Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.
Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.
Updated September 11, 2026 — all 201 published advisories are browsable here. The newest one is on the appliance that is supposed to be doing the protecting: a Cisco firewall management flaw under active attack and added to CISA's known-exploited list, on the console that controls the firewalls guarding the whole network (CVE-2026-20079). Behind it, a Chrome zero-day exploited in the wild, where simply visiting a booby-trapped site is enough to get code running on the machine (CVE-2026-87491), and a FreeIPA flaw that hands full administrator rights to anyone who connects without a password, on the directory server that decides who gets into everything else (CVE-2026-76578). The one readers keep coming back to is the Magento and Adobe Commerce zero-day being exploited against live online stores with no vendor patch available (StyleSmuggler). Every one of these sits on a device or service that faces the internet, so the clock starts the day the advisory drops — and a missed patch window is what turns a routine Tuesday into downtime, a breach-notification bill, and lost revenue. If you are not sure whether yours is patched, our 24/7 staffed security operations center handles the triage for you.
Broadcom patched a CVSS 9.8 directory traversal flaw in the vCenter Syslog server on July 29, and attackers were exploiting it five days later. Researchers have tracked 361 victim IPs across 47 countries, with the attack chain planting cron jobs that run reverse_ssh for persistent access that survives patching.
Tencent's Zhuque Lab disclosed SCTPhantom, an 18 year old use after free flaw in the Linux kernel SCTP code tracked as CVE-2026-64564. A local unprivileged user can escalate to root and, in the researchers' testing, escape containers to take over the host. Patched stable kernels shipped August 3, 2026.
Read moreWordPress 7.0.3 patches CVE-2026-64638, a pre-authentication cross-site scripting flaw on the login screen that researchers chained all the way to PHP code execution on the server. The CVSS 8.9 bug comes from a parser disagreement between strip_tags and KSES, affects every maintained version before 7.0.3, and was backported to the 4.7 branch. No confirmed exploitation in the wild yet, but the full technique is public.
Read moreMetabase disclosed a CVSS 10.0 unauthenticated SQL injection flaw that was already being exploited as a zero-day, handing attackers administrator access and every stored database credential. Framework, Tally, and LexisNexis have all been named. No CVE was assigned, so scanners will not flag it.
Read moreCisco shipped security hardening releases for Catalyst SD-WAN and IOS XE on August 5, 2026, fixing 12 flaws including three rated CVSS 9.9 and a 9.8 command injection. There are no workarounds and no configuration mitigations, only fixed images, and the low privileges required rating means any authenticated account on SD-WAN Manager is now a critical severity foothold.
Read moreVeeam patched four flaws in Service Provider Console, the multi-tenant console that MSPs and hosting providers use to manage customer backups. The most severe, CVE-2026-58073 at CVSS 9.5, lets an unauthenticated attacker impersonate a managed agent and steal that agent's credentials. Every version 9 build through 9.2.1.33875 is affected, and build 9.3.0.35057 is the fix.
Read moreIBM Langflow carries a CVSS 9.8 unauthenticated remote code execution flaw, CVE-2026-9198, that chains a token minting auto-login endpoint with a code validation endpoint running exec(). CISA added it to the Known Exploited Vulnerabilities catalog with an August 7 federal deadline, public exploit code is circulating, and roughly 7,000 instances are reachable online. Upgrade to 1.10.1 or later and rotate every secret the instance could read.
Read morecPanel and WHM patched CVE-2026-58048, a CVSS 9.4 critical flaw that lets any authenticated hosting customer with database access execute SQL in the database root context. Shared hosting servers carry the real exposure, since the only prerequisite is a paying account. Patched builds are out across every supported release tier.
Read moreN-able confirmed that attackers exploited an authentication bypass in N-central to take over administrator accounts on customer RMM servers, then found its original patch was incomplete. CVE-2026-18577 widens the affected range to every build before 2026.3.1.7, which shipped on August 2. Attackers pivoted from compromised consoles into managed endpoints and planted Cloudflare tunnels that survive both reboots and revoked console access.
Read moreAdobe patched a maximum severity flaw in Campaign Classic that lets an unauthenticated attacker run arbitrary code with no user interaction. CVE-2026-48449 carries a CVSS score of 10.0 and affects on-premise builds up to 7.4.3 build 9397. The fix is build 9398 and Adobe rated the advisory Priority 1.
Read moreMicrosoft has disclosed CVE-2026-66803, a CVSS 10.0 improper access control flaw in Azure Cosmos DB that let researchers escape the Gremlin query sandbox and reach a platform wide signing key capable of retrieving the primary key for any Cosmos DB account on the service. Microsoft says no customer data was accessed and no customer action is required, but the finding is a hard lesson in cloud key hygiene and blast radius.
Read moreCisco Secure Firewall Management Center ships with static credentials for a low privilege account, and attackers exploited the flaw as a zero-day before any fix existed. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29, 2026. Hot fixes are available for every affected train and no workarounds exist.
Read moreOpenWrt disclosed CVE-2026-53921, a pair of stack buffer overflows in the odhcpd DHCPv6 daemon that let an unauthenticated attacker reach code execution as root on affected devices. It scores CVSS 9.8 and is fixed in OpenWrt 24.10.8 and 25.12.5. No exploitation has been reported yet, but public proof of concept code already exists.
Read moreArista has patched CVE-2026-16812, a CVSS 10.0 unauthenticated OS command injection flaw in on-premises VeloCloud Orchestrator that is already under active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog with a July 30, 2026 federal patching deadline, and compromise of the orchestrator can extend to the VeloCloud Edge devices it manages.
Read moreJetBrains patched CVE-2026-63077, a CVSS 9.8 unauthenticated remote code execution flaw in the TeamCity On-Premises agent polling protocol. Every on-premises version ever shipped is affected, the fixes are 2025.11.7 and 2026.1.3, and TeamCity has drawn nation-state and ransomware exploitation twice before.
Read moreFastjson 1.x has an actively exploited RCE with no patch available. CVE-2026-16723 (CVSS 9.0) works against default configs in Spring Boot apps. One JSON payload gives attackers code execution. Enable SafeMode or migrate to 2.x immediately.
Read moreCl0p affiliates are actively exploiting CVE-2026-12569, a CVSS 9.8 unauthenticated RCE in PTC Windchill PDMLink and FlexPLM, chaining it with a FlexPLM WSDL information disclosure to drop JSP web shells and steal engineering data. Exploited as a zero-day since early June 2026 and on the CISA KEV list since June 25. Patch via PTC CS473270 and hunt for compromise now.
Read moreCheck Point SmartConsole CVE-2026-16232 (CVSS 9.3) is under active exploitation. Unauthenticated attackers grab a login token and take full admin control of your firewall. Patch now or restrict SmartConsole to trusted networks only.
Read moreA critical CVSS 9.8 deserialization flaw in on-premises Microsoft SharePoint Server, CVE-2026-50522, is under active exploitation after a public proof-of-concept. Attackers are executing remote code and stealing SharePoint machine keys for persistence that survives patching. Patch immediately and rotate machine keys.
Read moreA critical unauthenticated remote code execution flaw in the ServiceNow AI Platform, CVE-2026-6875, is under active attack after threat actors weaponized a sandbox escape against the /assessment_thanks.do endpoint. Scored 9.5 on CVSS 4.0, it lets attackers run code with no credentials. Patches reached hosted instances in April and self hosted customers in June, and every unpatched instance is now a live target.
Read moreOur CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.
Subscribe to our newsletter and get the latest security insights delivered to your inbox.
