Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
171 articles
CVE-2026-41940 (high severity) enables attackers to exploit cPanel and WHM via compromised GitHub Actions workflows. Immediate patching is required to prevent credential theft and further exploitation.
CVE-2026-0257 is a high-severity authentication bypass in Palo Alto Networks PAN-OS, exploited in June 2026 for ransomware deployment. Immediate patching is critical.
CVE-2026-6875 is a critical, actively exploited vulnerability in the ServiceNow AI Platform enabling unauthenticated code execution. Immediate patching is required; ServiceNow released fixes in June 2026.
CVE-2026-6875 is a critical pre-auth remote code execution flaw in ServiceNow AI Platform, actively exploited since July 2026. Patch all self-hosted instances immediately.
CVE-2026-63030 and CVE-2026-60137 are critical pre-auth remote code execution flaws in WordPress Core, now exploited in the wild. Immediate patching is required; auto-patching is incomplete.
CVE-2026-15409 and CVE-2026-15410 (critical) allow remote attackers to gain root access on SonicWall SMA 1000 series appliances. Patch as soon as updates are available.
CVE-2026-42533 is a critical heap buffer overflow in NGINX enabling remote code execution and denial of service. Patch all affected servers by July 15, 2026.
CVE-2008-4128 and CVE-2018-0171 are high-severity Cisco router vulnerabilities exploited for remote code execution; patch immediately to prevent compromise.
CVE-2026-58644 is a critical SharePoint vulnerability enabling remote code execution, now under active exploitation. Immediate patching is mandated by CISA.
CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949 are critical zero-days in Siemens ROX II OT switches enabling root access; patch immediately or isolate affected devices.
CVE-2026-39987 and CVE-2026-41176 (high severity) are exploited by the NadMesh botnet to steal cloud credentials and Kubernetes tokens from exposed AI services. Immediate patching is critical to prevent unauthorized infrastructure access.
CVE-2026-59208 is a high-severity flaw in n8n’s Enterprise token exchange, allowing attackers to impersonate users across trusted issuers. Patch released June 24, 2026.