Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2026-35273 is a critical, actively exploited zero-day in Oracle PeopleSoft, used by ShinyHunters to breach FBI employee data. No patch or mitigation is available as of June 2026.
CVE-2026-0768 is a critical zero-day in Langflow AI App Builder enabling unauthenticated root-level code execution; active exploitation began August 29, 2026. Immediate patching is required to prevent credential theft and lateral movement.
CVE-2021-22681 (CVSS: High) enables attackers to bypass authentication in Schneider Electric products. Active exploitation reported in June 2026. Patch immediately.
CVE-2026-88779 is a high-severity Citrix NetScaler flaw enabling denial of service and webshell deployment, actively exploited in the wild. CISA mandates immediate patching.
CVE-2026-16232 is a critical authentication bypass (CVSS 9.3) in Check Point Security Management, actively exploited in the wild. Patch immediately to prevent full admin compromise.
CVE-2026-58593 (high severity) exposes NodeBB forums to admin takeover, private data leaks, and code execution. Patch to 4.14.2 immediately.
CVE-2026-16232 is a critical authentication bypass in Check Point SmartConsole, exploited in the wild for full admin takeover. Patch with the latest hotfix immediately.
CVE-2025-66376 (high severity) enables remote credential theft via zero-click JavaScript injection in unpatched Zimbra Collaboration servers. Patch immediately; active exploitation confirmed.
CVE-2026-86950 is a critical CoreGraphics vulnerability in Apple iOS, iPadOS, and macOS enabling remote code execution via malicious files. Patch all devices immediately.
CVE-2026-88771 and CVE-2026-88772 are critical Citrix NetScaler vulnerabilities enabling remote code execution, actively exploited in the wild. Immediate patching is required to prevent compromise.
CVE-2026-76504 is a critical zero-day in Cisco Catalyst SD-WAN Manager enabling admin access via API authentication bypass. Active exploitation confirmed; immediate patching required.
CVE-2026-102489 and CVE-2026-102490 are critical zero-day flaws in Zammad Helpdesk, exploited in a live attack on DIVD. Immediate patching is mandatory.