Vulnerabilities

Severity High Detail Microsoft has released a security update to address a zero-day vulnerability in Microsoft Defender, RoguePlanet which was publicly disclosed after the June 2026 Patch Tuesday. The vulnerability tracked as CVE-2026-50656 affects fully patched Windows 10 and Windows 11 systems and could allow attackers to gain SYSTEM-level privileges through a race condition in […]

Severity Critical Detail BeyondTrust has disclosed multiple vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) appliances. The vulnerabilities, tracked under advisory BT26-03, include critical and high-severity flaws that could lead to authentication bypass, denial-of-service (DoS), and unauthorized access to sensitive data. The most critical vulnerabilities affect the authentication mechanism and have a […]

Severity High Detail RARLAB has released WinRAR 7.23 to address a high-severity vulnerability tracked as CVE-2026-14191. The flaw affects the way WinRAR and UnRAR process RAR5 recovery-volume (.rev) files and could allow a remote attacker to execute arbitrary code on a victim’s system by convincing a user to open a specially crafted archive. The vulnerability […]

Severity Critical Detail Progress Software has released security updates to address a critical vulnerability affecting Progress Kemp LoadMaster. The vulnerability, tracked as CVE-2026-8037 that allows an unauthenticated remote attacker to execute arbitrary commands as the root user on affected appliances when the API is enabled. The vulnerability exists in the escape_quotes() function, which is responsible […]

Severity High Detail A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46331 and nicknamed “Pedit COW,” allows an unprivileged local user to escalate privileges and obtain full root access on affected Linux systems. The vulnerability affects the Linux kernel’s traffic-control subsystem, specifically the tcf_pedit_act() function within the act_pedit module. It impacts Linux kernel versions 5.18 […]

Severity Medium Detail Cisco has released security updates to address an actively exploited vulnerability affecting Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). The vulnerability, tracked as CVE-2026-20262, has a CVSS score of 6.5 (Medium Severity) and may allow an authenticated remote attacker to create or overwrite files on the underlying operating system of an affected […]

Severity High Detail Microsoft has released security updates addressing three critical remote code execution (RCE) vulnerabilities affecting Microsoft Outlook and Microsoft Word. The vulnerabilities, tracked as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635, could allow attackers to execute arbitrary code on affected systems by delivering specially crafted emails or Office documents, originating from memory corruption flaws within the […]

SeverityHigh Detail Ivanti has disclosed and patched a high-severity vulnerability in Endpoint Manager Mobile (EPMM), tracked as CVE-2026-6973. The vulnerability could allow an authenticated attacker with sufficient privileges to achieve remote code execution by injecting malicious Apache configuration directives into affected systems. The vulnerability is classified under CWE-15 Improper Neutralization of Special Elements in Configuration […]

SeverityMedium Detail Microsoft has disclosed and patched Windows BitLocker Security Feature Bypass vulnerability, tracked as CVE-2026-50507, as part of its June 2026 Patch Tuesday security updates. The vulnerability stems from a protection mechanism failure within BitLocker Device Encryption that could allow an unauthorized attacker with physical access to bypass encryption protections and gain access to […]

SeverityCritical Detail SAP has released 15 new security notes as part of its June 2026 Security Patch Day, addressing multiple vulnerabilities across core SAP products. Among the updates are four critical-severity vulnerabilities affecting SAP NetWeaver, SAP Commerce Cloud, SAP Data Hub, and related enterprise platforms. The most severe vulnerability, CVE-2026-44748, is an XML Signature Wrapping […]

Severity High Detail Broadcom has disclosed three stored cross-site scripting (XSS) vulnerabilities affecting VMware Cloud Foundation Operations and several related products. Tracked as CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, the flaws were addressed in security advisory VMSA-2026-0004. No workarounds are currently available, making patching the only viable remediation path. The vulnerabilities stem from stored cross-site scripting flaws […]

Severity High Detail Cisco has disclosed an actively exploited privilege escalation vulnerability, tracked as CVE-2026-20245, affecting Cisco Catalyst SD-WAN Manager. At the time of disclosure, no security patch or workaround is available. The vulnerability affects the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager and is caused by insufficient validation of user-supplied input. An authenticated […]

Severity High Detail A high-severity vulnerability has been identified in Ivanti Neurons for ITSM, affecting both cloud and on-premises deployments. The flaw, tracked as CVE-2026-9614 is an improper access control vulnerability that allows an authenticated remote attacker with low-level privileges to escalate privileges and gain administrator-level access to affected environments. According to Ivanti, this flaw […]

Severity High Detail A high-severity vulnerability has been identified in TP-Link Archer routers, specifically affecting the Archer BE450 v1 and Archer BE7200 v1 models. Tracked as CVE-2026-5509, the flaw is a command injection vulnerability located within the router’s web management interface. It arises due to insufficient input sanitization in backend system commands, allowing an authenticated […]

Severity Critical Detail A critical vulnerability has been identified in Microsoft Windows Netlogon, affecting Windows Server domain controllers. The flaw, tracked as CVE-2026-41089, is a zero-click remote code execution (RCE) vulnerability that allows an unauthenticated attacker to execute arbitrary code with SYSTEM-level privileges by sending specially crafted Netlogon network requests. The vulnerability poses a significant […]

SeverityHigh Detail A high-severity vulnerability has been identified in Palo Alto Networks PAN-OS software affecting GlobalProtect portals and gateways. The flaw, tracked as CVE-2026-0257, is an authentication bypass vulnerability that allows an unauthenticated attacker to bypass normal VPN authentication and establish an unauthorized GlobalProtect VPN connection. The issue is linked to GlobalProtect authentication override cookies, […]

Severity High Detail Microsoft has disclosed two zero-day vulnerabilities affecting Microsoft Defender that are currently being actively exploited in the wild. The vulnerabilities may allow attackers to escalate privileges or disrupt system availability, creating significant risk for enterprise environments. The issues are tracked as CVE-2026-41091 and CVE-2026-45498 and were publicly disclosed on May 19, 2026. […]

Severity High Detail A vulnerability has been identified in VMware Fusion that allows a local attacker to escalate privileges to root on affected systems. The issue, tracked as CVE-2026-41702, stems from a Time-of-Check Time-of-Use (TOCTOU) race condition within a SETUID binary. This occurs when a system validates a condition but later acts on it without […]

Severity Critical Detail A critical heap-based buffer overflow vulnerability, tracked as CVE-2026-41096, has been identified within the Microsoft WindowsDNS Client. The vulnerability centers on DNSAPI[.]dll, the foundational library used by every Windows process to translate domain names into IP addresses. Under normal conditions, this library allocates a specific amount of memory known as a buffer […]

Severity Critical Detail A critical security vulnerability has been discovered in SandboxJS, a widely used JavaScript sandboxing library available on npm. The vulnerability tracked as CVE-2026-43898, allows attackers to escape the sandbox environment and execute arbitrary code directly on the underlying host system potentially resulting in full Remote Code Execution (RCE) without requiring authentication or […]

Severity Medium Detail Microsoft has disclosed a security vulnerability affecting Microsoft Teams for Android that could allow attackers to perform spoofing attacks against users and organizations. The vulnerability tracked as CVE-2026-32185, was released as part of Microsoft’s May 2026 Patch Tuesday security updates. The flaw is caused by improper handling of file and directory access […]

Severity High Detail A high-severity vulnerability has been identified in Cisco Crosswork Network Controller (CNC) and Cisco Network Services Orchestrator (NSO). The flaw tracked as CVE-2026-20188 is caused by insufficient rate limiting on incoming network connections. An unauthenticated remote attacker can exploit the vulnerability using low-complexity attacks to exhaust available connection resources and force affected […]

Severity Critical Detail A critical vulnerability has been identified in Palo Alto Networks PAN-OS software impacting PA-Series and VM-Series firewalls. The flaw tracked as CVE-2026-0300, is a buffer overflow vulnerability affecting the User-ID Authentication Portal (also known as the Captive Portal). This vulnerability allows an unauthenticated attacker to execute arbitrary code with root privileges by […]

Severity High Detail A critical vulnerability has been identified in Apache HTTP Server, one of the most widely used web servers globally. The flaw, tracked as CVE-2026-23918, could allow attackers to execute malicious code remotely on affected systems. The vulnerability is caused by a “double free” memory corruption issue in the handling of HTTP/2 requests. […]

Severity Critical Detail A proof-of-concept (PoC) exploit has been publicly released for a critical vulnerability affecting Fortinet’s FortiSandbox, enabling attackers to execute arbitrary commands on vulnerable systems. Tracked as CVE-2026-39808, the vulnerability is classified as an OS command injection (CWE-78) issue caused by improper neutralization of special elements in system commands. This flaw allows a […]

Severity Medium Detail Microsoft has addressed a moderate-severity vulnerability in the Windows Snipping Tool that could allow attackers to steal user credentials through a spoofing attack. Tracked as CVE-2026-33829, the flaw was patched as part of the April 14, 2026, security updates. The vulnerability was discovered and reported by security researchers at Blackarrow (Tarlogic), highlighting […]

Updated on Apr 18, 2026 Detail Cisco has released security updates addressing multiple critical vulnerabilities affecting Identity Services Engine (ISE), ISE Passive Identity Connector (ISE-PIC), and Webex Services. These vulnerabilities could allow attackers to execute arbitrary code, impersonate legitimate users, or gain unauthorized control over affected systems. The issues primarily stem from insufficient validation of […]

Severity High Detail Microsoft has disclosed a high-severity vulnerability affecting Windows Active Directory, which could allow attackers to execute malicious code within enterprise environments. Tracked as CVE-2026-33826, the flaw enables authenticated attackers to perform remote code execution over an adjacent network, posing significant risk to affected systems. CVE ID Summary CVSS Score CVE-2026-33826 Improper input […]

Severity High Detail Cybersecurity researchers have identified a critical vulnerability affecting Adobe Acrobat Reader that is being actively exploited in the wild. The flaw, tracked as CVE-2026-34621, allows attackers to execute arbitrary code on affected systems. This vulnerability is associated with improper memory handling, which can be triggered when a user opens a specially crafted […]

Severity Critical Detail Cybersecurity researchers have identified a critical security vulnerability affecting Juniper Networks Support Insights Virtual Lightweight Collector (vLWC) appliances. This vulnerability allows unauthenticated attackers to remotely gain full administrative access to affected devices. The issue is caused using a default password that is pre-configured in the system and not enforced to be changed […]

Severity High Detail Cybersecurity researchers have identified five distinct security vulnerabilities affecting the TP-Link Archer AX53 v1.0 router. These flaws impact core components, including OpenVPN, dnsmasq, and tmpServer modules. When exploited, the vulnerabilities allow attackers on the same network (adjacent access) to execute system commands, crash services, and access sensitive configuration files, potentially leading to […]

Severity Critical Detail Palo Alto Networks has released an urgent update addressing a critical vulnerability in the Microsoft Teams integration for Cortex XSOAR and Cortex XSIAM, tracked as CVE-2026-0234. The flaw could allow unauthenticated attackers to access and modify sensitive data within affected systems. CVE ID Summary CVSS Score CVE-2026-0234 An improper verification of cryptographic […]

Severity critical Detail A critical zero-day vulnerability has been identified in Fortinet FortiClient Endpoint Management Server (EMS), allowing unauthenticated attackers to execute arbitrary commands on affected systems. The flaw, tracked as CVE-2026-35616, is actively exploited in the wild and poses a significant risk to enterprise environments relying on Fortinet endpoint management solutions. The vulnerability originates […]

Severity High Detail Apple has issued an emergency security update to address a critical vulnerability within its WebKit engine that affects iPhone, iPad, and Mac devices. The flaw, identified as CVE-2026-20643, has the potential to allow attackers to bypass core browser security protections through specially crafted web content. The vulnerability originates from improper handling within […]

Severity High Details Microsoft has released an out-of-band (OOB) hotpatch for Windows 11 to address multiple Remote Code Execution (RCE) vulnerabilities in the Routing and Remote Access Service (RRAS) management component. The vulnerabilities could allow attackers to execute arbitrary code on affected systems by tricking users into connecting to malicious servers or processing specially crafted […]

Severity High Detail Google has released an emergency update for the Chrome browser after discovering two high-severity zero-day vulnerabilities, tracked as CVE‑2026‑3909 and CVE‑2026‑3910, which are actively exploited in the wild. These vulnerabilities could allow attackers to execute arbitrary code, bypass browser protections, and potentially compromise host systems. CVE ID Summary Impact CVSS Score CVE‑2026‑3909 […]

Severity High Detail Cybersecurity researchers have discovered multiple security vulnerabilities in the Linux kernel’s AppArmor module that could allow unprivileged users to bypass security protections, escalate privileges to root, and weaken container isolation mechanisms. These vulnerabilities were identified by the Qualys Threat Research Unit (TRU) and are collectively referred to as CrackArmor. The flaws are […]

Severity High Detail A high-severity elevation of privilege vulnerability has been identified in Active Directory Domain Services (AD DS). The flaw allows an authenticated attacker with low privileges to escalate their access to SYSTEM level by exploiting improper validation of resource names within the service. This vulnerability was addressed by Microsoft during the Microsoft Patch […]

Severity High Detail Fortinet has released a security advisory regarding a high severity vulnerability affecting FortiManager. The vulnerability, tracked as CVE-2025-54820, has a CVSS score of 7.0 and may allow remote, unauthenticated attackers to execute unauthorized commands on affected systems. CVE ID Descrption CVSS Score CVE-2025-54820 A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet […]

Severity High Detail Microsoft released its February 2026 Patch Tuesday security updates addressing 58 vulnerabilities across Windows operating systems and related software components. This Patch Tuesday release also addresses five vulnerabilities rated Critical, including several Elevation of Privilege and Information Disclosure flaws. The update includes six zero-day vulnerabilities actively exploited in the wild, which may […]

Severity High Detail Google has released its March 2026 Android Security Bulletin, delivering patches for 129 security vulnerabilities — among them an actively exploited zero-day in a Qualcomm display/graphics component affecting a wide range of Android devices. CVE ID Vulnerability Type Impact CVSS Score CVE-2026-21385 Buffer Over-Read Occurs when user-supplied data causes an integer overflow […]

Severity High Detail A newly disclosed vulnerability has revealed that the AI-powered answer panel in Google’s Gemini can be manipulated by malicious websites, potentially allowing attackers to hijack the AI-generated content displayed to users. The issue affects how Gemini processes and summarizes web content for its AI Overview panel in search results. Security researchers demonstrated […]

Severity Critical Detail Cisco has released a critical security advisory detailing an actively exploited authentication bypass vulnerability in Cisco Catalyst SD-WAN products, tracked as CVE‑2026‑20127. This flaw has been exploited in targeted attacks and poses a severe risk to SD-WAN deployments. CVE ID Vulnerability Type Impact CVSS Score CVE‑2026‑20127 Improper Authentication (CWE-287) The flaw exists […]

SolarWinds has issued security updates addressing four critical remote code execution (RCE) vulnerabilities affecting its Serv-U file transfer software. If left unpatched, these flaws could allow attackers to gain root-level access to impacted servers. Serv-U is a self-hosted file transfer solution for Windows and Linux environments, offering Managed File Transfer (MFT) and FTP server capabilities. […]

Severity Critical Detail A critical security advisory has been released by HPE Aruba Networking to address several vulnerabilities in its Private 5G Core Platform that could allow hackers access to sensitive system data, disrupt services, and create unauthorized administrative accounts. The vulnerabilities, identified by the Communications Security Establishment (CSE) as CVE-2026-23595, CVE-2026-23596, CVE-2026-23597, and CVE-2026-23598, […]

Severity High Detail Microsoft has announced a zero-day vulnerability in Microsoft Office Word that enables attackers to bypass built-in security protections. Tracked as CVE-2026-21514, the issue was formally documented on February 10, 2026, and presents considerable risk to users globally. CVE-2026-21514 is categorized as a Security Feature Bypass vulnerability within Microsoft Word. The root cause […]

Severity: High Detail Fortinet has revealed a high-severity vulnerability in FortiOS, identified as CVE-2026-22153 (FG-IR-25-1052), which enables unauthenticated attackers to bypass LDAP authentication in Agentless VPN or Fortinet Single Sign-On (FSSO) policies. The flaw, categorized under CWE-305 (Authentication Bypass by Primary Weakness), resides in the fnbamd daemon and is triggered by specific LDAP server configurations […]

SeverityCritical Detail The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting SolarWinds Web Help Desk (WHD) to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The vulnerability stems from a deserialization of untrusted data issue that allows attackers to execute arbitrary commands on affected systems. Successful […]

Severity Critical Detail Ivanti has released updates for Endpoint Manager Mobile (EPMM) which addresses two critical severity vulnerabilities. Successful exploitation could lead to unauthenticated remote code execution. CVE Number  Description  CVSS Score (Severity) CVE-2026-1281 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. 9.8 (Critical) CVE-2026-1340 A code […]

Severity Critical Detail Fortinet has confirmed an actively exploited, critical authentication bypass vulnerability affecting FortiCloud Single Sign-On (SSO), tracked as CVE-2026-24858. The flaw allows attackers to gain administrative access to FortiOS, FortiManager, and FortiAnalyzer devices belonging to other customers through FortiCloud SSO, even when devices were fully patched. CVE Number  Description  CVSS Score (Severity) CVE-2026-24858 […]