Security feed

— Debian High · Remote code execution

DSA-6607-1 apt - security update

— Debian High · Remote code execution

DSA-6608-1 puppet-agent - security update

— Debian High · Auth or access bypass

DSA-6609-1 trapperkeeper-authorization-clojure - security update

— Debian High · Privilege escalation

DSA-6610-1 xen - security update

— Debian High · Remote code execution

DSA-6611-1 imagemagick - security update

— Debian High · Injection / SSRF

DSA-6612-1 symfony - security update

03:00 CISA KEV Exploited (KEV) · CISA due 18 Nov Critical · Auth or access bypass

Apple Multiple Products Improper Authentication Vulnerability

CVE-2024-27834

Read our write-up -> Source

23:24 Ubuntu Medium · Denial of service

USN-9000-1: Twisted vulnerability

22:49 Ubuntu High · Injection / SSRF

USN-8999-1: Pillow vulnerabilities

CVE-2026-54058 · CVE-2026-54059 · CVE-2026-54060 · CVE-2026-55379 · CVE-2026-55380 · CVE-2026-59197 +5

Read our write-up -> Source

22:32 Ubuntu High · Auth or access bypass

USN-8998-1: Squid vulnerability

22:25 Ubuntu Medium · Denial of service

USN-8997-1: Net-SNMP vulnerability

22:14 Ubuntu High · Injection / SSRF

USN-7530-2: ADOdb vulnerability

20:37 Ubuntu High · Remote code execution

USN-8996-1: APT vulnerability

17:45 Packagist Medium · Auth or access bypass

symfony/http-foundation: CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075

CVE-2026-118514

Read our write-up -> Source

15:00 Microsoft Medium · Memory corruption

November 2026 Early Security Updates

07:00 Packagist Medium · Multiple / other

symfony/http-kernel: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

07:00 Packagist Medium · Multiple / other

symfony/http-foundation: Generated URLs Can Point to a Host Chosen by the Client

07:00 Packagist Medium · Auth or access bypass

symfony/http-foundation: The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies

07:00 Packagist Medium · Auth or access bypass

symfony/http-foundation: Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

— Debian High · Injection / SSRF

DSA-6606-1 squid - security update

— CISA KEV Exploited (KEV) · CISA due 6 Nov Critical · Remote code execution

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

CVE-2026-119977

Read our write-up -> Source

00:39 Ubuntu High · Remote code execution

USN-8994-1: libvips vulnerabilities

CVE-2025-59933 · CVE-2026-33327 · CVE-2026-33328 · CVE-2026-35590 · CVE-2026-35591 · CVE-2026-69242 +3

00:38 Ubuntu High · Auth or access bypass

USN-8993-1: SOGo vulnerability

00:38 Ubuntu Medium · Remote code execution

USN-8992-1: Shapelib vulnerability

00:37 Ubuntu High · Remote code execution

USN-8991-1: rxvt-unicode vulnerability

— Debian High · Privilege escalation

DSA-6602-1 linux - security update

— Debian Medium · Information disclosure

DSA-6603-1 git-annex - security update

— Debian High · Privilege escalation

DSA-6604-1 incus - security update

— Debian High · Remote code execution

DSA-6600-1 vim - security update

— Debian Medium · Memory corruption

DSA-6597-1 dpdk - security update

— Debian Low · Multiple / other

DSA-6599-1 nss - security update

— CISA KEV Exploited (KEV) · CISA due 2 Nov Critical · Privilege escalation

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

CVE-2026-111357

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 13 Nov Critical · File access / upload

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

CVE-2026-118527

Read our write-up -> Source

— Debian High · Remote code execution

DSA-6593-1 imagemagick - security update

— Debian High · Remote code execution

DSA-6594-1 python-git - security update

— Debian High · Remote code execution

DSA-6596-1 wordpress - security update

— CISA KEV Exploited (KEV) · CISA due 1 Nov Critical · Denial of service

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

CVE-2026-76418

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 1 Nov Critical · Remote code execution

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

CVE-2026-97229

Read our write-up -> Source

— Debian High · Auth or access bypass

DSA-6591-1 openjdk-25 - security update

— CISA KEV Exploited (KEV) · CISA due 11 Nov Critical · Multiple / other

Broadcom VMWare ESX Insufficient Logging Vulnerability

CVE-2026-41709

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 31 Oct Critical · Memory corruption

Linux Kernel Missing Initialization of a Variable Vulnerability

CVE-2026-46300

Read our write-up -> Source

00:13 WordPress High · Remote code execution

WordPress 7.1.4

— Debian High · Remote code execution

DSA-6586-1 valkey - security update

— Debian Medium · Denial of service

DSA-6587-1 pdns - security update

— Debian High · Auth or access bypass

DSA-6588-1 openjdk-21 - security update

— Debian Medium · Denial of service

DSA-6589-1 php-mongodb - security update

— CISA KEV Exploited (KEV) · CISA due 10 Nov Critical · Remote code execution

Google Brotli Unchecked Return Value Vulnerability

CVE-2026-111497

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 10 Nov Critical · Remote code execution

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-48356

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 29 Oct Critical · Remote code execution

PHP Memory Corruption Vulnerability

CVE-2026-109618

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 29 Oct Critical · Remote code execution

PHP Stale Internal Request-State Vulnerability

CVE-2026-109619

Read our write-up -> Source

18:57 PHP Critical · Memory corruption

Updated PHP Windows builds for Brotli security fix

— Debian High · Auth or access bypass

DSA-6584-1 varnish - security update

— Debian Medium · Information disclosure

DSA-6583-1 libheif - security update

— Debian High · Injection / SSRF

DSA-6579-1 roundcube - security update

— Debian High · Auth or access bypass

DSA-6580-1 erlang - security update

— Debian Medium · Multiple / other

DSA-6581-1 unbound - security update

— Debian High · Remote code execution

DSA-6582-1 brotli - security update

— CISA KEV Exploited (KEV) · CISA due 26 Oct Critical · Remote code execution

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

CVE-2026-110447

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 26 Oct Critical · Injection / SSRF

Arista VeloCloud Orchestrator SQL Injection Vulnerability

CVE-2026-114625

Read our write-up -> Source

04:50 Packagist Critical · Auth or access bypass

laravel/framework: Laravel TokenGuard authentication bypass through non-string API credentials

CVE-2026-114509

Read our write-up -> Source

04:47 Packagist Medium · Auth or access bypass

laravel/framework: Laravel relationship inclusion can trigger unauthorized data destruction

CVE-2026-114508

Read our write-up -> Source

03:51 Packagist Medium · Auth or access bypass

livewire/livewire: Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

— Debian Low · Multiple / other

DSA-6578-1 aide - security update

20:44 WordPress Critical · Remote code execution

Critical PHP Security Release

07:35 PHP Critical · Remote code execution

Security advisory: Critical remote code execution vulnerabilities, update now

— CISA KEV Exploited (KEV) · CISA due 23 Oct Critical · Remote code execution

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

CVE-2026-106931

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 3 Nov Critical · Remote code execution

Siemens Software Center Uncontrolled Search Path Element Vulnerability

CVE-2026-110936

— CISA KEV Exploited (KEV) · CISA due 3 Nov Critical · Remote code execution

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

CVE-2026-96652

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 23 Oct Critical · Auth or access bypass

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

CVE-2026-96654

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 3 Nov Critical · Injection / SSRF

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

CVE-2026-96655

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 23 Oct Critical · Remote code execution

Plex Media Server External Control of File Name or Path Vulnerability

CVE-2026-96656

Read our write-up -> Source

03:32 PHP Critical · Multiple / other

Upcoming Critical PHP Security Release

— CISA KEV Exploited (KEV) · CISA due 19 Oct Critical · File access / upload

Fortinet Multiple Products Path Traversal Vulnerability

CVE-2025-61624

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 19 Oct Critical · Auth or access bypass

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

CVE-2026-102764

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 18 Oct Critical · File access / upload

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

CVE-2026-21589

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 17 Oct Critical · Remote code execution

Palo Alto Networks PAN-OS Code Injection Vulnerability

CVE-2026-0322

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 17 Oct Critical · Auth or access bypass

Ahsay AhsayCBS Improper Authentication Vulnerability

CVE-2026-105133

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 17 Oct Critical · Remote code execution

Ahsay AhsayCBS Command Injection Vulnerability

CVE-2026-105134

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 17 Oct Critical · Remote code execution

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

CVE-2026-76519

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 16 Oct Critical · Remote code execution

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

CVE-2026-104935

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 16 Oct Critical · Injection / SSRF

Microsoft Windows Command Injection Vulnerability

CVE-2026-96951

Read our write-up -> Source

14:00 Microsoft Critical · Multiple / other

October 2026 Security Updates

— CISA KEV Exploited (KEV) · CISA due 11 Oct Critical · File access / upload

ProFTPD Improper Access Control Vulnerability

CVE-2015-3306

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 11 Oct Critical · Denial of service

ISC BIND Data Processing Errors Vulnerability

CVE-2015-5477

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 11 Oct Critical · Remote code execution

Apache Struts Command Injection Vulnerability

CVE-2016-3081

— CISA KEV Exploited (KEV) · CISA due 11 Oct Critical · Remote code execution

ONLYOFFICE Docs Server Path Traversal Vulnerability

CVE-2021-3199

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 11 Oct Critical · Auth or access bypass

Strapi Cleartext Storage of Sensitive Information Vulnerability

CVE-2023-22894

Read our write-up -> Source

00:00 WordPress High · Multiple / other

WordPress 7.1.3 Maintenance and Security Release

06:44 Packagist Medium · Auth or access bypass

filament/filament: Filament: Multi-factor authentication (app) management actions do not require password reauthentication

CVE-2026-104181

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 7 Oct Critical · Memory corruption

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88779

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 5 Oct Critical · Remote code execution

Zammad GmbH Zammad Session Fixation Vulnerability

CVE-2026-102489

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 5 Oct Critical · Privilege escalation

Zammad GmbH Zammad Improper Privilege Management Vulnerability

CVE-2026-102490

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 4 Oct Critical · File access / upload

Fortinet FortiMail Path Traversal Vulnerability

CVE-2026-104286

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 3 Oct Critical · Auth or access bypass

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

CVE-2026-76504

Read our write-up -> Source

22:36 Packagist Medium · Cross-site scripting

league/commonmark: league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

22:36 Packagist High · Denial of service

league/commonmark: league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

— CISA KEV Exploited (KEV) · CISA due 13 Oct Critical · Remote code execution

Apple Multiple Products Out-of-Bounds Write Vulnerability

CVE-2026-86950

Read our write-up -> Source

01:24 Packagist Low · Cross-site scripting

laravel/framework: Laravel: XSS in Debug Page Information

CVE-2026-102279

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 30 Sep Critical · Remote code execution

Citrix NetScaler Improper Input Validation Vulnerability

CVE-2026-88771

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 30 Sep Critical · Remote code execution

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88772

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 28 Sep Critical · Remote code execution

Microsoft SharePoint Code Injection Vulnerability

CVE-2026-65660

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 28 Sep Critical · Auth or access bypass

Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

CVE-2026-67279

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 28 Sep Critical · Remote code execution

WordPress Core Remote File Inclusion Vulnerability

CVE-2026-87902

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 27 Sep Critical · Remote code execution

WSO2 Multiple Products Path Traversal Vulnerability

CVE-2026-5430

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 27 Sep Critical · Auth or access bypass

Adobe Commerce and Magento Incorrect Authorization Vulnerability

CVE-2026-71362

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 25 Sep Critical · Remote code execution

Check Point Multiple Products Improper Certificate Validation Vulnerability

CVE-2026-85102

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 25 Sep Critical · Remote code execution

Check Point Multiple Products Path Traversal Vulnerability

CVE-2026-93616

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 25 Sep Critical · Auth or access bypass

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

CVE-2026-93952

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 25 Sep Critical · Remote code execution

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

CVE-2026-94127

Read our write-up -> Source

21:01 WordPress Critical · Multiple / other

WordPress 7.1.2 Release

— CISA KEV Exploited (KEV) · CISA due 24 Sep Critical · Remote code execution

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

CVE-2026-7273

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 21 Sep Critical · Multiple / other

Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

CVE-2025-39682

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 21 Sep Critical · Multiple / other

Linux Kernel Race Condition Vulnerability

CVE-2025-39964

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 21 Sep Critical · Memory corruption

Linux Kernel Out-of-Bounds Write Vulnerability

CVE-2026-53266

Read our write-up -> Source

02:53 WordPress Medium · Multiple / other

WordPress 7.1.1 Maintenance and Security Release

— CISA KEV Exploited (KEV) · CISA due 19 Sep Critical · Privilege escalation

Google Pixel Improper Authorization Vulnerability

CVE-2026-58704

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 19 Sep Critical · Auth or access bypass

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

CVE-2026-76460

— CISA KEV Exploited (KEV) · CISA due 19 Sep Critical · Privilege escalation

Acronis Backup Incorrect Default Permissions Vulnerability

CVE-2026-87886

15:00 Packagist High · Denial of service

symfony/http-foundation: CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

CVE-2026-108082

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 17 Sep Critical · Remote code execution

Cisco Secure Email Gateway SQL Injection Vulnerability

CVE-2026-76461

— CISA KEV Exploited (KEV) · CISA due 25 Sep Critical · Privilege escalation

JFrog Artifactory Incorrect Authorization Vulnerability

CVE-2026-42016

— CISA KEV Exploited (KEV) · CISA due 25 Sep Critical · Auth or access bypass

JFrog Artifactory Improper Authentication Vulnerability

CVE-2026-42018

— CISA KEV Exploited (KEV) · CISA due 14 Sep Critical · Remote code execution

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

CVE-2026-84869

— CISA KEV Exploited (KEV) · CISA due 14 Sep Critical · File access / upload

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

CVE-2026-85706

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 13 Sep Critical · Auth or access bypass

MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

CVE-2026-67277

— CISA KEV Exploited (KEV) · CISA due 13 Sep Critical · Privilege escalation

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

CVE-2026-86060

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 12 Sep Critical · Remote code execution

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

CVE-2025-25249

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 12 Sep Critical · Auth or access bypass

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-19490

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 12 Sep Critical · Remote code execution

Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-20079

— CISA KEV Exploited (KEV) · CISA due 23 Sep Critical · Remote code execution

Google Chromium V8 Out of Bounds Write Vulnerability

CVE-2026-87491

— CISA KEV Exploited (KEV) · CISA due 11 Sep Critical · Remote code execution

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

CVE-2026-75650

— CISA KEV Exploited (KEV) · CISA due 22 Sep Critical · Privilege escalation

Microsoft Windows Link Following Vulnerability

CVE-2026-81963

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 22 Sep Critical · Privilege escalation

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

CVE-2026-85880

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 11 Sep Critical · Remote code execution

N-able N-central Static Code Injection Vulnerability

CVE-2026-86218

04:24 Packagist Medium · Information disclosure

phpseclib/phpseclib: phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

CVE-2026-84308

Read our write-up -> Source

14:00 Microsoft Medium · Multiple / other

September 2026 Security Updates

— CISA KEV Exploited (KEV) · CISA due 18 Sep Critical · Remote code execution

Google Chromium V8 Type Confusion Vulnerability

CVE-2026-85046

— CISA KEV Exploited (KEV) · CISA due 16 Sep Critical · Auth or access bypass

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

CVE-2026-48710

— CISA KEV Exploited (KEV) · CISA due 5 Sep Critical · Remote code execution

Kestra OSS OS Command Injection Vulnerability

CVE-2026-49869

— CISA KEV Exploited (KEV) · CISA due 16 Sep Critical · Auth or access bypass

BerriAI LiteLLM Improper Authentication Vulnerability

CVE-2026-59822

— CISA KEV Exploited (KEV) · CISA due 5 Sep Critical · Auth or access bypass

JFrog Artifactory Improper Authentication Vulnerability

CVE-2026-82329

— CISA KEV Exploited (KEV) · CISA due 5 Sep Critical · Injection / SSRF

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVE-2026-83548

— CISA KEV Exploited (KEV) · CISA due 5 Sep Critical · Remote code execution

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

CVE-2026-83549

— CISA KEV Exploited (KEV) · CISA due 5 Sep Critical · Remote code execution

Sangoma Switchvox SQL Injection Vulnerability

CVE-2026-9586

21:38 Packagist Medium · Cross-site scripting

livewire/livewire: Livewire DOM-based cross-site scripting during client-side state handling

CVE-2026-81887

Read our write-up -> Source

04:29 Packagist Medium · Auth or access bypass

filament/filament: Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

CVE-2026-84306

Read our write-up -> Source

04:29 Packagist Low · Information disclosure

filament/filament: Filament: Password validity disclosure for accounts denied panel access on login page

CVE-2026-84307

Read our write-up -> Source

04:28 Packagist High · Auth or access bypass

filament/filament: Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

CVE-2026-77567

Read our write-up -> Source

03:28 Packagist High · Denial of service

league/commonmark: league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

03:21 Packagist High · Denial of service

league/commonmark: league/commonmark: Denial of service in the SmartPunct and Attributes extensions

03:18 Packagist High · Cross-site scripting

league/commonmark: league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

03:17 Packagist High · Denial of service

league/commonmark: league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

— CISA KEV Exploited (KEV) · CISA due 14 Sep Critical · Auth or access bypass

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

CVE-2026-81578

— CISA KEV Exploited (KEV) · CISA due 14 Sep Critical · Remote code execution

PaperCut NG/MF Unsafe Reflection Vulnerability

CVE-2026-82078

— CISA KEV Exploited (KEV) · CISA due 30 Aug Critical · Auth or access bypass

ownCloud Improper Authentication Vulnerability

CVE-2023-49105

— CISA KEV Exploited (KEV) · CISA due 30 Aug Critical · Privilege escalation

Linux Kernel Unspecified Vulnerability

CVE-2026-53362

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 10 Sep Critical · File access / upload

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

CVE-2026-66384

— CISA KEV Exploited (KEV) · CISA due 9 Sep Critical · Privilege escalation

Red Hat Libuser Race Condition Vulnerability

CVE-2015-3246

— CISA KEV Exploited (KEV) · CISA due 9 Sep Critical · Privilege escalation

Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

CVE-2015-5287

— CISA KEV Exploited (KEV) · CISA due 29 Aug Critical · Remote code execution

Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2019-1068

— CISA KEV Exploited (KEV) · CISA due 9 Sep Critical · Remote code execution

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

CVE-2021-23758

— CISA KEV Exploited (KEV) · CISA due 29 Aug Critical · Privilege escalation

Linux Kernel Out-of-Bounds Write Vulnerability

CVE-2022-0995

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 29 Aug Critical · Memory corruption

Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-8452

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 28 Aug Critical · Remote code execution

Gitea Code Injection Vulnerability

CVE-2026-60004

— CISA KEV Exploited (KEV) · CISA due 27 Aug Critical · Auth or access bypass

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

CVE-2026-21962

— CISA KEV Exploited (KEV) · CISA due 24 Aug Critical · Remote code execution

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

CVE-2026-73570

— CISA KEV Exploited (KEV) · CISA due 23 Aug Critical · Remote code execution

TrueConf Server Missing Authentication for Critical Function Vulnerability

CVE-2026-72529

— CISA KEV Exploited (KEV) · CISA due 3 Sep Critical · Remote code execution

TrueConf Server Code Injection Vulnerability

CVE-2026-72530

— CISA KEV Exploited (KEV) · CISA due 2 Sep Critical · Injection / SSRF

MLflow Server-Side Request Forgery Vulnerability

CVE-2026-64849

— CISA KEV Exploited (KEV) · CISA due 21 Aug Critical · Remote code execution

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

CVE-2026-33824

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 21 Aug Critical · Auth or access bypass

Microsoft SharePoint Weak Authentication Vulnerability

CVE-2026-55040

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 21 Aug Used by ransomware Critical · Remote code execution

Broadcom VMware vCenter Path Traversal Vulnerability

CVE-2026-59310

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 21 Aug Critical · Auth or access bypass

Apple macOS Improper Authentication Vulnerability

CVE-2026-65400

— CISA KEV Exploited (KEV) · CISA due 20 Aug Critical · Remote code execution

Ray-Project Ray Code Injection Vulnerability

CVE-2025-62593

21:45 WordPress Medium · Multiple / other

WordPress 7.0.4 Release

— CISA KEV Exploited (KEV) · CISA due 14 Aug Critical · Denial of service

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

CVE-2026-20349

— CISA KEV Exploited (KEV) · CISA due 25 Aug Critical · Privilege escalation

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

CVE-2026-68820

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 14 Aug Critical · Injection / SSRF

Metabase SQL Injection Vulnerability

CVE-2026-72898

14:00 Microsoft Medium · Multiple / other

August 2026 Security Updates

— CISA KEV Exploited (KEV) · CISA due 10 Aug Critical · Remote code execution

Progress LoadMaster Command Injection Vulnerability

CVE-2026-8037

03:42 Packagist Medium · Denial of service

league/commonmark: league/commonmark: Denial of service via deeply nested XML output

03:41 Packagist High · Denial of service

league/commonmark: league/commonmark: Denial of service via colliding heading slugs

03:40 Packagist High · Denial of service

league/commonmark: league/commonmark: Denial of service via duplicate footnote definitions

03:39 Packagist High · Denial of service

league/commonmark: league/commonmark: Denial of service via adjacent inline attribute blocks

03:37 Packagist High · Denial of service

league/commonmark: league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

CVE-2026-71488

03:30 Packagist Medium · Cross-site scripting

league/commonmark: league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

CVE-2026-71478

01:55 WordPress Medium · Multiple / other

WordPress 7.0.3 release

— CISA KEV Exploited (KEV) · CISA due 8 Aug Used by ransomware Critical · Remote code execution

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

CVE-2026-63077

— CISA KEV Exploited (KEV) · CISA due 7 Aug Critical · Auth or access bypass

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-18556

— CISA KEV Exploited (KEV) · CISA due 7 Aug Critical · Information disclosure

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

CVE-2026-34486

— CISA KEV Exploited (KEV) · CISA due 7 Aug Critical · Remote code execution

IBM Langflow Code Injection Vulnerability

CVE-2026-9198

— CISA KEV Exploited (KEV) · CISA due 6 Aug Critical · Auth or access bypass

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-18577

04:07 Packagist High · Auth or access bypass

guzzlehttp/guzzle: Guzzle: Noncanonical host can bypass host-based checks

CVE-2026-69246

04:05 Packagist Medium · Information disclosure

guzzlehttp/guzzle: Guzzle: Noncanonical cookie domain keeps subdomain scope

CVE-2026-69245

— CISA KEV Exploited (KEV) · CISA due 1 Aug Used by ransomware Critical · Auth or access bypass

Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

CVE-2026-20316

— CISA KEV Exploited (KEV) · CISA due 10 Aug Critical · Information disclosure

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

CVE-2025-68686

— CISA KEV Exploited (KEV) · CISA due 30 Jul Critical · Injection / SSRF

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

CVE-2026-16812

— CISA KEV Exploited (KEV) · CISA due 25 Jul Critical · Auth or access bypass

Check Point SmartConsole Improper Authentication Vulnerability

CVE-2026-16232

— CISA KEV Exploited (KEV) · CISA due 25 Jul Critical · Remote code execution

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CVE-2026-50522

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 24 Jul Critical · Remote code execution

DD-WRT Stack-Based Buffer Overflow Vulnerability

CVE-2021-27137

— CISA KEV Exploited (KEV) · CISA due 24 Jul Critical · Remote code execution

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

CVE-2026-0770

— CISA KEV Exploited (KEV) · CISA due 4 Aug Critical · Remote code execution

WordPress Core SQL Injection Vulnerability

CVE-2026-60137

— CISA KEV Exploited (KEV) · CISA due 24 Jul Critical · Remote code execution

WordPress Core Interpretation Conflict Vulnerability

CVE-2026-63030

06:28 Packagist Medium · Information disclosure

guzzlehttp/guzzle: Guzzle: URI fragments disclosed in redirect Referer headers

CVE-2026-67354

06:27 Packagist Medium · Information disclosure

guzzlehttp/guzzle: Guzzle: Host-only cookie scope is not preserved

CVE-2026-67355

06:27 Packagist Medium · Denial of service

guzzlehttp/guzzle: Guzzle: Unbounded response cookies risk denial of service

CVE-2026-67353

05:00 Packagist Medium · Injection / SSRF

guzzlehttp/guzzle: Guzzle: Cookie Disclosure and Injection via IP-Address Domains

CVE-2026-59883

04:46 Packagist Medium · Information disclosure

guzzlehttp/guzzle: Guzzle: Proxy-Authorization headers can be sent to origin servers

CVE-2026-67339

01:45 WordPress Critical · Multiple / other

WordPress 7.0.2 Release

— CISA KEV Exploited (KEV) · CISA due 19 Jul Critical · Remote code execution

Fortinet FortiSandbox OS Command Injection Vulnerability

CVE-2026-25089

— CISA KEV Exploited (KEV) · CISA due 19 Jul Critical · Remote code execution

Fortinet FortiSandbox OS Command Injection Vulnerability

CVE-2026-39808

— CISA KEV Exploited (KEV) · CISA due 19 Jul Critical · Remote code execution

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CVE-2026-58644

Read our write-up -> Source

— CISA KEV Exploited (KEV) · CISA due 29 Jul Critical · Denial of service

KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability

CVE-2023-4346

— CISA KEV Exploited (KEV) · CISA due 18 Jul Critical · Privilege escalation

Oracle E-Business Suite Improper Privilege Management Vulnerability

CVE-2026-46817

— CISA KEV Exploited (KEV) · CISA due 17 Jul Used by ransomware Critical · Injection / SSRF

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVE-2026-15409

— CISA KEV Exploited (KEV) · CISA due 17 Jul Used by ransomware Critical · Remote code execution

SonicWall SMA1000 Appliances Code Injection Vulnerability

CVE-2026-15410

— CISA KEV Exploited (KEV) · CISA due 28 Jul Critical · Privilege escalation

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

CVE-2026-56155

— CISA KEV Exploited (KEV) · CISA due 17 Jul Critical · Auth or access bypass

Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

CVE-2026-56164

Read our write-up -> Source

14:00 Microsoft Medium · Multiple / other

July 2026 Security Updates

— CISA KEV Exploited (KEV) · CISA due 16 Jul Critical · Remote code execution

Cisco IOS Cross-Site Request Forgery Vulnerability

CVE-2008-4128

— CISA KEV Exploited (KEV) · CISA due 13 Jul Critical · Remote code execution

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-48939

— CISA KEV Exploited (KEV) · CISA due 13 Jul Critical · Remote code execution

Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-56291

4 Nov 2026

5 Nov 2026

4 Nov 2026

3 Nov 2026

4 Nov 2026

2 Nov 2026

1 Nov 2026

31 Oct 2026

30 Oct 2026

29 Oct 2026

28 Oct 2026

29 Oct 2026

27 Oct 2026

26 Oct 2026

25 Oct 2026

24 Oct 2026

23 Oct 2026

24 Oct 2026

22 Oct 2026

21 Oct 2026

20 Oct 2026

21 Oct 2026

16 Oct 2026

15 Oct 2026

14 Oct 2026

13 Oct 2026

8 Oct 2026

7 Oct 2026

6 Oct 2026

4 Oct 2026

2 Oct 2026

1 Oct 2026

30 Sep 2026

29 Sep 2026

30 Sep 2026

27 Sep 2026

25 Sep 2026

24 Sep 2026

22 Sep 2026