Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2026-11374 is a critical zero-day in ManageEngine enabling account takeover and unauthorized access. Immediate patching is required to prevent exploitation.
CVE-2026-50160 is a critical flaw in self-hosted Hoppscotch API Platform, enabling unauthenticated server takeover. Patch immediately to prevent persistent compromise.
CVE-2026-20230 is a critical SSRF flaw in Cisco Unified Communications Manager enabling remote code execution via webshell drop; active exploitation confirmed. Immediate patching is mandatory.
CVE-2025-54068 is a high-severity flaw in Laravel Livewire that may permit unauthorized access or code execution. Patch as soon as possible to mitigate risk.
CVE-2024-40766 (critical) enables remote attackers to compromise SonicWall SonicOS firewalls, leading to rapid ransomware deployment. Patch all affected devices immediately—delays increase risk of total perimeter loss.
CVE-2026-20971 is a high-severity use-after-free flaw in Samsung KNOX, enabling local kernel attacks on Galaxy S9–S25 devices. Patch by January 2026 update.
CVE-2026-8461 is a high-severity heap out-of-bounds write in FFmpeg’s MagicYUV decoder, enabling remote code execution or denial-of-service via crafted video files. Patch FFmpeg immediately to mitigate risk.
CVE-2025-66336 is a high-severity SQL injection flaw in Apache Doris that permits arbitrary SQL execution and data compromise. Patch as soon as possible.
CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837 (high severity) are actively exploited to hijack D-Link DIR-850L and DIR-818LW routers. Patch or replace affected devices immediately.
CVE-2026-45257 is a high-severity flaw in FreeBSD’s Kernel TLS (KTLS) that could expose encrypted network data. Immediate patching is critical to prevent data compromise.
CVE-2026-20181 (critical) enables authenticated admin users to execute arbitrary OS commands as root on Cisco ISE and ISE-PIC. Patch immediately to prevent privilege escalation and data exposure.
CVE-2023-3519, CVE-2025-5777, CVE-2023-48788, and CVE-2024-57727 are critical vulnerabilities exploited by INC ransomware in active campaigns since 2023. Patch immediately to prevent compromise.