Security Articles

Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.

Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.

Updated July 31, 2026 — 169 published advisories, with new analysis most weekdays. Recent coverage includes a Cisco Secure Firewall Management Center zero-day already under active exploitation (CVE-2026-20316), an OpenWrt DHCPv6 flaw that hands over root without any authentication (CVE-2026-53921), a pre-authentication remote code execution bug affecting every on-premises JetBrains TeamCity build server (CVE-2026-63077), a CVSS 10.0 Arista VeloCloud Orchestrator flaw already exploited in the wild (CVE-2026-16812), and the fastjson deserialization remote code execution bug still shipping without a patch (CVE-2026-16723). If one of these touches a system you run and you are not sure what to do next, our 24/7 staffed security operations center handles the triage for you.

All Articles AdvisoryCyber AttackData BreachExploitMalwareThreat ActorVulnerability
Severity: All Critical High Medium Low
36 articles found
Featured Story
high
Jul 30, 2026
highCVE AdvisoryVulnerability

HIGH: Cisco Secure FMC Zero-Day CVE-2026-20316 Under Active Exploitation

Cisco Secure Firewall Management Center ships with static credentials for a low privilege account, and attackers exploited the flaw as a zero-day before any fix existed. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29, 2026. Hot fixes are available for every affected train and no workarounds exist.

By Danny MercerRead Full Article
CVE-2026-46242
high
CVE AdvisoryVulnerabilityCVE-2026-46242 •Jul 5, 2026

HIGH: Bad Epoll Linux Kernel Flaw Hands Any User Root on Servers and Android (CVE-2026-46242)

A use-after-free race condition in the Linux kernel epoll subsystem lets an unprivileged local user escalate to root with roughly 99 percent reliability. It affects kernel 6.4 and newer across servers, desktops, and Android, can be triggered from a Chrome renderer sandbox, and has no workaround. Only a patched kernel fixes it.

Read more
high
CVE AdvisoryVulnerability•Jun 18, 2026

HIGH: Microsoft Defender RoguePlanet Zero-Day Hits SYSTEM Without a Patch in Sight (CVE-2026-50656)

Researcher Nightmare Eclipse dropped a public PoC for CVE-2026-50656 (RoguePlanet), a TOCTOU race condition in the Microsoft Defender Malware Protection Engine that yields NT AUTHORITY\SYSTEM on fully patched Windows 10 and Windows 11. Microsoft has confirmed the flaw, rated it CVSS 7.8, and is still working on a patch. The PoC works whether real-time protection is enabled or not, leaving defenders with detection and containment as the only options for now.

Read more
CVE-2026-5027
high
CVE AdvisoryVulnerabilityCVE-2026-5027 •Jun 11, 2026

HIGH: Langflow Path Traversal CVE-2026-5027 Lets Unauthenticated Attackers Plant Code on Roughly 7,000 Exposed AI Servers

A path traversal flaw in Langflow's POST /api/v2/files endpoint allows unauthenticated attackers to write files anywhere the platform process can reach, opening a clean route to remote code execution on the roughly seven thousand exposed instances Censys is currently tracking. Tenable disclosed CVE-2026-5027 in late March, the maintainers shipped a fix in version 1.10.0 on June 10, and VulnCheck honeypots are catching exploitation right now. Patch immediately or pull the instance off the public internet.

Read more
CVE-2026-11645
high
CVE AdvisoryVulnerabilityCVE-2026-11645 •Jun 10, 2026

HIGH: Chrome V8 Zero-Day CVE-2026-11645 Under Active Exploitation, Patch Today

Google confirmed active in the wild exploitation of CVE-2026-11645, an out-of-bounds read and write vulnerability in Chrome V8 with a CVSS score of 8.8. The fifth Chrome zero day patched in 2026 lets attackers run code inside the browser sandbox via a crafted HTML page. Update to Chrome 149.0.7827.102 or .103 immediately and force a relaunch across the fleet.

Read more
CVE-2026-20230
high
CVE AdvisoryVulnerabilityCVE-2026-20230 •Jun 7, 2026

HIGH: Cisco Unified Communications Manager SSRF Flaw Has a Public PoC and a Root-Level Punchline (CVE-2026-20230)

Cisco's June 3 advisory for CVE-2026-20230 details a critical-rated SSRF in the Unified Communications Manager WebDialer service, with a CVSS 8.6 base score and a public proof-of-concept already in circulation. An unauthenticated attacker on the network can write arbitrary files to the underlying OS and chain that into root. Cisco has released fixes in 14SU6 and an interim COP for the 15 line, with 15SU5 due in September 2026. Disabling WebDialer is the recommended interim mitigation.

Read more
CVE-2026-20245
high
CVE AdvisoryVulnerabilityCVE-2026-20245 •Jun 6, 2026

HIGH: Cisco Catalyst SD-WAN Manager Zero-Day Under Active Exploitation, No Patch Available (CVE-2026-20245)

Cisco confirmed active exploitation of CVE-2026-20245, an unpatched command injection flaw in Catalyst SD-WAN Manager that lets authenticated attackers escalate to root and push malicious configurations to edge devices. The CVSS 7.8 bug is the seventh exploited SD-WAN zero-day since 2023 and chains with two prior auth bypass vulnerabilities to enable full remote takeover. No patch is available.

Read more
CVE-2026-49975
high
CVE AdvisoryVulnerabilityCVE-2026-49975 •Jun 3, 2026

HIGH: HTTP/2 Bomb Vulnerability Lets a Home Connection Flatten NGINX, Apache, IIS, Envoy, and Cloudflare Pingora

A newly disclosed HTTP/2 vulnerability dubbed HTTP/2 Bomb lets a single client on a residential connection exhaust 32 gigabytes of server memory in under twenty seconds. The flaw, tracked as CVE-2026-49975 for Apache httpd, affects NGINX, Apache, Microsoft IIS, Envoy, and Cloudflare Pingora. NGINX and Apache shipped fixes. IIS, Envoy, and Pingora remain unpatched as of public disclosure on June 2, 2026.

Read more
CVE-2026-0257
high
CVE AdvisoryVulnerabilityCVE-2026-0257 •May 31, 2026

HIGH: Palo Alto GlobalProtect Auth Bypass (CVE-2026-0257) Actively Exploited, Now on CISA KEV

A GlobalProtect authentication override flaw in PAN-OS lets unauthenticated attackers forge session cookies and walk into the VPN. Rapid7 observed two waves of in the wild exploitation in May, CISA added the bug to the KEV catalog on May 29 with a June 1 federal deadline, and Palo Alto Networks has confirmed active exploitation against unpatched devices.

Read more
CVE-2026-9082
high
CVE AdvisoryVulnerabilityCVE-2026-9082 •May 23, 2026

HIGH: Drupal Core SQL Injection CVE-2026-9082 Hits CISA KEV Days After Disclosure

Drupal disclosed SA-CORE-2026-004 (CVE-2026-9082), a Highly Critical SQL injection in the core database abstraction API that lets unauthenticated attackers escalate privileges and reach remote code execution on PostgreSQL-backed sites. Imperva is tracking 15,000+ attack attempts against nearly 6,000 sites across 65 countries. CISA added the bug to KEV on May 22 with a federal patch deadline of May 27, 2026.

Read more
CVE-2026-41091
high
CVE AdvisoryVulnerabilityCVE-2026-41091 •May 21, 2026

HIGH: Microsoft Defender Burns Again as Two New Zero-Days Hit Active Exploitation

Microsoft confirmed on May 21 that CVE-2026-41091, a CVSS 7.8 link-following privilege escalation in the Microsoft Malware Protection Engine, and CVE-2026-45498, a denial-of-service flaw in the Defender Antimalware Platform, are both under active exploitation. CISA added both to the KEV catalog with a June 3 federal remediation deadline. Defender engine version 1.1.26040.8 and Antimalware Platform 4.18.26040.7 contain the fixes and ship automatically through definition updates.

Read more
CVE-2026-45585
high
CVE AdvisoryVulnerabilityCVE-2026-45585 •May 20, 2026

HIGH: Microsoft Ships Mitigation for YellowKey BitLocker Bypass Zero-Day (CVE-2026-45585)

Microsoft published mitigation guidance for CVE-2026-45585, the YellowKey BitLocker bypass zero-day publicly disclosed by researcher Chaotic Eclipse last week. The flaw lives in the FsTx Auto Recovery Utility inside Windows Recovery Environment and lets anyone with physical access and a USB stick spawn an unrestricted shell with the BitLocker-protected volume already mounted. Windows 11 24H2, 25H2, 26H1 and Windows Server 2025 are affected.

Read more
CVE-2026-42897
high
CVE AdvisoryVulnerabilityCVE-2026-42897 •May 16, 2026

HIGH: Microsoft Exchange Server XSS Flaw CVE-2026-42897 Under Active Attack

Microsoft Exchange Server CVE-2026-42897 is a cross-site scripting flaw in Outlook Web Access that lets a crafted email execute JavaScript in the victim OWA session. CISA added it to the Known Exploited Vulnerabilities catalog on May 15, 2026 after confirmed in-the-wild exploitation, with a May 29 federal mitigation deadline. Exchange Server 2016, 2019, and Subscription Edition are affected. Exchange Online is not. Microsoft scored it CVSS 8.1, and patches shipped in the May 2026 security update.

Read more
CVE-2026-6973
high
CVE AdvisoryVulnerabilityCVE-2026-6973 •May 11, 2026

HIGH: Ivanti EPMM CVE-2026-6973 Under Active Exploitation, CISA Mandates 3-Day Federal Patch Deadline

Ivanti has confirmed in-the-wild exploitation of CVE-2026-6973, an authenticated remote code execution flaw in on-premises Endpoint Manager Mobile rated CVSS 7.2. CISA added the bug to its Known Exploited Vulnerabilities catalog on May 7 and gave federal agencies until May 10, 2026 to remediate. The exploitation pattern strongly suggests reuse of admin credentials harvested during the unauthenticated EPMM compromises disclosed in January 2026.

Read more
CVE-2026-43284
high
CVE AdvisoryVulnerabilityCVE-2026-43284 •May 9, 2026

HIGH: 'Dirty Frag' Linux Kernel Bugs Hand Locals Root, One Half Already Patched, RxRPC Half Still Open (CVE-2026-43284, CVE-2026-43500)

Two Linux kernel page-cache write bugs collectively named Dirty Frag let any unprivileged local user pop a root shell in one command. CVE-2026-43284 in xfrm-ESP was patched May 8. CVE-2026-43500 in RxRPC is still unpatched. Microsoft has already seen active exploitation in the wild and a public proof-of-concept is on GitHub.

Read more

Is Your Mobile App Secure?

Our CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.

Learn About Mobile Pen TestingMSP Partner Program
Page 1 of 2Next

Stay Informed

Subscribe to our newsletter and get the latest security insights delivered to your inbox.