Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2026-20253 is a critical Splunk Enterprise vulnerability (CVSS 9.8) enabling unauthenticated remote code execution; patch to 10.0.7 or 10.2.4 immediately.
CVE-2026-48558 is a critical authentication bypass in SimpleHelp's remote management software (CVSS 10.0), allowing attackers to gain admin access and hijack endpoints. Patch immediately to prevent exploitation.
CVE-2026-50751 (critical) is an authentication bypass in Check Point Remote Access VPN and Mobile Access, exploited in the wild since May 2026. All affected systems require immediate patching to prevent unauthorized access and ransomware deployment.
CVE-2026-10520 is a critical OS command injection flaw in Ivanti Sentry, actively exploited to backdoor internet-exposed gateways. CISA mandates federal agencies patch within three days.
CVE-2026-23111 is a high-severity Linux kernel vulnerability enabling local privilege escalation to root via nf_tables. Public exploits exist; patch immediately and reboot.
CVE-2026-20253 and related Splunk Enterprise flaws (CVSS 9.8/8.8) are under active exploitation, enabling unauthenticated file manipulation and remote code execution. Immediate patching is critical.
CVE-2026-5027 is a high-severity path traversal flaw in Langflow, enabling unauthenticated attackers to write arbitrary files on exposed servers. Immediate patching is critical to prevent compromise.
CVE-2026-10520 and CVE-2026-10523 are critical vulnerabilities in Ivanti Sentry enabling remote root code execution; no exploitation reported, but immediate patching is required.
CVE-2026-42271 (CVSS 10.0, critical) enables command injection in BerriAI LiteLLM, and is being actively exploited in the wild. Immediate patching is required to prevent unauthenticated remote code execution via a chained Starlette flaw (CVE-2026-48710).
CVE-2026-50751 is a critical authentication bypass in Check Point VPN/firewall appliances, exploited since May 2026 for ransomware attacks. Immediate patching is required to prevent unauthorized VPN access.
CISA confirms active exploitation of the CVE-2026-28318 DoS vulnerability in SolarWinds Serv-U servers, urging federal agencies and enterprises to patch by June 19, 2026. This cybersecurity report details the risk and response.
CrowdStrike and NVIDIA have joined forces to scale AI-native agents that transform vulnerability management. CISOs gain rapid, prioritized risk reduction at enterprise scale.