Vulnerabilities briefings
Exploited and exploitable flaws, tracked from disclosure through proof-of-concept to active exploitation, with patch and mitigation guidance.
- CISA flags years-old ProFTPD and Struts bugs as exploited 2026-10-13
- GitLab patches perfect-10 flaw letting strangers run code 2026-10-13
- A booby-trapped PDF can run code on servers via Ghostscript 2026-10-12
- SonicWall fixes a third login-free SMA1000 flaw this year 2026-10-12
- Critical Splunk flaw lets attackers run commands, no login 2026-10-12
- PaperCut's emergency fixes were bypassed three times 2026-10-12
- Critical Atlassian bug exposes Jira and Confluence files 2026-10-11
- Hackers hit unpatched Ahsay backup servers to mine crypto 2026-10-11
- AI agent uncovers Linux kernel bug that can grant root 2026-10-05
- Chrome update fixes two bugs that can escape the sandbox 2026-10-05
- Exploited NetScaler bug needs a newer build than September's 2026-10-04
- TeamViewer patches five flaws, update to version 15.82 2026-10-03
- Zammad zero-days used to breach bug-disclosure group DIVD 2026-10-02
- Health software makers sit on bugs for years, France warns 2026-10-02
- NetScaler hackers plant a hidden admin and a web shell 2026-10-02
- EV charging platform flaws let attackers pose as chargers 2026-10-01
- Hackers exploit FortiMail zero-day before a patch exists 2026-10-01
- NetScaler attackers try a new trick to grab device configs 2026-09-30
- Zimbra flaw let hackers raid mail servers, Microsoft says 2026-09-30
- Hackers exploit another Cisco SD-WAN flaw for admin access 2026-09-30
- Chrome and Firefox fix 108 flaws on the same day 2026-09-30
- Lantronix gateway SDK shipped its own signing key 2026-09-29
- Public exploit puts 37 VIVOTEK camera models at risk 2026-09-29
- One web request can hand over a MikroTik router 2026-09-29
- Citrix attackers hid web shells behind fake icon files 2026-09-29
- Apache Tomcat fixes 12 flaws, led by a WebSocket bypass 2026-09-29
- Apple fixes iPhone and Mac zero-day used in targeted attacks 2026-09-29
- Hackers hit Citrix zero-day three days before disclosure 2026-09-28
- Dayforce Payroll flaws go public after vendor stays silent 2026-09-28
- 50,000 NetScaler boxes exposed as UK joins Citrix alarm 2026-09-28
- Old Telerik bug still lets hackers into IIS web servers 2026-09-28
- Citrix NetScaler zero-days under attack, CISA warns 2026-09-27
- ServiceNow fixes five AI Platform flaws, two rated critical 2026-09-26
- Kiteworks urges server shutdown after attack warning 2026-09-26
- ShinyHunters dodges WAF rules to hack unpatched PeopleSoft 2026-09-26
- CISA says hackers now exploit a WordPress core flaw 2026-09-25
- Hackers exploit WSO2 and Adobe Commerce flaws, CISA warns 2026-09-25
- Chrome 154 fixes 11 critical bugs, most in graphics 2026-09-23
- WordPress patches a core flaw that needs no login 2026-09-23
- Password reset flaw hands over Siemens Edge accounts 2026-09-22
- Attackers can run code on devices using the lwIP stack 2026-09-22
- Hackers exploit Check Point, Arista and F5 gear 2026-09-22
- MikroTik's silent patch was reverse engineered in a day 2026-09-22
- Two critical Synology NAS bugs let strangers write files 2026-09-22
- Login bug gives root on Check Point's own servers 2026-09-22
- One admin click can hand over a WordPress site 2026-09-22
- Second BIG-IP DNS bug in six weeks has no fix yet 2026-09-21
- One coding mistake gives root on Dell and Cisco gear 2026-09-19
- Docker's AI sandbox can be escaped onto the host Mac 2026-09-19
- Five Linux kernel flaws hit CISA's exploited list in weeks 2026-09-18
- Crafted iPhone photos can run code on vulnerable servers 2026-09-18
- Hackers exploit two Linux kernel flaws, CISA warns 2026-09-18
- Mirai scanning surged from servers, not IoT devices 2026-09-18
- One link was enough to backdoor a Chinese typing app 2026-09-18
- ISC patches 14 BIND flaws that can knock DNS offline 2026-09-18
- Mitsubishi factory software accepts a wrong password 2026-09-17
- Hardcoded password opens live truck tracking data 2026-09-17
- Course plugin flaw lets students run code on the server 2026-09-17
- Update Firefox and Thunderbird: 78 flaws fixed 2026-09-17
- Cisco patches four critical firewall software flaws 2026-09-17
- 82 Office flaws still have no fix for Mac users 2026-09-16
- Cisco's access gatekeeper is being bypassed in attacks 2026-09-16
- T-Mobile 5G router flaws let strangers get root access 2026-09-16
- Pixel modem flaw exploited in limited targeted attacks 2026-09-16
- Oracle ships 673 fixes, six rated a perfect 10 2026-09-16
- Chrome patches 42 flaws, three rated critical 2026-09-16
- No password needed to run SCADA manager commands 2026-09-15
- Hardcoded keys let attackers push ship software updates 2026-09-15
- Camera flaws hand strangers your live security video 2026-09-15
- VLC bug can run code and no fixed build is listed 2026-09-15
- Apple patches 257 flaws across iOS 27 and macOS 27 2026-09-15
- CISA says a Cisco email gateway bug is under attack 2026-09-14
- Hackers hammer a WooCommerce plugin patched in February 2026-09-14
- Anyone can comment their way into 600,000 WordPress sites 2026-09-14
- Bank's payment plugin lets shop staff rewrite the database 2026-09-14
- Ivanti service desk flaws let strangers run code remotely 2026-09-13
- Roundcube patches 12 flaws, one needs no click at all 2026-09-12
- Online stores hacked before Adobe could ship a fix 2026-09-12
- A stolen key opens every file Windows RMS ever sealed 2026-09-12
- CISA gives agencies three days to patch ScreenConnect 2026-09-12
- Unpatched GitLab servers leak files to anyone who asks 2026-09-11
- One bug class drove most Linux root flaws in 2026 2026-09-11
- Public exploits land for SonicWall, PaperCut, Cisco bugs 2026-09-11
- France warns of mass Metabase break-ins, check your logs 2026-09-10
- Hackers chain three bugs to hijack JFrog Artifactory 2026-09-10
- Polish medical software shipped hard-coded API logins 2026-09-10
- Root on one node hands over every workload's identity 2026-09-10
- A crafted XML request can root a Palo Alto firewall 2026-09-10
- Chrome 153 fixes 230 bugs and one is already exploited 2026-09-10
- Spies and ransomware crews root Cisco firewall servers 2026-09-09
- Microsoft patches two Windows bugs already under attack 2026-09-09
- A 10.0-rated N-able zero-day is already being exploited 2026-09-09
- LG smart TVs quietly map the devices in your home 2026-09-07
- Hackers hide a web shell in F5 BIG-IP server memory 2026-09-07
- HPE patches 34 flaws in Aruba network switches 2026-09-07
- Attackers are seizing MikroTik routers over SSH, patch now 2026-09-06
- Unpatched Proxmox servers hand root to anyone who asks 2026-09-05
- Ship satellite routers have a public exploit and no patch 2026-09-05
- Two open ports let strangers root Cisco Nexus 9000 switches 2026-09-05
- Hackers try to hijack Elementor Pro sites 190,000 times 2026-09-05
- ServiceNow flaws let strangers run code on an instance 2026-09-04
- Video encoders can be rooted and no patch is coming 2026-09-04
- Attackers exploit a Chrome flaw, update your browser now 2026-09-04
- 22,000 Exchange servers still exposed to a public exploit 2026-09-03
- Hackers plant webshells via a WordPress form plugin 2026-09-03
- OptimiDoc kept Active Directory passwords in plain text 2026-09-03
- Exploited bugs up 34% as attackers beat the patch cycle 2026-09-03
- Exploit claims SYSTEM access via CrowdStrike Falcon 2026-09-03
- Cisco finds critical flaws in every IOS XR release 2026-09-03
- Jenkins fixes 33 flaws, one opens the script console 2026-09-03
- Hackers exploit JFrog, Kestra and Sangoma bugs, CISA warns 2026-09-02
- Patching is not enough for exploited SonicWall bugs 2026-09-02
- Unpatched domain controllers face full takeover bugs 2026-09-02
- Rockwell factory controllers can be crashed by one packet 2026-09-01
- Gravity Forms bug let anyone upload code to WordPress sites 2026-09-01
- Backup plugin flaw exposes 5 million WordPress sites 2026-09-01
- AWS patches flaw that turns one IAM permission into root 2026-09-01
- Kaspersky fixes flaw as researcher targets Nvidia and Avast 2026-08-31
- CISA flags two PaperCut flaws as exploited in the wild 2026-08-31
- Critical Metabase bug lets hackers seize admin access 2026-08-31
- Critical cPanel bug hands one customer the whole server 2026-08-29
- Hackers exploit PaperCut zero-day to take over servers 2026-08-28
- Critical flaws let attackers hijack WatchGuard's agent 2026-08-28
- Fuel systems ship with 2018-era PHP bugs and no fix 2026-08-27
- Hackers exploit ownCloud, Linux kernel and JFrog flaws 2026-08-27
- WPMU DEV SSO flaw hands attackers admin on 350k sites 2026-08-27
- Symlink flaw in Linux monitor dool overwrites files 2026-08-27
- Critical Next.js flaws let attackers run code on servers 2026-08-27
- A glibc bug lets strangers crash an F5 Kubernetes service 2026-08-27
- Most cloud security alerts are not real attack paths 2026-08-26
- CISA gives agencies three days to fix a Citrix bug 2026-08-26
- Update Chrome now: one web page can run code on your PC 2026-08-26
- Spies and ransomware crews exploit the same edge devices 2026-08-26
- Attackers exploit SPIP sites through a single HTTP header 2026-08-26
- Public exploit code can take over vBulletin forums 2026-08-26
- Veeam bug wrote backup credentials into plain text logs 2026-08-26
- CISA flags flaws in truck brakes and ship transponders 2026-08-25
- US warns a Gitea code injection bug is under attack 2026-08-25
- An AI agent chained six bugs into a WordPress takeover 2026-08-25
- A hostile FTP server can stall wget with one number 2026-08-25
- Translation plugin hands admin reset links to strangers 2026-08-25
- Hackers exploit a maximum severity Oracle server flaw 2026-08-24
- SharePoint exploit goes public with two attack paths 2026-08-24
- KAON router bug leaks the admin password to strangers 2026-08-24
- A crafted web page can break out of Edge's sandbox 2026-08-24
- Microsoft says a 10.0 Entra ID flaw was never exploited 2026-08-22
- WordPress forces a mass update after a critical Pods flaw 2026-08-21
- Attackers exploit a Zimbra bug to run commands on servers 2026-08-21
- Two hex digits bring a dead credit card back to life 2026-08-21
- Google patches critical Chrome remote desktop flaw 2026-08-21
- Abandoned e-learning platform has 13 flaws and no patch 2026-08-20
- US warns two critical TrueConf server flaws are exploited 2026-08-20
- Elementor Pro bug lets strangers take over WordPress sites 2026-08-20
- Free tool turns Windows Defender's own driver into a weapon 2026-08-20
- Joomla fixes upload bug that can run code on servers 2026-08-20
- A shared Splunk report can leak an admin session 2026-08-20
- Critical Citrix NetScaler bug lets attackers bypass login 2026-08-19
- Malicious file names run commands in the nnn file manager 2026-08-19
- Critical GitLab bug lets strangers delete public projects 2026-08-19
- Oracle ships 943 security fixes, one rated a perfect 10 2026-08-19
- Hackers exploit critical VMware vCenter and Windows bugs 2026-08-18
- Apple patches an image bug that can run code on iPhones 2026-08-18
- A zip bomb hidden in a .docx crashes Carbone servers 2026-08-18
- A booby-trapped image can run code on a WordPress site 2026-08-18
- Old iPhones just got 122 security fixes in one update 2026-08-18
- Forminator flaw exposes 600,000 WordPress sites to takeover 2026-08-17
- Hackers get root on Macs through Screen Sharing flaw 2026-08-17
- Ivanti bug can expose database logins to eavesdroppers 2026-08-17
- Hackers now attack a SharePoint flaw that skips the login 2026-08-17
- New ColdFusion flaw scores a perfect 10 for severity 2026-08-17
- Microsoft patches six security flaws in Edge browser 2026-08-17
- Apple fixed this zip bug in 2008. Upstream never did. 2026-08-15
- Metasploit ships working exploits for flaws under attack 2026-08-15
- A 61-character username can take over a WordPress site 2026-08-14
- 249 WordPress flaws in a week, 32 with no fix yet 2026-08-14
- Citrix NetScaler bug lets attackers hijack VPN gateways 2026-08-14
- Rogue VPN gateway can run code on Palo Alto clients 2026-08-14
- Critical flaw gives root on Haiwell industrial gateways 2026-08-13
- Two bugs let a bad Go proxy sneak past checksum checks 2026-08-13
- rsync ships 33 CVE fixes, one lets clients fake their IP 2026-08-13
- Brain and nerve stimulators take orders from strangers 2026-08-13
- Docker flaw lets a container take over the host machine 2026-08-13
- MongoDB patches 25 flaws across server and driver builds 2026-08-13
- Fortinet patches 8 bugs, worst is a FortiWeb login bypass 2026-08-12
- Critical SAP flaw lets anyone take over Commerce Cloud 2026-08-12
- Hackers are crashing Cisco firewalls through the VPN 2026-08-12
- Microsoft fixes 421 flaws as new Defender zero-day drops 2026-08-12
- Fertility monitor flaws expose reproductive health data 2026-08-11
- Zoom's drawing tool let anyone in a call hijack your laptop 2026-08-11
- AI helped find SharePoint bugs behind a server takeover 2026-08-11
- Traefik bug lets attackers reach protected admin pages 2026-08-11
- F5 BIG-IP DNS flaw has no patch, only workarounds 2026-08-11
- Booby-trapped fonts can crash or hijack Emacs on Android 2026-08-10
- Linux kernel bug hands any local user root on most distros 2026-08-10
- Metabase zero-day exploited, public exploit code is out 2026-08-10
- Public exploit lets macOS printing bug write files as root 2026-08-10
- WPMU DEV flaw lets attackers take over WordPress sites 2026-08-09
- Belgian banking ID extension let any site steal your PIN 2026-08-09
- Nearly a third of July's exploited bugs predate 2025 2026-08-08
- Fake clearances can be injected into cockpit datalink 2026-08-08
- Attackers exploit a critical Progress LoadMaster flaw 2026-08-07
- Public exploit lands for critical TeamCity server bug 2026-08-07
- WordPress bug runs code on the server if an admin clicks 2026-08-07
- Cloudflare runtime bugs leak tenant data in self-hosted lab 2026-08-07
- Update Chrome now to fix 41 security flaws 2026-08-07
- Safari's Private Relay leaks your real IP, researchers say 2026-08-06
- Windows Defender's own driver can be turned against it 2026-08-06
- AI helped turn an 18-year-old flaw into a container escape 2026-08-06
- New KVM bug lets a guest VM break out onto the host 2026-08-06
- Critical Jenkins flaw breaks the agent to server barrier 2026-08-06
- Cisco patches critical IOS XE flaws it found itself 2026-08-06
- CISA says attackers are exploiting critical TeamCity bug 2026-08-05
- Attackers keep access to SharePoint servers after patching 2026-08-05
- CISA says hackers exploit critical IBM Langflow AI flaw 2026-08-04
- Car alarm flaw lets attackers unlock and immobilize cars 2026-08-04
- DNA analyzer flaw lets attackers alter genetic test results 2026-08-04
- Smart-building protocol flaw is under attack, CISA says 2026-08-04
- Hackers exploit an N-able RMM login bypass, CISA warns 2026-08-03
- Critical Rails bug now has a working Metasploit exploit 2026-08-03
- Malware can steal Google passkeys and hijack accounts 2026-08-03
- Attackers weaponize most public exploits within 48 hours 2026-08-03
- Four SharePoint flaws joined CISA's exploited list in July 2026-08-03
- CISA flags four critical Joomla add-on bugs as exploited 2026-08-02
- One-click installs expose databases with a default password 2026-08-01
- Fuel terminal controllers ship with an open root debug port 2026-07-31
- Critical Rails flaw lets attackers steal app secrets 2026-07-31
- Critical VMware bugs let attackers take over virtual server fleets 2026-07-30
- Azure database flaw could have unlocked every customer database 2026-07-30
- Kubernetes storage flaws let one tenant read another tenant's files 2026-07-30
- CISA warns hackers are abusing a built-in Cisco firewall password 2026-07-29
- Critical JetBrains TeamCity bug lets attackers hijack build servers 2026-07-29
- CISA says hackers are exploiting Fortinet and Arista flaws 2026-07-29
- A second critical Fastjson flaw lets attackers run code on servers 2026-07-29
- Hackers exploit a critical Check Point flaw to hijack management servers 2026-07-25
- Critical login bypass hits Siemens and Rockwell industrial software 2026-07-22
- Hackers exploit critical Fastjson flaw to run code on servers 2026-07-22
- CISA flags four flaws under active attack, including two in WordPress 2026-07-22
- Hackers now exploit a critical WordPress flaw to hijack sites 2026-07-20
- Critical WordPress flaw lets attackers take over sites without logging in 2026-07-18
- Shark robot vacuum flaw exposes home cameras and Wi-Fi passwords 2026-07-17
- Chained Siemens switch zero-days give attackers root on OT networks 2026-07-17
- CISA flags a new SharePoint flaw as actively exploited 2026-07-17
- Old signed bootloaders let attackers bypass Secure Boot on most PCs 2026-07-17
- CISA flags critical bugs in Rockwell and ABB industrial gear 2026-07-15
- Hackers exploit SonicWall remote access appliances, CISA warns 2026-07-14
- Microsoft fixes 622 flaws in July, two already under active attack 2026-07-14
- SharePoint flaw lets attackers bypass login and impersonate any user 2026-07-14
- Microsoft patches Defender zero-day that grants full system control 2026-07-10
- A hidden signing key can let hackers forge any Microsoft login 2026-07-07
- CISA warns hackers are exploiting an Adobe ColdFusion flaw 2026-07-07
- Critical vulnerabilities surged 62% in the second quarter of 2026 2026-07-07
- Critical Oracle, Kemp, and Linux flaws come under active attack 2026-07-06
- Adobe patches a raft of critical ColdFusion code execution flaws 2026-07-03
- CISA warns of active attacks on a Microsoft SharePoint flaw 2026-07-02
- Update Chrome now to patch 382 security bugs, 15 critical 2026-07-02
- CISA warns of critical flaws across industrial control systems 2026-06-30
- New Citrix NetScaler flaw leaks memory from VPN gateways 2026-06-30
- Apple patches WebKit bugs that can be chained to steal data 2026-06-30
- CISA warns SimpleHelp remote-support bug is under active attack 2026-06-30
- Critical Kemp LoadMaster bug lets hackers run code without a login 2026-06-29
- Flaw in popular SSH library libssh2 lets rogue servers attack clients 2026-06-28
- Critical bugs expose medical imaging software, one unpatched 2026-06-26
- Critical flaws let attackers hijack EV charging networks 2026-06-26
- CISA flags Cisco and PTC bugs as actively exploited 2026-06-25
- Update Chrome now to fix four critical browser security flaws 2026-06-25
- Critical FFmpeg flaw lets a malicious video file hijack servers 2026-06-24
- Hackers exploit a new Cisco SD-WAN zero-day to gain root access 2026-06-24
- Siemens patches flaws that let attackers hijack network management servers 2026-06-24
- Hackers exploit Fortinet FortiSandbox flaws to hijack malware analysis servers 2026-06-22
- Node.js fixes TLS flaws that let attackers impersonate trusted servers 2026-06-20
- Hackers abuse a little known Windows installer to deploy malware 2026-06-19
- CISA warns of two actively exploited Cisco and cPanel bugs 2026-06-16
- Critical Splunk bug lets attackers take over servers without a login 2026-06-14
- Critical Ivanti Sentry flaw exploited in the wild after public exploit release 2026-06-12
- Check Point VPN zero-day lets attackers bypass login, now actively exploited 2026-06-12
- Microsoft patches 206 flaws, four critical bugs likely to be exploited 2026-06-10
- Google patches a Chrome zero-day already being used in attacks 2026-06-09
- One Click on a Windows Search Link Can Leak Your Password Hash 2026-06-06
- Hackers Are Breaking Into Palo Alto VPNs Without a Password 2026-06-06
- Fortinet Checks Whether Its Security Tools Are Exposed to a Linux Kernel Flaw 2026-06-06
- New Linux Bug Lets Any Local User Become Root 2026-06-06
- Hackers Break Into Unpatched Cisco SD-WAN Devices to Plant Webshells 2026-06-06
- Hackers Hijack cPanel Servers Through Critical Login Bypass 2026-06-05
- Kaspersky Discloses CVE-2025-68670, a Pre-Auth Stack Overflow in the xrdp Remote Desktop Server 2026-06-05
- OnePlus Websites Compromised via Abandoned AWS S3 Bucket — Stored XSS Active Across Multiple Domains 2026-03-17
- Google Patches Two Chrome Zero-Days Exploited in the Wild — Skia and V8 Under Active Attack 2026-03-15
- CVE-2026-27944: Nginx UI Backup Endpoint Exposes Full Server Secrets Without Authentication 2026-03-08
- FreePBX Patches SQL Injection and Command Injection Trio: CVE-2026-28210, CVE-2026-28284, CVE-2026-28287 2026-03-05
- Six CVEs Fixed in Gogs 0.14.2: Supply Chain Risk via LFS Object Overwrite, XSS Cluster, and Token Leakage 2026-03-05
- CVE-2026-3009 and CVE-2026-3047: Keycloak Authentication Bypass via Disabled Identity Providers and SAML Broker 2026-03-05
- CVE-2026-20127: Active Exploitation at Scale of Cisco Catalyst SD-WAN Zero-Day - Webshell Deployment, Sophisticated Implants, and 50+ Attack IPs Observed 2026-03-05