Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
228 articles
CVE-2026-55200 and related critical CVEs impact Libssh2, Linux kernel, and major open-source projects, enabling remote code execution and privilege escalation. Immediate patching is mandatory; some vulnerabilities remain unpatched and are under active exploitation.
CVE-2026-14191 (high severity) enables remote code execution in WinRAR via crafted .rev files. Patch to version 7.23 immediately; no auto-update available.
CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-49975, and CVE-2026-13474 are high-severity flaws in Citrix NetScaler ADC and Gateway. Immediate patching is required to prevent denial-of-service and information disclosure.
CVE-2026-8037 is a critical pre-auth remote code execution flaw in Progress Kemp LoadMaster under active exploitation. Patch immediately to prevent compromise.
CVE-2026-46817 is a critical, actively exploited flaw in Oracle E-Business Suite Payments (CVSS 9.8) enabling unauthenticated system takeover. Patch immediately if not already applied.
CVE-2026-8037 is a critical pre-auth remote code execution flaw in Progress Kemp LoadMaster, enabling root access via API. Patch immediately to eliminate risk.
CVE-2026-12569 is a critical, actively exploited vulnerability in PTC Windchill and FlexPLM enabling unauthenticated remote code execution. Patch immediately; exploitation confirmed in the wild as of June 18, 2026.
CVE-2026-46331 is a critical Linux kernel vulnerability enabling local root privilege escalation via act_pedit. Patch immediately; public exploit exists.
CVE-2026-46331 is a critical Linux kernel vulnerability enabling local root escalation via act_pedit COW cache poisoning. Patch immediately to prevent undetected root compromise.
CVE-2026-12957 and CVE-2026-12958 are high-severity flaws in Amazon Q Developer for VS Code enabling cloud credential theft via malicious repositories. Patch immediately to prevent compromise.
CVE-2026-20230 is a critical SSRF flaw in Cisco Unified Communications Manager Server, actively exploited and under CISA patch deadline for federal agencies.
CVE-2026-46529 is a critical remote code execution vulnerability in Atril software, enabling attackers to compromise systems with a single user click. Immediate patching is required.