Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
286 articles
CVE-2025-2479 (high severity) is linked to a surge in ransomware attacks targeting Japanese SMEs in early 2026, enabling double-extortion and AI-enhanced operations. Patch or mitigate immediately to prevent data loss.
CVE-2026-87886 is a critical privilege escalation flaw in Acronis backup plugins for cPanel and WHM, exploited in targeted attacks. Patch immediately to prevent local compromise.
CVE-2026-76460 is a critical authentication bypass in Cisco Identity Services Engine (ISE), CVSS 10, already exploited in the wild. Immediate patching is required.
CVE-2026-76461 is a critical, actively exploited SQL injection flaw in Cisco Secure Email Gateway enabling root command execution. Patch immediately; Cisco urges urgent investigation.
CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 are critical JFrog Artifactory flaws exploited for admin bypass and backdoor deployment. Immediate patching is mandatory.
CVE-2026-85706 is a critical, actively exploited GitLab vulnerability enabling unauthenticated file access. Patch all affected instances immediately to prevent data theft.
CVE-2026-51990 is a critical remote code execution flaw in Tencent Sogou Input Method, exploited in the wild by UNC3569. Patch immediately to prevent GRAYRABBIT backdoor deployment.
CVE-2026-33017, CVE-2026-21858, CVE-2025-68613, and CVE-2026-3055 are high-severity flaws exploited in Citrix NetScaler appliances. Immediate patching is critical to prevent session hijack and credential theft.
CVE-2013-4786 is a high-severity flaw in IPMI 2.0 BMCs, enabling remote hash extraction and offline password cracking. Patch or isolate exposed interfaces immediately.
CVE-2026-9198, CVE-2026-18556, and CVE-2026-34486 are high-severity, actively exploited flaws in IBM Langflow, N-able N-central, and Apache Tomcat. CISA mandates federal agencies patch per BOD 26-04 deadlines.
CVE-2026-84869 is a critical zero-day in ConnectWise ScreenConnect allowing unauthorized file transfers and code execution during remote sessions. Patch to version 26.6.5 immediately.
CVE-2026-81578 and CVE-2026-82078 are critical PaperCut NG/MF vulnerabilities under active exploitation, enabling rapid domain compromise. Patch immediately to prevent credential theft and privilege escalation.