Vulnerabilities

SeverityCritical Detail Microsoft has addressed a critical remote code execution vulnerability, tracked as CVE-2026-69836, affecting Microsoft Entra ID, its cloud identity service formerly known as Azure Active Directory. The vulnerability has a CVSS score of 10.0 (Critical) and was reportedly exploited in the wild. The vulnerability is caused by deserialization of untrusted data in Microsoft […]

SeverityCritical Detail The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities affecting Apple macOS, Microsoft SharePoint, VMware vCenter, and Microsoft IKE Service Extensions to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The vulnerabilities are tracked as CVE-2026-65400, CVE-2026-55040, CVE-2026-59310, and CVE-2026-33824, with CVSS scores ranging from 9.1 to […]

SeverityCritical Detail Adobe has released security updates for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to address multiple critical, important, and moderate vulnerabilities. Successful exploitation of the vulnerabilities could result in security feature bypass, arbitrary code execution, and privilege escalation. Adobe stated that it is not aware of any exploits in the wild […]

SeverityHigh Detail Cisco has released security updates to address a high-severity vulnerability, tracked as CVE-2026-20349, affecting the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The vulnerability has a CVSS score of 8.6 (High Severity) and can allow an unauthenticated, remote […]

Severity High Detail Microsoft disclosed a new remote code execution (RCE) vulnerability in Microsoft Outlook, tracked as CVE-2026-70329, on August 11, 2026. The vulnerability is rated Important with a maximum CVSS 3.1 score of 8.8. The flaw is classified as CWE-190 (Integer Overflow or Wraparound), where an application incorrectly handles numerical values outside their expected […]

Severity Critical Detail A critical Linux kernel vulnerability, tracked as CVE-2026-64564 and dubbed SCTPhantom, allows an unprivileged local attacker to escalate privileges to full root and, under specific conditions, escape a container and compromise the underlying host. The vulnerability is a use-after-free (UAF) flaw in the Linux kernel’s SCTP Dynamic Address Reconfiguration (ASCONF) functionality. The […]

Severity High Detail WordPress has disclosed a high-severity pre-authentication reflected cross-site scripting (XSS) vulnerability affecting the WordPress login screen. Tracked as CVE-2026-64638, the vulnerability requires no authentication or attacker privileges and can allow malicious JavaScript to execute in a victim’s browser through a specially crafted username. Researchers at pwn.ai demonstrated that the vulnerability can be […]

Severity Critical Detail SonicWall has disclosed two actively exploited zero-day vulnerabilities affecting SonicWall SMA 1000 appliances. Tracked as CVE-2026-15409 and CVE-2026-15410, the vulnerabilities can be chained to allow unauthenticated attackers to gain root-level access to affected internet-facing VPN gateways. The attack begins by exploiting CVE-2026-15409, a critical pre-authentication vulnerability in the SMA WorkPlace WebSocket proxy […]

Severity Critical Detail Broadcom has released emergency security updates to address five vulnerabilities affecting VMware products, including three critical flaws that could allow attackers to bypass authentication, execute arbitrary code, or escape from a guest virtual machine (VM) to the underlying ESX host. The most severe vulnerabilities affect VMware vCenter Server and VMware ESX. The […]

Severity Critical Detail SolarWinds has released Web Help Desk (WHD) version 2026.2.1 to address multiple security vulnerabilities including a critical authentication bypass flaw and a high-severity denial-of-service (DoS) vulnerability that could impact the availability and security of affected systems. The most critical issue, CVE-2026-28323, is a SAML authentication bypass vulnerability affecting deployments configured to use […]

Severity Critical Detail Security researchers and Cisco have disclosed a high-severity vulnerability affecting Cisco Secure Firewall Management Center (FMC) Software, tracked as CVE-2026-20316, which has been actively exploited in zero-day attacks. The vulnerability is caused by the presence of static credentials associated with a low-privilege account built into Cisco Secure FMC Software. An unauthenticated remote […]

Severity High Detail Security researchers have disclosed four high-severity vulnerabilities affecting libssh2, a widely used open-source C library that provides SSH2 protocol support for applications such as remote administration tools, SFTP clients, automated deployment platforms, backup solutions, and file transfer applications. The vulnerabilities affect libssh2 version 1.11.1 and earlier and could allow a malicious SSH […]

Severity Critical Detail Check Point has disclosed a critical authentication bypass vulnerability, tracked as CVE-2026-16232, affecting Check Point Security Management and Multi-Domain Security Management servers. The flaw allows an unauthenticated remote attacker to obtain a valid application login token, authenticate through SmartConsole, and gain full administrator privileges over the management server. According to Check Point, […]

Severity Critical Detail ASUS has disclosed a critical security vulnerability, tracked as CVE-2026-13385, affecting multiple ASUS router firmware versions. The flaw stems from improper validation of network communications and could allow a remote attacker to execute arbitrary commands through a man-in-the-middle (MITM) attack. According to ASUS, the vulnerability affects firmware branches 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102. […]

Severity Critical Detail Microsoft has disclosed that CVE-2026-50522, a critical remote code execution (RCE) vulnerability affecting Microsoft SharePoint Server, is being actively exploited in the wild. The flaw, caused by insecure deserialization of untrusted data, allows attackers to execute arbitrary code remotely on vulnerable on-premises SharePoint servers. According to Microsoft’s advisory, the vulnerability can be […]

Severity Critical Detail WordPress has released versions 6.9.5 and 7.0.2 to address a critical pre-authentication remote code execution (RCE) vulnerability, known as wp2shell, affecting WordPress Core. The vulnerability allows an anonymous attacker to execute arbitrary code on a vulnerable WordPress installation without authentication, user interaction, or the presence of third-party plugins. According to the published […]

Severity Medium Detail Dell has disclosed a security vulnerability, tracked as CVE-2026-40639 (DSA-2026-197) affecting multiple Dell client platforms. This flaw allows attackers with physical access to recover BIOS administrator and user passwords from the device’s SPI flash memory due to the use of an insecure XOR-based password storage mechanism. The vulnerability exists in the SystemPwSmm […]

Severity High Detail Palo Alto Networks has released security updates to address a high-severity vulnerability in PAN-OS that could allow unauthenticated attackers to execute arbitrary code or cause a denial-of-service (DoS) condition by sending specially crafted network traffic. The vulnerability tracked as CVE-2026-0288 affects the User-ID Terminal Server Agent (TSA) component in PAN-OS and is […]

Severity High Detail Microsoft has released a security update to address a zero-day vulnerability in Microsoft Defender, RoguePlanet which was publicly disclosed after the June 2026 Patch Tuesday. The vulnerability tracked as CVE-2026-50656 affects fully patched Windows 10 and Windows 11 systems and could allow attackers to gain SYSTEM-level privileges through a race condition in […]

Severity Critical Detail BeyondTrust has disclosed multiple vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) appliances. The vulnerabilities, tracked under advisory BT26-03, include critical and high-severity flaws that could lead to authentication bypass, denial-of-service (DoS), and unauthorized access to sensitive data. The most critical vulnerabilities affect the authentication mechanism and have a […]

Severity High Detail RARLAB has released WinRAR 7.23 to address a high-severity vulnerability tracked as CVE-2026-14191. The flaw affects the way WinRAR and UnRAR process RAR5 recovery-volume (.rev) files and could allow a remote attacker to execute arbitrary code on a victim’s system by convincing a user to open a specially crafted archive. The vulnerability […]

Severity Critical Detail Progress Software has released security updates to address a critical vulnerability affecting Progress Kemp LoadMaster. The vulnerability, tracked as CVE-2026-8037 that allows an unauthenticated remote attacker to execute arbitrary commands as the root user on affected appliances when the API is enabled. The vulnerability exists in the escape_quotes() function, which is responsible […]

Severity High Detail A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46331 and nicknamed “Pedit COW,” allows an unprivileged local user to escalate privileges and obtain full root access on affected Linux systems. The vulnerability affects the Linux kernel’s traffic-control subsystem, specifically the tcf_pedit_act() function within the act_pedit module. It impacts Linux kernel versions 5.18 […]

Severity Medium Detail Cisco has released security updates to address an actively exploited vulnerability affecting Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). The vulnerability, tracked as CVE-2026-20262, has a CVSS score of 6.5 (Medium Severity) and may allow an authenticated remote attacker to create or overwrite files on the underlying operating system of an affected […]

Severity High Detail Microsoft has released security updates addressing three critical remote code execution (RCE) vulnerabilities affecting Microsoft Outlook and Microsoft Word. The vulnerabilities, tracked as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635, could allow attackers to execute arbitrary code on affected systems by delivering specially crafted emails or Office documents, originating from memory corruption flaws within the […]

SeverityHigh Detail Ivanti has disclosed and patched a high-severity vulnerability in Endpoint Manager Mobile (EPMM), tracked as CVE-2026-6973. The vulnerability could allow an authenticated attacker with sufficient privileges to achieve remote code execution by injecting malicious Apache configuration directives into affected systems. The vulnerability is classified under CWE-15 Improper Neutralization of Special Elements in Configuration […]

SeverityMedium Detail Microsoft has disclosed and patched Windows BitLocker Security Feature Bypass vulnerability, tracked as CVE-2026-50507, as part of its June 2026 Patch Tuesday security updates. The vulnerability stems from a protection mechanism failure within BitLocker Device Encryption that could allow an unauthorized attacker with physical access to bypass encryption protections and gain access to […]

SeverityCritical Detail SAP has released 15 new security notes as part of its June 2026 Security Patch Day, addressing multiple vulnerabilities across core SAP products. Among the updates are four critical-severity vulnerabilities affecting SAP NetWeaver, SAP Commerce Cloud, SAP Data Hub, and related enterprise platforms. The most severe vulnerability, CVE-2026-44748, is an XML Signature Wrapping […]

Severity High Detail Broadcom has disclosed three stored cross-site scripting (XSS) vulnerabilities affecting VMware Cloud Foundation Operations and several related products. Tracked as CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, the flaws were addressed in security advisory VMSA-2026-0004. No workarounds are currently available, making patching the only viable remediation path. The vulnerabilities stem from stored cross-site scripting flaws […]

Severity High Detail Cisco has disclosed an actively exploited privilege escalation vulnerability, tracked as CVE-2026-20245, affecting Cisco Catalyst SD-WAN Manager. At the time of disclosure, no security patch or workaround is available. The vulnerability affects the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager and is caused by insufficient validation of user-supplied input. An authenticated […]

Severity High Detail A high-severity vulnerability has been identified in Ivanti Neurons for ITSM, affecting both cloud and on-premises deployments. The flaw, tracked as CVE-2026-9614 is an improper access control vulnerability that allows an authenticated remote attacker with low-level privileges to escalate privileges and gain administrator-level access to affected environments. According to Ivanti, this flaw […]

Severity High Detail A high-severity vulnerability has been identified in TP-Link Archer routers, specifically affecting the Archer BE450 v1 and Archer BE7200 v1 models. Tracked as CVE-2026-5509, the flaw is a command injection vulnerability located within the router’s web management interface. It arises due to insufficient input sanitization in backend system commands, allowing an authenticated […]

Severity Critical Detail A critical vulnerability has been identified in Microsoft Windows Netlogon, affecting Windows Server domain controllers. The flaw, tracked as CVE-2026-41089, is a zero-click remote code execution (RCE) vulnerability that allows an unauthenticated attacker to execute arbitrary code with SYSTEM-level privileges by sending specially crafted Netlogon network requests. The vulnerability poses a significant […]

SeverityHigh Detail A high-severity vulnerability has been identified in Palo Alto Networks PAN-OS software affecting GlobalProtect portals and gateways. The flaw, tracked as CVE-2026-0257, is an authentication bypass vulnerability that allows an unauthenticated attacker to bypass normal VPN authentication and establish an unauthorized GlobalProtect VPN connection. The issue is linked to GlobalProtect authentication override cookies, […]

Severity High Detail Microsoft has disclosed two zero-day vulnerabilities affecting Microsoft Defender that are currently being actively exploited in the wild. The vulnerabilities may allow attackers to escalate privileges or disrupt system availability, creating significant risk for enterprise environments. The issues are tracked as CVE-2026-41091 and CVE-2026-45498 and were publicly disclosed on May 19, 2026. […]

Severity High Detail A vulnerability has been identified in VMware Fusion that allows a local attacker to escalate privileges to root on affected systems. The issue, tracked as CVE-2026-41702, stems from a Time-of-Check Time-of-Use (TOCTOU) race condition within a SETUID binary. This occurs when a system validates a condition but later acts on it without […]

Severity Critical Detail A critical heap-based buffer overflow vulnerability, tracked as CVE-2026-41096, has been identified within the Microsoft WindowsDNS Client. The vulnerability centers on DNSAPI[.]dll, the foundational library used by every Windows process to translate domain names into IP addresses. Under normal conditions, this library allocates a specific amount of memory known as a buffer […]

Severity Critical Detail A critical security vulnerability has been discovered in SandboxJS, a widely used JavaScript sandboxing library available on npm. The vulnerability tracked as CVE-2026-43898, allows attackers to escape the sandbox environment and execute arbitrary code directly on the underlying host system potentially resulting in full Remote Code Execution (RCE) without requiring authentication or […]

Severity Medium Detail Microsoft has disclosed a security vulnerability affecting Microsoft Teams for Android that could allow attackers to perform spoofing attacks against users and organizations. The vulnerability tracked as CVE-2026-32185, was released as part of Microsoft’s May 2026 Patch Tuesday security updates. The flaw is caused by improper handling of file and directory access […]

Severity High Detail A high-severity vulnerability has been identified in Cisco Crosswork Network Controller (CNC) and Cisco Network Services Orchestrator (NSO). The flaw tracked as CVE-2026-20188 is caused by insufficient rate limiting on incoming network connections. An unauthenticated remote attacker can exploit the vulnerability using low-complexity attacks to exhaust available connection resources and force affected […]

Severity Critical Detail A critical vulnerability has been identified in Palo Alto Networks PAN-OS software impacting PA-Series and VM-Series firewalls. The flaw tracked as CVE-2026-0300, is a buffer overflow vulnerability affecting the User-ID Authentication Portal (also known as the Captive Portal). This vulnerability allows an unauthenticated attacker to execute arbitrary code with root privileges by […]

Severity High Detail A critical vulnerability has been identified in Apache HTTP Server, one of the most widely used web servers globally. The flaw, tracked as CVE-2026-23918, could allow attackers to execute malicious code remotely on affected systems. The vulnerability is caused by a “double free” memory corruption issue in the handling of HTTP/2 requests. […]

Severity Critical Detail A proof-of-concept (PoC) exploit has been publicly released for a critical vulnerability affecting Fortinet’s FortiSandbox, enabling attackers to execute arbitrary commands on vulnerable systems. Tracked as CVE-2026-39808, the vulnerability is classified as an OS command injection (CWE-78) issue caused by improper neutralization of special elements in system commands. This flaw allows a […]

Severity Medium Detail Microsoft has addressed a moderate-severity vulnerability in the Windows Snipping Tool that could allow attackers to steal user credentials through a spoofing attack. Tracked as CVE-2026-33829, the flaw was patched as part of the April 14, 2026, security updates. The vulnerability was discovered and reported by security researchers at Blackarrow (Tarlogic), highlighting […]

Updated on Apr 18, 2026 Detail Cisco has released security updates addressing multiple critical vulnerabilities affecting Identity Services Engine (ISE), ISE Passive Identity Connector (ISE-PIC), and Webex Services. These vulnerabilities could allow attackers to execute arbitrary code, impersonate legitimate users, or gain unauthorized control over affected systems. The issues primarily stem from insufficient validation of […]

Severity High Detail Microsoft has disclosed a high-severity vulnerability affecting Windows Active Directory, which could allow attackers to execute malicious code within enterprise environments. Tracked as CVE-2026-33826, the flaw enables authenticated attackers to perform remote code execution over an adjacent network, posing significant risk to affected systems. CVE ID Summary CVSS Score CVE-2026-33826 Improper input […]

Severity High Detail Cybersecurity researchers have identified a critical vulnerability affecting Adobe Acrobat Reader that is being actively exploited in the wild. The flaw, tracked as CVE-2026-34621, allows attackers to execute arbitrary code on affected systems. This vulnerability is associated with improper memory handling, which can be triggered when a user opens a specially crafted […]

Severity Critical Detail Cybersecurity researchers have identified a critical security vulnerability affecting Juniper Networks Support Insights Virtual Lightweight Collector (vLWC) appliances. This vulnerability allows unauthenticated attackers to remotely gain full administrative access to affected devices. The issue is caused using a default password that is pre-configured in the system and not enforced to be changed […]

Severity High Detail Cybersecurity researchers have identified five distinct security vulnerabilities affecting the TP-Link Archer AX53 v1.0 router. These flaws impact core components, including OpenVPN, dnsmasq, and tmpServer modules. When exploited, the vulnerabilities allow attackers on the same network (adjacent access) to execute system commands, crash services, and access sensitive configuration files, potentially leading to […]

Severity Critical Detail Palo Alto Networks has released an urgent update addressing a critical vulnerability in the Microsoft Teams integration for Cortex XSOAR and Cortex XSIAM, tracked as CVE-2026-0234. The flaw could allow unauthenticated attackers to access and modify sensitive data within affected systems. CVE ID Summary CVSS Score CVE-2026-0234 An improper verification of cryptographic […]