Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-49975, and CVE-2026-13474 are high-severity flaws in Citrix NetScaler ADC and Gateway. Immediate patching is required to prevent denial-of-service and information disclosure.
CVE-2026-8037 is a critical pre-auth remote code execution flaw in Progress Kemp LoadMaster under active exploitation. Patch immediately to prevent compromise.
CVE-2026-46817 is a critical, actively exploited flaw in Oracle E-Business Suite Payments (CVSS 9.8) enabling unauthenticated system takeover. Patch immediately if not already applied.
CVE-2026-8037 is a critical pre-auth remote code execution flaw in Progress Kemp LoadMaster, enabling root access via API. Patch immediately to eliminate risk.
CVE-2026-12569 is a critical, actively exploited vulnerability in PTC Windchill and FlexPLM enabling unauthenticated remote code execution. Patch immediately; exploitation confirmed in the wild as of June 18, 2026.
CVE-2026-46331 is a critical Linux kernel vulnerability enabling local root privilege escalation via act_pedit. Patch immediately; public exploit exists.
CVE-2026-46331 is a critical Linux kernel vulnerability enabling local root escalation via act_pedit COW cache poisoning. Patch immediately to prevent undetected root compromise.
CVE-2026-12957 and CVE-2026-12958 are high-severity flaws in Amazon Q Developer for VS Code enabling cloud credential theft via malicious repositories. Patch immediately to prevent compromise.
CVE-2026-20230 is a critical SSRF flaw in Cisco Unified Communications Manager Server, actively exploited and under CISA patch deadline for federal agencies.
CVE-2026-46529 is a critical remote code execution vulnerability in Atril software, enabling attackers to compromise systems with a single user click. Immediate patching is required.
CVE-2025-67038 is a critical code injection flaw in Lantronix EDS5000, allowing remote root command execution. Active exploitation ongoing; patch immediately.
CVE-2021-26855, CVE-2023-32315, and related high-severity CVEs are being exploited in the StrikeShark campaign to deploy Cobalt Strike via SharkLoader. Immediate patching is critical to block ongoing attacks.