Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2026-16723 is a high-severity remote code execution flaw in Alibaba Fastjson 1.x, actively exploited with no patch available. Immediate mitigation is required.
CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, and CVE-2026-8314 are high-severity flaws in Rockwell Arena Simulation (≤17.00.00) enabling code execution via malicious files. Patch to 17.00.01 immediately.
CVE-2026-25589 and CVE-2026-25243 are high-severity Redis vulnerabilities enabling authenticated remote code execution. Patch all affected Redis instances by July 23, 2026.
CVE-2026-0257 is a critical authentication bypass in Palo Alto GlobalProtect VPN, exploited in June 2026 for ransomware attacks. Patch immediately to prevent compromise.
CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305 are critical Windows vulnerabilities (CVSS 9.8) exploited in active JadeProx attacks. Patch all affected systems immediately.
CVE-2025-66376 is a high-severity zero-click vulnerability in Zimbra Collaboration Suite, actively exploited for credential and data theft. Immediate patching is critical.
CVE-2026-48294 is a high-severity flaw in the Adobe Acrobat Chrome extension that enabled theft of WhatsApp data from 329 million browsers. Patch released June 2026.
CVE-2026-41940 (high severity) enables attackers to exploit cPanel and WHM via compromised GitHub Actions workflows. Immediate patching is required to prevent credential theft and further exploitation.
CVE-2026-0257 is a high-severity authentication bypass in Palo Alto Networks PAN-OS, exploited in June 2026 for ransomware deployment. Immediate patching is critical.
CVE-2026-6875 is a critical, actively exploited vulnerability in the ServiceNow AI Platform enabling unauthenticated code execution. Immediate patching is required; ServiceNow released fixes in June 2026.
CVE-2026-6875 is a critical pre-auth remote code execution flaw in ServiceNow AI Platform, actively exploited since July 2026. Patch all self-hosted instances immediately.
CVE-2026-63030 and CVE-2026-60137 are critical pre-auth remote code execution flaws in WordPress Core, now exploited in the wild. Immediate patching is required; auto-patching is incomplete.