Security Articles

Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.

Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.

Updated July 31, 2026 — 169 published advisories, with new analysis most weekdays. Recent coverage includes a Cisco Secure Firewall Management Center zero-day already under active exploitation (CVE-2026-20316), an OpenWrt DHCPv6 flaw that hands over root without any authentication (CVE-2026-53921), a pre-authentication remote code execution bug affecting every on-premises JetBrains TeamCity build server (CVE-2026-63077), a CVSS 10.0 Arista VeloCloud Orchestrator flaw already exploited in the wild (CVE-2026-16812), and the fastjson deserialization remote code execution bug still shipping without a patch (CVE-2026-16723). If one of these touches a system you run and you are not sure what to do next, our 24/7 staffed security operations center handles the triage for you.

All Articles Advisory Cyber Attack Data Breach Exploit Malware Threat Actor Vulnerability

Severity: All Critical High Medium Low

65 articles found

Featured Story

CVE-2026-0300

critical

May 6, 2026

criticalCVE AdvisoryVulnerability

CRITICAL: Palo Alto PAN-OS Zero-Day Hands Attackers Root on Internet-Facing Firewalls (CVE-2026-0300)

CVE-2026-0300 is an unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal that grants root code execution on PA-Series and VM-Series firewalls. Palo Alto has confirmed limited in-the-wild exploitation against internet-exposed portals. CVSS scores 9.3 for internet-exposed deployments, 8.7 for trusted-network only. Patches roll out from May 13 through May 28, 2026.

By Danny MercerRead Full Article

CVE-2026-4670

critical

CVE AdvisoryVulnerabilityCVE-2026-4670 •May 5, 2026

CRITICAL: Progress MOVEit Automation Hit by 9.8 Auth Bypass With No Workaround

Progress Software disclosed CVE-2026-4670, an unauthenticated authentication bypass in MOVEit Automation rated CVSS 9.8, alongside CVE-2026-5174, a CVSS 7.7 privilege escalation. Patch to 2025.1.5, 2025.0.9, or 2024.1.8. No workarounds exist.

CVE-2026-41940

critical

CVE AdvisoryVulnerabilityCVE-2026-41940 •May 4, 2026

CRITICAL: cPanel Authentication Bypass CVE-2026-41940 Exploited Against MSPs and Government Targets

A pre-authentication bypass in cPanel and WHM (CVE-2026-41940, CVSS 9.8) is being mass-exploited. CRLF injection in cpsrvd lets attackers forge a session cookie and gain root with no credentials. CISA added it to KEV on April 30, 2026. Patch immediately.

critical

CVE AdvisoryVulnerability•May 2, 2026

CRITICAL: Google Patches CVSS 10 Gemini CLI Flaw That Turned CI Workspaces Into Free RCE

A maximum severity CVSS 10.0 flaw in Google Gemini CLI headless mode let any attacker who could drop a .gemini directory into a CI workspace execute code on the runner host. Tracked as GHSA-wpqr-6v78-jr5g, it is fixed in @google/gemini-cli 0.39.1 and 0.40.0-preview.3, plus run-gemini-cli action 0.1.22. Patch immediately and rotate any secrets reachable from affected pipelines.

critical

CVE AdvisoryVulnerability•May 1, 2026

CRITICAL: Google Gemini CLI Earns CVSS 10 By Trusting Every Folder It Touches

Google patched a CVSS 10.0 remote code execution flaw in the Gemini CLI that let attackers hijack CI/CD pipelines through malicious .gemini/ configurations in untrusted workspaces. The advisory ships under GHSA-wpqr-6v78-jr5g without a CVE assigned, and any organization running the run-gemini-cli GitHub Action without a pinned version was carrying the vulnerable code by default.

CVE-2026-3854

critical

CVE AdvisoryVulnerabilityCVE-2026-3854 •Apr 30, 2026

CRITICAL: GitHub Enterprise Server RCE via a Single Git Push (CVE-2026-3854)

Wiz researchers disclosed CVE-2026-3854 on April 28, a critical remote code execution flaw in GitHub Enterprise Server that turns a single authenticated git push into full server compromise. Roughly 88 percent of internet-exposed Enterprise Server instances were unpatched at disclosure. GitHub.com and Enterprise Cloud are already fixed, but self-hosted admins must upgrade to 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, or 3.20.0.

CVE-2026-40372

critical

CVE AdvisoryVulnerabilityCVE-2026-40372 •Apr 22, 2026

CRITICAL: Microsoft Patches CVSS 9.1 ASP.NET Core Flaw Letting Attackers Forge Authentication Cookies on Linux

Microsoft published an advisory for CVE-2026-40372, a CVSS 9.1 elevation-of-privilege flaw in Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6 that lets a network-positioned attacker forge authentication cookies and decrypt protected payloads. The bug primarily affects Linux and macOS deployments where the managed authenticated encryptor computes its HMAC tag over the wrong bytes and skips the comparison entirely. Patch to 10.0.7 immediately and rotate the DataProtection key ring if the application was internet-exposed during the vulnerable window.

critical

CVE AdvisoryVulnerability•Apr 17, 2026

CRITICAL: Cisco Patches Four Critical Flaws in ISE and Webex Including RCE

Cisco released patches for four critical vulnerabilities affecting Identity Services Engine and Webex. CVE-2026-20184 allows unauthenticated attackers to impersonate any Webex user, while three ISE flaws enable remote code execution and root privilege escalation.

CVE-2026-33032

critical

CVE AdvisoryVulnerabilityCVE-2026-33032 •Apr 16, 2026

nginx-ui Unauthenticated RCE Gives Attackers Full Web Server Control (CVE-2026-33032)

A critical unauthenticated RCE in nginx-ui lets attackers take over your web server through a single API call. The flaw exists because one MCP endpoint skipped authentication checks entirely. Patch immediately or restrict access to the management interface.

CVE-2024-9486

critical

CVE AdvisoryVulnerabilityCVE-2024-9486 •Apr 14, 2026

Kubernetes Image Builder Bakes Default SSH Credentials Into Every VM It Creates (CVE-2024-9486)

CVE-2024-9486 (CVSS 9.8) in Kubernetes Image Builder leaves a well-known default SSH password on every VM image it builds. Anyone who knows the builder account password can SSH in and take full control. Check your images and rotate credentials immediately.

CVE-2026-29849

critical

CVE AdvisoryVulnerabilityCVE-2026-29849 •Mar 20, 2026

Veeam Backup Critical Flaw Lets Ransomware Gangs Delete Your L...

Critical authentication bypass in Veeam Backup & Replication allows attackers to delete backup repositories without credentials.

critical

CVE AdvisoryVulnerability•Mar 18, 2026

KVM Switch Vulnerabilities Give Attackers Direct Hardware Access

Nine critical vulnerabilities in budget IP KVM switches from GL-iNet, Angeet, Sipeed, and JetKVM allow unauthenticated code execution and hardware-level access.

CVE-2025-47813

critical

CVE AdvisoryVulnerabilityCVE-2025-47813 •Mar 17, 2026

CRITICAL: CISA Adds Wing FTP Vulnerability to KEV as Attackers Chain Flaws for Remote Access

CISA added CVE-2025-47813 (info disclosure) to KEV, used to enhance CVE-2025-47812 (CVSS 10.0 RCE) exploitation. Attackers chain both flaws for reliable remote access. Wing FTP patches available since May 2025. Federal deadline: March 30.

CVE-2026-3909

critical

CVE AdvisoryVulnerabilityCVE-2026-3909 •Mar 15, 2026

CRITICAL: Google Patches Two Chrome Zero-Days Under Active Attack

Google patched CVE-2026-3909 (Skia OOB write) and CVE-2026-3910 (V8 implementation flaw), both actively exploited. Third Chrome zero-day emergency in 2026. Update to 146.0.7680.75/76 immediately.

CVE-2026-42071

critical

CVE AdvisoryVulnerabilityCVE-2026-42071 •Mar 14, 2026

Apache Tomcat RCE Vulnerability Actively Exploited

CVE-2026-42071 (CVSS 9.8) in Apache Tomcat allows unauthenticated RCE via partial PUT request handling. Actively exploited 30 hours after disclosure.

CVE-2017-7921

critical

CVSS 9.8

CVE AdvisoryVulnerabilityCVE-2017-7921 CVSS 9.8 •Mar 6, 2026

CISA Adds Hikvision and Rockwell Automation Flaws to KEV Catalog as Attacks Accelerate

CISA confirmed active exploitation of CVE-2017-7921 (Hikvision cameras) and CVE-2021-22681 (Rockwell Automation controllers), both CVSS 9.8. Federal agencies must patch by March 26, 2026. Legacy vulnerabilities remain potent weapons in attacker arsenals.

CVE-2026-22719

critical

CVSS 8.1

CVE AdvisoryVulnerabilityCVE-2026-22719 CVSS 8.1 •Mar 5, 2026

VMware Aria Operations Under Active Attack as CISA Orders Emergency Patches

CISA added CVE-2026-22719 (CVSS 8.1) to the Known Exploited Vulnerabilities catalog after confirming active exploitation. The command injection flaw in VMware Aria Operations allows unauthenticated RCE. Federal agencies must patch by March 24, 2026.

CVE-2026-22769

critical

CVSS 10.0

CVE AdvisoryVulnerabilityCVE-2026-22769 CVSS 10.0 •Feb 19, 2026

Dell RecoverPoint Zero-Day Gave Chinese Hackers 18 Months of Access

A maximum-severity zero-day in Dell RecoverPoint for Virtual Machines (CVSS 10.0) has been exploited by Chinese state-sponsored hackers since mid-2024. The flaw involves hard-coded Tomcat credentials enabling root access. CISA has added it to the KEV catalog with a 3-day patch deadline.

CVE-2026-1731

critical

CVSS 9.9

CVE AdvisoryVulnerabilityCVE-2026-1731 CVSS 9.9 •Feb 15, 2026

BeyondTrust Remote Support Under Active Attack After PoC Drops

A critical pre-authentication RCE vulnerability in BeyondTrust Remote Support and Privileged Remote Access is now being actively exploited after a proof-of-concept was published. With a CVSS of 9.9 and approximately 8,500 unpatched on-premise deployments exposed, organizations must patch immediately.

CVE-2026-20700

critical

CVSS 8.8

CVE AdvisoryVulnerabilityCVE-2026-20700 CVSS 8.8 •Feb 12, 2026

Apple First Zero-Day of 2026 and the Three-Stage Exploit Chain Behind It

Apple patches CVE-2026-20700, a memory corruption flaw in dyld exploited in sophisticated attacks. The vulnerability completes a three-stage exploit chain with two December 2025 bugs (CVE-2025-14174, CVE-2025-43529) discovered by Google TAG, likely used in mercenary spyware operations.

Is Your Mobile App Secure?

Our CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.

Learn About Mobile Pen Testing MSP Partner Program

PreviousPage 3 of 4Next

Stay Informed

Subscribe to our newsletter and get the latest security insights delivered to your inbox.