Do Son Microsoft's March 2026 Patch Tuesday addresses 93 vulnerabilities, including two public zero-days affecting SQL Server and .NET. Patch your systems now.
vulnerability management
OpenAI launches Codex Security, an advanced AI agent that uses reasoning to find and fix complex vulnerabilities without the noise of false positives.
Google releases an urgent security update for Chrome, patching 10 flaws including 3 critical memory corruption vulnerabilities. Update to version 145 now.
Google Threat Intelligence uncovers "Coruna", a repurposed iOS exploit kit now used by state-sponsored and financially motivated hackers to steal crypto.
Django releases security updates (6.0.3, 5.2.12, 4.2.29) to fix a Windows DoS flaw (CVE-2026-25673) and file permission risks. Upgrade your framework now.
CISA adds actively exploited Qualcomm (CVE-2026-21385) and VMware (CVE-2026-22719) flaws to its KEV catalog. See the impact and patch deadlines inside.
HPE warns of a critical CVSS 10.0 vulnerability (CVE-2026-23600) in AutoPass License Server. Remote attackers can bypass authentication. Patch to 9.19 now!
Google’s March 2026 Android update fixes 129 flaws, including CVE-2026-21385—a high-severity Qualcomm vulnerability currently being exploited in the wild.
Fortinet warns of critical SQL injection CVE-2026-21643 in FortiClient EMS 7.4.4. Unauthenticated attackers can execute code. Update to v7.4.5 now.
VulnCheck reveals CVE-2025-11953 (Metro4Shell) was exploited in the wild since Dec 2025. Attackers target Windows & Linux dev servers. Patch now.
Oracle patches CVE-2026-21962 (CVSS 10) in Fusion Middleware. This critical flaw allows unauthenticated server takeover. Update immediately.
Urgent: Uninstall the EOL Spring CLI VS Code extension now. CVE-2026-22718 (CVSS 6.6) allows command injection and will not be patched.
CISA warns: Active exploits target Gogs Git service via CVE-2025-8110 (CVSS 8.7). Attackers use symlink bypass for RCE. Patch by Feb 2, 2026.
Critical zlib flaw CVE-2026-22184 (CVSS 9.3) allows RCE via buffer overflow in the untgz utility. Update to version 1.3.1.2 immediately to secure systems.
CISA adds critical HPE OneView (CVE-2025-37164) and legacy PowerPoint (CVE-2009-0556) flaws to KEV. FCEB agencies must patch by Jan 28, 2026.
GitLab patches critical Stored XSS (CVE-2025-9222) and AI flaws in versions 18.7.1, 18.6.3, & 18.5.5. Update immediately to secure your pipelines.
Google's Chrome 143 update fixes high-severity flaw CVE-2026-0628. The "WebView" vulnerability allows policy bypass. Update your browser immediately.
CISA confirms stability of the CVE Program, dispelling funding concerns and reaffirming its commitment to cybersecurity and vulnerability management.
CISA extends funding for the CVE program, ensuring no disruption to global vulnerability tracking and cybersecurity infrastructure.
The CVE Foundation launches to ensure the future of the CVE Program after U.S. government funding ends for MITRE's operation.
MITRE warns the CVE program may halt after April 16 as U.S. funding expires, threatening global cybersecurity and vulnerability tracking.