Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2026-82329 is a critical authentication bypass in JFrog Artifactory, actively exploited to breach OpenInfra Europe. Patch or isolate affected instances immediately.
CVE-2026-73570 is a critical unauthenticated command injection flaw in Zimbra Collaboration Suite SNMP, exploited for remote code execution and data exfiltration. Immediate patching is required to prevent persistent compromise.
CVE-2026-88771 (critical) enables remote admin compromise of Citrix NetScaler ADC and Gateway. Exploitation is active; patch immediately to prevent unauthorized access.
CVE-2026-27577 is a high-severity vulnerability in n8n pre-2.31.5/2.32.1 allowing authenticated users to execute OS commands. Patch immediately to prevent privilege abuse.
CVE-2026-88771 and CVE-2026-88772 are critical zero-days in Citrix NetScaler ADC and Gateway, enabling remote code execution and unauthorized access. Active exploitation confirmed; patch guidance is pending.
CVE-2026-16812 is a critical (CVSS 10.0) unauthenticated OS command injection flaw in Arista's on-premises VeloCloud Orchestrator, actively exploited in the wild. Immediate patching is mandatory to prevent full compromise.
CVE-2026-61511 is a high-severity pre-auth remote code execution flaw in vBulletin’s template engine. Patch to v6.2.2 immediately to prevent exploitation.
CVE-2026-12569 is a critical pre-authentication RCE in PTC Windchill and FlexPLM, exploited since July 2026 by ransomware affiliates. Patch immediately to prevent data exfiltration and extortion.
CVE-2026-12569 is a critical remote code execution flaw in PTC Windchill and FlexPLM, actively exploited by Cl0p ransomware affiliates since June 2026. Immediate patching is essential to prevent data theft and ransomware deployment.
CVE-2026-16723 is a critical remote code execution flaw in Fastjson (v1.2.68–1.2.83) exploited in the wild. Immediate patching is required to prevent full server compromise.
CVE-2026-85102 and CVE-2026-93616 are critical zero-days in Check Point Security Gateway and Management, enabling unauthenticated remote code execution. Patches released September 2026; immediate update required.
CVE-2026-93952 is a critical, actively exploited CSRF flaw in Arista's on-prem VeloCloud Orchestrator. Immediate patching is required to prevent SD-WAN compromise.