Security Articles

Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.

Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.

Updated August 19, 2026 — 188 published advisories, with new analysis most weekdays. Recent coverage includes a flaw in the Ray AI framework that a botnet exploited before it was even public, which CISA has now ordered federal agencies to fix by August 20 (CVE-2025-62593), a SAP Commerce Cloud flaw attackers began exploiting within days of the patch, giving them a way to run their own code on your storefront (CVE-2026-58231), a Cisco firewall flaw attackers are using to knock remote-access VPNs offline, cutting staff off from the network (CVE-2026-20349), an Adobe ColdFusion flaw rated the maximum 10.0 severity that lets an attacker run commands on your server without ever logging in (CVE-2026-48362), and a SharePoint flaw attackers are using to walk past the login screen entirely, now that working exploit code is public (CVE-2026-55040). If one of these touches a system you run and you are not sure what to do next, our 24/7 staffed security operations center handles the triage for you.

Severity: All Critical High Medium Low
128 articles found
Featured Story
critical
Aug 19, 2026
criticalCVE AdvisoryVulnerability

CRITICAL: Windows IKE Flaw CVE-2026-33824 Under Active Exploitation

CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities catalog on August 18 after Unit 42 observed hands on keyboard attacks against Windows IKE VPN endpoints. The CVSS 9.8 double free in the Windows IKE Service Extensions gives unauthenticated attackers SYSTEM level code execution over UDP 500 and 4500. Microsoft patched it in April 2026 and federal agencies must remediate by August 21.

By Danny MercerRead Full Article
critical
CVE AdvisoryVulnerabilityAug 18, 2026

CRITICAL: Ray CVE-2025-62593 Added to CISA KEV After Active Exploitation

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026, giving federal civilian agencies until August 20 to remediate. The critical 9.4 flaw in the Ray distributed AI framework lets a malicious web page reach an otherwise unexposed Ray dashboard through DNS rebinding and execute arbitrary code. The RondoDox botnet weaponized it two days before public disclosure, and every version before Ray 2.52.0 is affected.

Read more
critical
CVE AdvisoryVulnerabilityAug 14, 2026

CRITICAL: SharePoint CVE-2026-55040 Exploited After Public PoC Release

Microsoft patched CVE-2026-55040 in July 2026, a CVSS 9.1 authentication bypass in on-premises SharePoint Server that chains four JWT validation failures to let an unauthenticated attacker forge tokens and impersonate any user, including administrators. Rapid7 published a working proof of concept on August 11 and honeypots recorded exploitation attempts roughly one day later. SharePoint Server 2016, 2019, and Subscription Edition are all affected.

Read more
critical
CVE AdvisoryVulnerabilityAug 11, 2026

CRITICAL: Gunra Ransomware Exploits Fortinet FortiOS Auth Bypass Flaws

CISA, the FBI, and South Korea's National Police Agency issued joint advisory AA26-222A on the Gunra ransomware group, which is breaching networks through the Fortinet FortiOS and FortiProxy authentication bypass flaws CVE-2024-55591 and CVE-2025-24472. Gunra has claimed fifty-one victims across healthcare, finance, government, and manufacturing, and tampers with VDI authentication files to create a persistent MFA bypass before destroying backups and encrypting with ChaCha20.

Read more
high
CVE AdvisoryVulnerabilityAug 9, 2026

HIGH: WordPress 7.0.3 Fixes Pre-Auth XSS Chaining to PHP Code Execution

WordPress 7.0.3 patches CVE-2026-64638, a pre-authentication cross-site scripting flaw on the login screen that researchers chained all the way to PHP code execution on the server. The CVSS 8.9 bug comes from a parser disagreement between strip_tags and KSES, affects every maintained version before 7.0.3, and was backported to the 4.7 branch. No confirmed exploitation in the wild yet, but the full technique is public.

Read more
critical
CVE AdvisoryVulnerabilityAug 7, 2026

CRITICAL: Cisco Patches Three CVSS 9.9 Catalyst SD-WAN Flaws and Seven IOS XE Bugs

Cisco shipped security hardening releases for Catalyst SD-WAN and IOS XE on August 5, 2026, fixing 12 flaws including three rated CVSS 9.9 and a 9.8 command injection. There are no workarounds and no configuration mitigations, only fixed images, and the low privileges required rating means any authenticated account on SD-WAN Manager is now a critical severity foothold.

Read more
critical
CVE AdvisoryVulnerabilityAug 6, 2026

CRITICAL: Veeam Service Provider Console CVE-2026-58073 Allows Unauthenticated Credential Theft

Veeam patched four flaws in Service Provider Console, the multi-tenant console that MSPs and hosting providers use to manage customer backups. The most severe, CVE-2026-58073 at CVSS 9.5, lets an unauthenticated attacker impersonate a managed agent and steal that agent's credentials. Every version 9 build through 9.2.1.33875 is affected, and build 9.3.0.35057 is the fix.

Read more
critical
CVE AdvisoryVulnerabilityAug 5, 2026

CRITICAL: Langflow CVE-2026-9198 Hits CISA KEV as Exploit Code Spreads

IBM Langflow carries a CVSS 9.8 unauthenticated remote code execution flaw, CVE-2026-9198, that chains a token minting auto-login endpoint with a code validation endpoint running exec(). CISA added it to the Known Exploited Vulnerabilities catalog with an August 7 federal deadline, public exploit code is circulating, and roughly 7,000 instances are reachable online. Upgrade to 1.10.1 or later and rotate every secret the instance could read.

Read more
high
CVE AdvisoryVulnerabilityAug 3, 2026

HIGH: N-able N-central Auth Bypass Exploited After Incomplete Patch

N-able confirmed that attackers exploited an authentication bypass in N-central to take over administrator accounts on customer RMM servers, then found its original patch was incomplete. CVE-2026-18577 widens the affected range to every build before 2026.3.1.7, which shipped on August 2. Attackers pivoted from compromised consoles into managed endpoints and planted Cloudflare tunnels that survive both reboots and revoked console access.

Read more
critical
CVE AdvisoryVulnerabilityAug 2, 2026

CRITICAL: Coldcard Seed Flaw Linked to $70 Million Bitcoin Theft

A firmware integration error shipped in March 2021 routed Coldcard seed generation to a deterministic software PRNG instead of the STM32 hardware RNG, cutting effective entropy to as low as 40 bits. An attacker drained 1,196 Bitcoin addresses of 1,082.65 BTC worth roughly $70.2 million in 41 minutes on July 30, 2026, without ever touching a device. Coinkite shipped emergency firmware on July 31, but updating does not repair a seed that was already generated.

Read more
critical
CVE AdvisoryVulnerabilityJul 31, 2026

CRITICAL: Azure Cosmos DB CVE-2026-66803 Exposed a Platform-Wide Master Key

Microsoft has disclosed CVE-2026-66803, a CVSS 10.0 improper access control flaw in Azure Cosmos DB that let researchers escape the Gremlin query sandbox and reach a platform wide signing key capable of retrieving the primary key for any Cosmos DB account on the service. Microsoft says no customer data was accessed and no customer action is required, but the finding is a hard lesson in cloud key hygiene and blast radius.

Read more

Is Your Mobile App Secure?

Our CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.

Page 1 of 7Next

Stay Informed

Subscribe to our newsletter and get the latest security insights delivered to your inbox.