Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2026-33017, CVE-2026-21858, and CVE-2025-68613 are high-severity flaws in Citrix NetScaler exploited in active attacks by a China-based actor. Immediate patching is critical.
CVE-2026-8233 (high severity) exposes 4G and 5G core networks to remote session hijacking and denial-of-service. Patch Dotouch systems immediately; remediation ongoing for other carriers.
CVE-2026-42897 is a critical zero-day in Microsoft Exchange Outlook Web Access exploited in the wild to deploy persistent backdoors. Immediate patching is mandatory.
CVE-2026-33017 is a high-severity vulnerability exploited in the wild by a Chinese-speaking threat actor using autonomous AI-driven attack workflows. Immediate patching is critical to prevent automated exploitation.
CVE-2026-10702 (high severity) enables remote code execution in Firefox and Tor Browser via a malicious webpage. Patch to 151.0.3 immediately.
CVE-2026-42897 is a critical zero-day in Microsoft Exchange OWA exploited in the wild for persistent mailbox access. Patch immediately to prevent credential theft.
CVE-2026-16812 is a critical command injection flaw in Arista VeloCloud Orchestrator, actively exploited for remote code execution. CISA mandates patching by July 30, 2026.
CVE-2013-4786 (high severity) exposes over 24,650 Dell, Supermicro, HPE, and GPU provider BMCs to remote hash theft and offline password cracking. No patch exists; immediate isolation is required.
CVE-2026-16232 is a critical authentication bypass (actively exploited) in Check Point SmartConsole, enabling remote admin takeover. Immediate patching is mandatory.
CVE-2026-16723 is a critical, actively exploited remote code execution vulnerability in Alibaba FastJson (v1.2.68–1.2.83). No patch is available yet; urgent mitigation is required.
CVE-2026-12569 is a critical, actively exploited vulnerability in PTC Windchill and FlexPLM enabling unauthenticated remote code execution. Immediate patching is mandatory to prevent ransomware and data theft.
CVE-2025-66376 is a high-severity Zimbra webmail vulnerability exploited in the wild for zero-click phishing by Russia-linked actors. Immediate patching is critical.