Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
229 articles
CVE-2026-59726 is a critical unauthenticated remote code execution flaw in Ruflo's AI agent orchestration platform. All self-hosted instances exposing port 3001 are at risk; immediate patching is mandatory.
CVE-2026-20316 (high severity) is a zero-day in Cisco Secure Firewall Management Center, actively exploited to access sensitive data. Cisco hotfixes must be applied by August 1, 2026.
CVE-2026-42897 is a critical Microsoft Exchange cross-site scripting flaw enabling persistent mailbox compromise. Exploited in the wild; patch immediately.
CVE-2026-33017, CVE-2026-21858, and CVE-2025-68613 are high-severity flaws in Citrix NetScaler exploited in active attacks by a China-based actor. Immediate patching is critical.
CVE-2026-8233 (high severity) exposes 4G and 5G core networks to remote session hijacking and denial-of-service. Patch Dotouch systems immediately; remediation ongoing for other carriers.
CVE-2026-42897 is a critical zero-day in Microsoft Exchange Outlook Web Access exploited in the wild to deploy persistent backdoors. Immediate patching is mandatory.
CVE-2026-33017 is a high-severity vulnerability exploited in the wild by a Chinese-speaking threat actor using autonomous AI-driven attack workflows. Immediate patching is critical to prevent automated exploitation.
CVE-2026-10702 (high severity) enables remote code execution in Firefox and Tor Browser via a malicious webpage. Patch to 151.0.3 immediately.
CVE-2026-42897 is a critical zero-day in Microsoft Exchange OWA exploited in the wild for persistent mailbox access. Patch immediately to prevent credential theft.
CVE-2026-16812 is a critical command injection flaw in Arista VeloCloud Orchestrator, actively exploited for remote code execution. CISA mandates patching by July 30, 2026.
CVE-2013-4786 (high severity) exposes over 24,650 Dell, Supermicro, HPE, and GPU provider BMCs to remote hash theft and offline password cracking. No patch exists; immediate isolation is required.
CVE-2026-16232 is a critical authentication bypass (actively exploited) in Check Point SmartConsole, enabling remote admin takeover. Immediate patching is mandatory.