Do Son
TL;DR Ivanti disclosed CVE-2026-104935 on October 13, 2026, and confirmed the flaw is already exploited in the...
exploited in the wild
TL;DR Attackers are exploiting two unauthenticated stored XSS flaws in Ninja Forms and WPC Product Bundles for...
TL;DR Attackers have begun CVE-2026-21589 exploitation against self-managed Atlassian servers. Researchers at watchTowr published a full technical...
TL;DR Attackers chained two Zammad zero-day flaws to break into the Dutch Institute for Vulnerability Disclosure (DIVD)...
TL;DR A Sharp printer vulnerability, now tracked as CVE-2024-58388, lets unauthenticated attackers read any file on the...
TL;DR Attackers are exploiting a MediaWiki RCE flaw tracked as CVE-2026-100382. This CVSS 10 unauthenticated RCE sits...
TL;DR watchTowr has published a technical analysis and a public proof-of-concept for CVE-2026-88771, a Citrix NetScaler flaw...
TL;DR Cisco confirmed active attacks on a critical Cisco Secure Email Gateway vulnerability. Tracked as CVE-2026-76461, it...
TL;DR Acronis fixed a high-severity Acronis cPanel plugin vulnerability in its Backup plugin for cPanel and WHM....
TL;DR Attackers are exploiting CVE-2026-14894 in the wild. This critical Super Forms vulnerability lets unauthenticated users upload...
TL;DR SonicWall published advisory SNWLID-2026-0016 on September 1, 2026. It confirms active exploitation of two SMA1000 flaws....
TL;DR Proxmox published advisory PSA-2026-00043-1 on September 1, 2026. It warns of a critical Proxmox VE authentication...
TL;DR Attackers are exploiting CVE-2026-9586 in the wild. This critical Sangoma Switchvox vulnerability turns an unauthenticated SQL...
Attackers are actively targeting JetBrains TeamCity servers in the wild. The TeamCity CVE-2026-63077 vulnerability allows unauthenticated remote...
GitLab has patched a critical flaw that lets unauthenticated attackers delete public projects and user data. The...
TL;DR CVE-2026-77806 is a CVSS 9.8 unauthenticated RCE in the SPIP CMS. It affects all versions before...
TL;DR CVE-2026-19598 is a CVSS 9.8 privilege escalation flaw in the Pods WordPress plugin. It lets unauthenticated...
TL;DR CVE-2026-77647 is a CVSS 9.8 unauthenticated remote code execution flaw in the SPIP CMS. It affects...
Update: Microsoft updated its safety alert on August 21, 2026. Initially, the report marked the bug as...
TL;DR CISA added two TrueConf Server flaws to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-72529 and...
TL;DR CERT Polska reports active exploitation of a Zimbra unauthenticated remote code execution flaw, tracked as CVE-2026-73570....
TL;DR A GeoServer unauthenticated SQL injection flaw is under active attack. It lives in the jsonArrayContains filter...