: Authentication bypass in Hirschmann Industrial HiVision
CVE-2026-0545
CVE-2026-0545: Unauthenticated RCE via job endpoints in MLflow
CVE-2026-26135
CVE-2026-26135: SSRF in Microsoft Azure Custom Locations Resource Provider
CVE-2026-32211
CVE-2026-32211: Missing authentication in Azure MCP Server
CVE-2026-32213
CVE-2026-32213: Improper authorization in Azure AI Foundry
CVE-2026-33105
CVE-2026-33105: Improper authorization in Microsoft Azure Kubernetes Service
CVE-2026-33107
CVE-2026-33107: SSRF in Azure Databricks
CVE-2026-2699
CVE-2026-2699: Unauthenticated configuration access in Citrix ShareFile Storage Zones Controller
CVE-2026-2701
CVE-2026-2701: Authenticated file upload RCE in Citrix ShareFile Storage Zones Controller
CVE-2026-20093
CVE-2026-20093: Authentication bypass in Cisco Integrated Management Controller
CVE-2026-20160
CVE-2026-20160: Unauthenticated command execution in Cisco Smart Software Manager On-Prem
CVE-2026-29014
CVE-2026-29014: Unauthenticated PHP code injection in MetInfo CMS
CVE-2026-5290
CVE-2026-5290: Use-after-free in Google Chrome
CVE-2026-1579
CVE-2026-1579: Unauthenticated command execution via unsigned MAVLink in PX4 Autopilot
CVE-2026-33579
CVE-2026-33579: Privilege escalation in Openclaw
CVE-2026-3300
CVE-2026-3300: PHP code injection RCE in Everest Forms Pro plugin for WordPress
CVE-2026-4257
CVE-2026-4257: Remote code execution in WordPress
CVE-2026-34714
CVE-2026-34714: Code execution via crafted file in Vim
CVE-2026-22738
CVE-2026-22738: SpEL injection in Spring AI SimpleVectorStore
CVE-2026-27876
CVE-2026-27876: Remote code execution in Grafana
CVE-2026-4809
CVE-2026-4809: Arbitrary file upload in Laravel
CVE-2026-20688
CVE-2026-20688: Sandbox escape via path handling in Apple iOS/iPadOS
CVE-2026-28827
CVE-2026-28827: Sandbox escape via directory path parsing in Apple macOS
CVE-2026-28858
CVE-2026-28858: Critical Vulnerability in Apple iOS - Immediate Update Required
CVE-2026-33017
CVE-2026-33017: Langflow Code Injection Vulnerability
CVE-2026-4001
CVE-2026-4001: Critical Vulnerability in WordPress Woocommerce Custom Product Addons Pro - Immediate Update Required
CVE-2026-3587
CVE-2026-3587: Critical Vulnerability in Embedded Device CLI - Immediate Update Required
CVE-2026-21992
CVE-2026-21992: Critical Vulnerability in Oracle Oracle Identity Manager - Immediate Update Required
CVE-2026-22732
CVE-2026-22732: Critical Vulnerability in VMware Spring Security - Immediate Update Required
CVE-2026-32194
CVE-2026-32194: Critical Vulnerability in Microsoft Bing Images - Immediate Update Required
CVE-2026-20131
CVE-2026-20131: unauthenticated RCE as root in Cisco Secure Firewall Management Center (CVSS 10.0)
CVE-2026-22557
CVE-2026-22557: Critical Path Traversal in Ubiquiti UniFi Network (CVSS 10.0)
CVE-2026-27542
CVE-2026-27542: Critical Vulnerability in Woocommerce Wholesale Lead Capture - Immediate Update Required
CVE-2026-28363
CVE-2026-28363: tools.exec.safeBins validation bypass in OpenClaw
CVE-2026-20127
CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
CVE-2026-26980
CVE-2026-26980: Unauthenticated database read in Ghost CMS
CVE-2026-22769
CVE-2026-22769: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
CVE-2026-1731
CVE-2026-1731: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
CVE-2026-24423
CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
CVE-2026-1281
CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
CVE-2026-24858
CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE-2026-23760
CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE-2026-24061
CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability
CVE-2025-15036
CVE-2025-15036: Path traversal in MLflow extract_archive_to_dir
CVE-2025-15379
CVE-2025-15379: Command injection in MLflow model serving
CVE-2025-53521
CVE-2025-53521: F5 BIG-IP Unspecified Vulnerability
CVE-2025-71275
CVE-2025-71275: Critical Vulnerability in Zimbra Zimbra Collaboration Suite - Immediate Update Required
CVE-2025-32432
CVE-2025-32432: High-Risk Craft CMS Vulnerability (EPSS: 79%)
CVE-2025-54068
CVE-2025-54068: Laravel Livewire Code Injection Vulnerability
CVE-2025-68613
CVE-2025-68613: High-Risk n8n Vulnerability (EPSS: 79%)
CVE-2025-26399
CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
CVE-2025-40538
CVE-2025-40538: Access control bypass in Solarwinds Serv-U
CVE-2025-40539
CVE-2025-40539: Type confusion leading to RCE in SolarWinds Serv-U
CVE-2025-40540
CVE-2025-40540: Type confusion leading to RCE in SolarWinds Serv-U
CVE-2025-40541
CVE-2025-40541: IDOR leading to RCE in SolarWinds Serv-U
CVE-2025-49113
CVE-2025-49113: High-Risk Webmail Vulnerability (EPSS: 90%)
CVE-2025-13590
CVE-2025-13590: Remote code execution in Wso2 Api Control Plane
CVE-2025-11953
CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability
CVE-2025-40551
CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
CVE-2025-52691
CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2017-20229
CVE-2017-20229: Buffer overflow in Invisible Island Mawk
CVE-2018-25223
CVE-2018-25223: Buffer overflow in Ftnapps Crashmail Ii
CVE-2006-10003
CVE-2006-10003: Critical buffer overflow in Perl XML::Parser - Immediate Update Required
CVE-2017-7921
CVE-2017-7921: 2017 Vulnerability Now Actively Exploited (Hikvision)
CVE-2021-22681
CVE-2021-22681: 2021 Vulnerability Now Actively Exploited (Rockwell)
CVE-2008-0015
CVE-2008-0015: 2008 Vulnerability Now Actively Exploited (Microsoft)
CVE-2020-7796
CVE-2020-7796: 2020 Vulnerability Now Actively Exploited (Synacor)
CVE-2024-43468
CVE-2024-43468: 2024 Vulnerability Now Actively Exploited (Microsoft)
CVE-2019-19006
CVE-2019-19006: 2019 Vulnerability Now Actively Exploited (Sangoma)
High (CVSS 7.0-8.9)
CVE-2026-119977
CVE-2026-119977: RCE During WordPress Core Upgrades (CISA KEV)
CVE-2026-111357
CVE-2026-111357: Privilege Escalation in Ivanti Connect Secure (Exploited)
CVE-2026-76418
CVE-2026-76418: Actively Exploited DoS in Cisco ASA and FTD SSL VPN
CVE-2026-46300
CVE-2026-46300: Actively Exploited Linux Kernel Flaw Chained with PHP2Shell
CVE-2026-109619
CVE-2026-109619 (PHP2Shell): Use-After-Free via Stale Request State in PHP
CVE-2026-86950
CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability
CVE-2026-65660
CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
CVE-2026-87902
CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability
CVE-2026-7273
CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
CVE-2025-39964
CVE-2025-39964: Race Condition on Concurrent AF_ALG Socket Writes in the Linux Kernel
CVE-2026-53266
CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
CVE-2026-42016
CVE-2026-42016: Privilege Escalation via Token Scope in JFrog Artifactory
CVE-2026-42018
CVE-2026-42018: Anonymous Token Leak in JFrog Artifactory
CVE-2026-67277
CVE-2026-67277: Missing Authentication in the MikroTik RouterOS btest Service
CVE-2025-25249
CVE-2025-25249: Heap Buffer Overflow in FortiOS, FortiSwitchManager and FortiSASE
CVE-2026-87491
CVE-2026-87491: Out-of-Bounds Write in the Chromium V8 Engine
CVE-2026-81963
CVE-2026-81963 and CVE-2026-85880: Two Actively Exploited Windows Privilege Escalation Flaws
CVE-2026-85046
CVE-2026-85046: Actively Exploited V8 Flaw in Google Chrome
CVE-2026-59822
CVE-2026-59822: Authentication Bypass in LiteLLM — The AI Gateway Let Requests Through Without a Key
CVE-2026-53362
CVE-2026-53362: Privilege Escalation via Linux Kernel IPv6 Subsystem
CVE-2015-5287
CVE-2015-5287: Privilege Escalation in Red Hat ABRT via Symlink Attack
CVE-2019-1068
CVE-2019-1068: Remote Code Execution in Microsoft SQL Server
CVE-2021-23758
CVE-2021-23758: Untrusted Deserialization in Ajax.NET Professional
CVE-2022-0995
CVE-2022-0995: Out-of-Bounds Write in Linux Kernel watch_queue
CVE-2026-73570
CVE-2026-73570: Remote Code Execution in Zimbra Collaboration Suite
CVE-2021-27137
CVE-2021-27137: 2021 Vulnerability Now Actively Exploited (DD-WRT)
CVE-2023-4346
CVE-2023-4346: 2023 Vulnerability Now Actively Exploited (KNX Association)
CVE-2026-56155
CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
CVE-2026-45659
CVE-2026-45659: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
CVE-2026-54420
CVE-2026-54420: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
CVE-2026-11645
CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
CVE-2026-20245
CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
CVE-2026-42271
CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability
CVE-2026-50752
CVE-2026-50752: Site-to-Site VPN Certificate Bypass in Check Point (IKEv1)
CVE-2026-28318
CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
CVE-2026-20230
CVE-2026-20230: SSRF and Arbitrary File Write in Cisco Unified CM (CUCM)
CVE-2026-9614
CVE-2026-9614: Privilege Escalation in Ivanti Neurons for ITSM
CVE-2010-0249
CVE-2010-0249: 2010 Vulnerability Now Actively Exploited (Microsoft)
CVE-2022-0492
CVE-2022-0492: 2022 Vulnerability Now Actively Exploited (Linux)
CVE-2025-48595
CVE-2025-48595: Android Framework Integer Overflow Vulnerability
CVE-2024-21182
CVE-2024-21182: 2024 Vulnerability Now Actively Exploited (Oracle)
CVE-2026-32996
CVE-2026-32996: High-Severity Arbitrary File Write / Privilege Escalation in Veeam
CVE-2026-32997
CVE-2026-32997: High-Severity Arbitrary File Write / Privilege Escalation in Veeam
CVE-2026-34927
CVE-2026-34927: Local Privilege Escalation in Trend Micro Apex One / Vision One SEP Agent
CVE-2026-34928
CVE-2026-34928: LPE in Trend Micro Apex One / Vision One SEP Agent (Named Pipe)
CVE-2026-34929
CVE-2026-34929: LPE in Trend Micro Apex One / Vision One SEP Agent (IPC)
CVE-2026-34930
CVE-2026-34930: LPE in Trend Micro Apex One / Vision One SEP Agent (Process Protection)
CVE-2026-40701
CVE-2026-40701: High-Severity Denial of Service in NGINX (Bundle K000160932)
CVE-2026-42934
CVE-2026-42934: High-Severity Out-of-Bounds Read in NGINX (Bundle K000160932)
CVE-2026-42946
CVE-2026-42946: High-Severity Use-After-Free in NGINX (Bundle K000160932)
CVE-2026-45206
CVE-2026-45206: LPE in Trend Micro Apex One / Vision One SEP Agent
CVE-2026-45207
CVE-2026-45207: LPE in Trend Micro Apex One / Vision One SEP Agent
CVE-2026-45208
CVE-2026-45208: TOCTOU LPE in Trend Micro Apex One / Vision One SEP Agent
CVE-2026-41091
CVE-2026-41091: Microsoft Defender Link Following Vulnerability
CVE-2026-42897
CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability
CVE-2026-6973
CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
CVE-2026-31431
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
CVE-2024-1708
CVE-2024-1708: 2024 Vulnerability Now Actively Exploited (ConnectWise)
CVE-2024-57728
CVE-2024-57728: 2024 Vulnerability Now Actively Exploited (SimpleHelp )
CVE-2024-7399
CVE-2024-7399: 2024 Vulnerability Now Actively Exploited (Samsung)
CVE-2025-29635
CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability
CVE-2026-33825
CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability
CVE-2023-27351
CVE-2023-27351: 2023 Vulnerability Now Actively Exploited (PaperCut)
CVE-2024-27199
CVE-2024-27199: 2024 Vulnerability Now Actively Exploited (JetBrains)
CVE-2025-2749
CVE-2025-2749: Kentico Xperience Path Traversal Vulnerability
CVE-2026-20128
CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
CVE-2026-34197
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
CVE-2026-34256
CVE-2026-34256: Missing Authorization Check in SAP ERP and SAP S/4HANA
CVE-2012-1854
CVE-2012-1854: 2012 Vulnerability Now Actively Exploited (Microsoft)
CVE-2020-9715
CVE-2020-9715: 2020 Vulnerability Now Actively Exploited (Adobe)
CVE-2023-21529
CVE-2023-21529: 2023 Vulnerability Now Actively Exploited (Microsoft)
CVE-2023-36424
CVE-2023-36424: 2023 Vulnerability Now Actively Exploited (Microsoft)
CVE-2025-60710
CVE-2025-60710: Microsoft Windows Link Following Vulnerability
CVE-2026-0233
CVE-2026-0233 and CVE-2026-0234: Critical Vulnerabilities in Palo Alto Networks Cortex XSOAR, XSIAM and ADEM - Immediate Update Required
CVE-2026-4112
CVE-2026-4112: Critical Privilege Escalation Vulnerability in SonicWall SMA 1000 - Immediate Update Required
CVE-2026-3502
CVE-2026-3502: TrueConf Client Download of Code Without Integrity Check Vulnerability
CVE-2026-5281
CVE-2026-5281: Google Dawn Use-After-Free Vulnerability
CVE-2026-22558
CVE-2026-22558: Ubiquiti UniFi Network NoSQL Injection Vulnerability (CVSS 7.7)
CVE-2026-23554
CVE-2026-23554: Critical Citrix XenServer Vulnerability - Host Memory Leak from Guest VM
CVE-2026-20963
CVE-2026-20963: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
CVE-2026-1603
CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
CVE-2026-21385
CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability
CVE-2026-25108
CVE-2026-25108: Soliton Systems K.K FileZen OS Command Injection Vulnerability
CVE-2026-2441
CVE-2026-2441: Google Chromium CSS Use-After-Free Vulnerability
CVE-2026-20700
CVE-2026-20700: Apple Multiple Buffer Overflow Vulnerability
CVE-2026-21510
CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability
CVE-2026-21513
CVE-2026-21513: Microsoft Internet Explorer Protection Mechanism Failure Vulnerability
CVE-2026-21514
CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
CVE-2026-21519
CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability
CVE-2026-21533
CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability
CVE-2026-21509
CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability
CVE-2025-31277
CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability
CVE-2025-43510
CVE-2025-43510: Apple Multiple Products Improper Locking Vulnerability
CVE-2025-43520
CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability
CVE-2025-66376
CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
CVE-2025-68461
CVE-2025-68461: RoundCube Webmail Cross-site Scripting Vulnerability
CVE-2025-40536
CVE-2025-40536: SolarWinds Web Help Desk Security Control Bypass Vulnerability
CVE-2025-64328
CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability
CVE-2021-22054
CVE-2021-22054: 2021 Vulnerability Now Actively Exploited (Omnissa)
CVE-2021-30952
CVE-2021-30952: 2021 Vulnerability Now Actively Exploited (Apple)
CVE-2023-41974
CVE-2023-41974: 2023 Vulnerability Now Actively Exploited (Apple)
CVE-2023-43000
CVE-2023-43000: 2023 Vulnerability Now Actively Exploited (Apple)
CVE-2022-20775
CVE-2022-20775: 2022 Vulnerability Now Actively Exploited (Cisco)
CVE-2024-7694
CVE-2024-7694: 2024 Vulnerability Now Actively Exploited (TeamT5)
CVE-2018-14634
CVE-2018-14634: 2018 Vulnerability Now Actively Exploited (Linux)
Other
CVE-2026-118527
CVE-2026-118527: Predictable Identifiers in Ivanti Connect Secure (Exploited)
CVE-2026-81578
CVE-2026-81578: Missing Authentication in PaperCut NG/MF - Active Exploitation (CISA KEV)
CVE-2026-82078
CVE-2026-82078: Actively Exploited Vulnerability in PaperCut NG/MF (CISA KEV)
CVE-2025-62593
CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability
CVE-2026-15409
CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
CVE-2026-15410
CVE-2026-15410: SonicWall SMA1000 Appliances Code Injection Vulnerability
CVE-2026-12569
CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability
CVE-2025-67038
CVE-2025-67038: Lantronix EDS5000 Code Injection Vulnerability
CVE-2026-48907
CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability
CVE-2026-34926
CVE-2026-34926: Trend Micro Apex One Server Directory Traversal - Actively Exploited (ITW)
CVE-2026-48027
CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability
CVE-2026-42208
CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability
CVE-2026-0300
CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
CVE-2026-39987
CVE-2026-39987: Marimo Remote Code Execution Vulnerability
CVE-2026-32201
CVE-2026-32201: Microsoft SharePoint Server Improper Input Validation Vulnerability
CVE-2026-3055
CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability
CVE-2026-33634
CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability
CVE-2026-3909
CVE-2026-3909: Google Skia Out-of-Bounds Write Vulnerability
CVE-2026-3910
CVE-2026-3910: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
CVE-2025-15556
CVE-2025-15556: Notepad++ Download of Code Without Integrity Check Vulnerability
Data Sources
We publish alerts based on official government sources:
Want to Reduce IT Risk and Costs?
Book a free consultation - we respond within 24h
Or download free guide:
E-book: Digital Resilience Strategy 2026