Security vulnerabilities remain the most common entry point for cyber attacks. This section tracks newly discovered CVEs, zero-day vulnerabilities, and actively exploited flaws affecting enterprise infrastructure, cloud environments, and software supply chains.
229 articles
CVE-2026-15409 and CVE-2026-15410 are critical zero-days in SonicWall SMA 1000, enabling admin-level command execution and SSRF. Patching is mandatory and urgent.
CVE-2026-44747 is a critical (CVSS 9.9) out-of-bounds write vulnerability in SAP NetWeaver Application Server ABAP, patched in July 2026. Immediate patching is required to prevent memory corruption and potential data breaches.
CVE-2026-56164 and CVE-2026-56155 are critical Microsoft zero-days under active attack, enabling privilege escalation in SharePoint Server and AD FS. Immediate patching is mandatory due to confirmed exploitation.
CVE-2018-0171 and CVE-2008-4128 are critical Cisco Smart Install flaws actively exploited by Russian state-linked actors; patch all affected devices immediately.
CVE-2025-32711 is a high-severity flaw in OpenClaw AI agents allowing persistent memory poisoning via a single email. Patch or mitigate immediately.
CVE-2026-XXXXX is a critical UniFi vulnerability allowing remote code execution and denial of service. Ubiquiti has released urgent patches; update immediately.
CVE-2023-24489 is a high-severity vulnerability impacting Progress ShareFile Storage Zone Controllers, prompting an urgent shutdown directive. No patch or workaround is currently available; immediate action is required.
CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492 are high-severity router vulnerabilities exploited by UAT-7810 for persistent access. Patch all affected devices immediately.
CVE-2026-39861 (High) enables silent execution of attacker-supplied code via Anthropic Claude Code and OpenAI Codex in autonomous review modes. Patch or disable autonomous execution immediately.
CVE-2026-3844 (CVSS: High) enables remote attackers to deploy persistent webshells via the WordPress Breeze plugin. Exploitation is active; patch immediately.
CVE-2016-6329 and CVE-2016-2183 (high severity) expose over 2.4 billion installs of free Android VPN apps to DNS leaks, tunnel hijacking, and plaintext data interception. Immediate removal or patching is advised; no vendor patch deadline announced.
CVE-2026-39861 is a high-severity flaw in Anthropic and OpenAI AI coding agents that enables arbitrary code execution when scanning untrusted projects. No patch is available; immediate mitigation is required.