CISA Archives • Daily CyberSecurity

MikroTik RouterOS Flaw CVE-2026-16347 Helps Attackers Gain Unauthorized System Access MikroTik RouterOS vulnerability CVE-2026-16347 enabling brute-force attacks and unauthorized system access

MikroTik RouterOS vulnerability CVE-2026-16347 enabling brute-force attacks and unauthorized system access

MikroTik RouterOS Flaw CVE-2026-16347 Helps Attackers Gain Unauthorized System Access

Do Son August 1, 2026

CVE-2026-16347 lets attackers brute-force MikroTik RouterOS logins for unauthorized system access. Rated CVSS 8.8, with no fix...

Tycon Power Monitor Authentication Bypass CVE-2026-61884 Rated CVSS 9.8 Tycon authentication bypass CVE-2026-61884 in TPDIN-Monitor-WEB2 rated CVSS 9.8

Tycon authentication bypass CVE-2026-61884 in TPDIN-Monitor-WEB2 rated CVSS 9.8

Tycon Power Monitor Authentication Bypass CVE-2026-61884 Rated CVSS 9.8

Do Son July 24, 2026

TL;DR CISA published advisory ICSA-26-202-01 on July 21, 2026. It covers a critical Tycon authentication bypass in...

White House Launches GOLD EAGLE Initiative to Speed Vulnerability Patching GOLD EAGLE initiative dashboard for U.S. cybersecurity vulnerability coordination

GOLD EAGLE initiative dashboard for U.S. cybersecurity vulnerability coordination

White House Launches GOLD EAGLE Initiative to Speed Vulnerability Patching

Do Son July 21, 2026

The White House has launched the GOLD EAGLE initiative, a new clearinghouse for cybersecurity vulnerability coordination. It...

CISA Adds FortiSandbox and SharePoint Flaws to KEV Catalog After Confirming Active Exploitation CISA KEV catalog adds three actively exploited FortiSandbox and SharePoint vulnerabilities

CISA KEV catalog adds three actively exploited FortiSandbox and SharePoint vulnerabilities

CISA Adds FortiSandbox and SharePoint Flaws to KEV Catalog After Confirming Active Exploitation

Do Son July 17, 2026

TL;DR CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on July 16, 2026. Two affect...

CISA Adds Oracle E-Business Suite and KNX Flaws to KEV Catalog CISA KEV catalog additions CVE-2026-46817 and CVE-2023-4346 illustration

CISA Adds Oracle E-Business Suite and KNX Flaws to KEV Catalog

Do Son July 16, 2026

TL;DR The CISA KEV catalog gained two entries on July 15, 2026. The agency confirmed active exploitation...

CISA Warns Three SharePoint Server Vulnerabilities Are Exploited in the Wild, Urges Hardening CISA alert on SharePoint vulnerabilities exploited in the wild including CVE-2026-56164

CISA alert on SharePoint vulnerabilities exploited in the wild including CVE-2026-56164

CISA Warns Three SharePoint Server Vulnerabilities Are Exploited in the Wild, Urges Hardening

Do Son July 15, 2026

TL;DR CISA has confirmed active exploitation of three SharePoint vulnerabilities: CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. Threat actors chain...

State of Exploited Vulnerabilities — Q2 2026 75 CVEs confirmed exploited in Q2 2026. Microsoft leads with 15, Ivanti tops EPSS at 99%. Full breakdown by vendor, CWE, and publication-to-exploit gap.

75 CVEs confirmed exploited in Q2 2026. Microsoft leads with 15, Ivanti tops EPSS at 99%. Full breakdown by vendor, CWE, and publication-to-exploit gap.

State of Exploited Vulnerabilities — Q2 2026

Do Son July 11, 2026

State of Exploited Vulnerabilities — Q2 2026 Coverage period: April 1 – June 30, 2026 Data source:...

CISA Adds Four Actively Exploited Flaws to Its KEV Catalog CISA KEV Catalog update listing four actively exploited Joomla Langflow and Adobe ColdFusion vulnerabilities

CISA KEV Catalog update listing four actively exploited Joomla Langflow and Adobe ColdFusion vulnerabilities

CISA Adds Four Actively Exploited Flaws to Its KEV Catalog

Do Son July 8, 2026

TL;DR The CISA KEV Catalog just gained four actively exploited flaws. Three of them carry a top...

CISA Adds Cisco Unified CM and PTC Windchill Flaws to KEV Catalog CISA KEV Catalog adding CVE-2026-20230 Cisco Unified CM and CVE-2026-12569 PTC Windchill vulnerabilities

CISA KEV Catalog adding CVE-2026-20230 Cisco Unified CM and CVE-2026-12569 PTC Windchill vulnerabilities

CISA Adds Cisco Unified CM and PTC Windchill Flaws to KEV Catalog

Do Son June 26, 2026

TL;DR The CISA KEV Catalog gained two new entries on June 25, 2026. Both additions cite evidence...

AVer PTC Cameras Hit by Critical RCE Flaw CVE-2026-40624 (CVSS 9.8) AVer PTC camera flaw CVE-2026-40624 enabling remote code execution

AVer PTC Cameras Hit by Critical RCE Flaw CVE-2026-40624 (CVSS 9.8)

Do Son June 24, 2026

TL;DR CISA published advisory ICSA-26-169-01 on June 18, 2026. It warns of an AVer PTC camera flaw...

Naxclow IoT Vulnerabilities: 7 Flaws Let Attackers Hijack Doorbells and Cameras Naxclow IoT vulnerabilities device takeover, CVE-2026-28742, CVE-2026-50101, CVE-2026-42947 CVE-2022-35914 Synectix LAN 232 TRIO CVE-2026-1633

Naxclow IoT vulnerabilities device takeover, CVE-2026-28742, CVE-2026-50101, CVE-2026-42947 CVE-2022-35914 Synectix LAN 232 TRIO CVE-2026-1633

Naxclow IoT Vulnerabilities: 7 Flaws Let Attackers Hijack Doorbells and Cameras

Do Son June 16, 2026

CISA has disclosed seven serious Naxclow IoT vulnerabilities affecting popular smart doorbells and cameras. Together, these flaws...

CISA Sounds the Alarm: State-Sponsored Hackers Weaponize New Windows and ScreenConnect Flaws State-Sponsored Exploitation CISA KEV Catalog F5 BIG-IP RCE CISA KEV Catalog SolarWinds WHD Exploit CVE-2025-40551 Zimbra XSS Zero-Day CVE-2025-27915 Exploited Windows Security Vulnerabilities

State-Sponsored Exploitation CISA KEV Catalog F5 BIG-IP RCE CISA KEV Catalog SolarWinds WHD Exploit CVE-2025-40551 Zimbra XSS Zero-Day CVE-2025-27915 Exploited Windows Security Vulnerabilities

CISA Sounds the Alarm: State-Sponsored Hackers Weaponize New Windows and ScreenConnect Flaws

Do Son April 29, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding two...

CISA Warns of Active Exploitation in Cisco, PaperCut, and Zimbra TP-Link, CISA CVE-2023-32315 CISA KEV Catalog Active Exploitation

CISA Warns of Active Exploitation in Cisco, PaperCut, and Zimbra

Do Son April 21, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding eight...

Critical Alert: Iranian-Affiliated Actors Target U.S. Infrastructure via Industrial Control Systems Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

Critical Alert: Iranian-Affiliated Actors Target U.S. Infrastructure via Industrial Control Systems

Do Son April 8, 2026

In a major joint advisory released on April 7, 2026, a coalition of U.S. federal agencies—including the...

Security Alert: Critical Vulnerability Hits Anritsu Remote Spectrum Monitors Ollama Heap Leak CVE-2026-5757 Anritsu Vulnerability Authentication Bypass Gootloader Malware Malformed ZIP Evasion Blender Malware, StealC V2 Lectora, XSS CVE-2025-9125 HFS RCE, Template Injection Arch Linux Malware, CHAOS RAT CVE-2024-56404 - CVE-2024-39327 CVE-2025-2538

Ollama Heap Leak CVE-2026-5757 Anritsu Vulnerability Authentication Bypass Gootloader Malware Malformed ZIP Evasion Blender Malware, StealC V2 Lectora, XSS CVE-2025-9125 HFS RCE, Template Injection Arch Linux Malware, CHAOS RAT CVE-2024-56404 - CVE-2024-39327 CVE-2025-2538

Security Alert: Critical Vulnerability Hits Anritsu Remote Spectrum Monitors

Do Son April 2, 2026

A recent security advisory summarized by CISA highlights a critical design flaw in Anritsu Remote Spectrum Monitors...

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

Critical 9.8 CVSS Flaw in Pharos Mosaic Controllers Grants Root Access to Unauthenticated Attackers

Do Son March 27, 2026

A security advisory has been issued by CISA regarding a critical vulnerability discovered in Pharos Controls’ Mosaic...

Critical Honeywell CCTV Flaw (CVSS 9.8) Allows Unauthenticated Takeover Honeywell CCTV Vulnerability CVE-2026-1670 EagleMsgSpy Spyware Tool ResidentBat Spyware, Belarusian KGB Surveillance

Honeywell CCTV Vulnerability CVE-2026-1670 EagleMsgSpy Spyware Tool ResidentBat Spyware, Belarusian KGB Surveillance

Critical Honeywell CCTV Flaw (CVSS 9.8) Allows Unauthenticated Takeover

Do Son February 18, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical vulnerability in Honeywell...

CISA Adds 2008 Windows Flaw & Chrome Zero-Day to KEV Ivanti EPMM Vulnerability CVE-2026-1340 CISA KEV Catalog CVE-2026-21385 CISA KEV Update CVE-2008-0015 CISA KEV, Array Networks Command Injection CVE-2025-0111 & CVE-2025-23209 CISA, Known Exploited Vulnerabilities

Ivanti EPMM Vulnerability CVE-2026-1340 CISA KEV Catalog CVE-2026-21385 CISA KEV Update CVE-2008-0015 CISA KEV, Array Networks Command Injection CVE-2025-0111 & CVE-2025-23209 CISA, Known Exploited Vulnerabilities

CISA Adds 2008 Windows Flaw & Chrome Zero-Day to KEV

Do Son February 18, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog with four...

Critical ZLAN5143D Flaws (CVSS 9.8) Allow Total Takeover, No Patch Available

Do Son February 16, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding high-severity vulnerabilities in industrial connectivity...

CISA Warns of Unpatched Avation & RISS Critical Flaws

Do Son February 5, 2026

In a concerning update for the operational technology (OT) sector, the Cybersecurity and Infrastructure Security Agency (CISA)...

PoC Public & Exploited: Critical SolarWinds Help Desk Flaw Exploited in the Wild State-Sponsored Exploitation CISA KEV Catalog F5 BIG-IP RCE CISA KEV Catalog SolarWinds WHD Exploit CVE-2025-40551 Zimbra XSS Zero-Day CVE-2025-27915 Exploited Windows Security Vulnerabilities

PoC Public & Exploited: Critical SolarWinds Help Desk Flaw Exploited in the Wild

Do Son February 4, 2026

The clock is ticking for organizations running SolarWinds Web Help Desk (WHD), as a nightmare scenario unfolds:...

Unpatchable & Critical: CISA Issues CVSS 10.0 Alert for Synectix Adapters Naxclow IoT vulnerabilities device takeover, CVE-2026-28742, CVE-2026-50101, CVE-2026-42947 CVE-2022-35914 Synectix LAN 232 TRIO CVE-2026-1633

Unpatchable & Critical: CISA Issues CVSS 10.0 Alert for Synectix Adapters

Do Son February 4, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a maximum-severity alert for the Synectix LAN 232...