Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.
Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.
Updated September 11, 2026 — all 201 published advisories are browsable here. The newest one is on the appliance that is supposed to be doing the protecting: a Cisco firewall management flaw under active attack and added to CISA's known-exploited list, on the console that controls the firewalls guarding the whole network (CVE-2026-20079). Behind it, a Chrome zero-day exploited in the wild, where simply visiting a booby-trapped site is enough to get code running on the machine (CVE-2026-87491), and a FreeIPA flaw that hands full administrator rights to anyone who connects without a password, on the directory server that decides who gets into everything else (CVE-2026-76578). The one readers keep coming back to is the Magento and Adobe Commerce zero-day being exploited against live online stores with no vendor patch available (StyleSmuggler). Every one of these sits on a device or service that faces the internet, so the clock starts the day the advisory drops — and a missed patch window is what turns a routine Tuesday into downtime, a breach-notification bill, and lost revenue. If you are not sure whether yours is patched, our 24/7 staffed security operations center handles the triage for you.
Broadcom patched a CVSS 9.8 directory traversal flaw in the vCenter Syslog server on July 29, and attackers were exploiting it five days later. Researchers have tracked 361 victim IPs across 47 countries, with the attack chain planting cron jobs that run reverse_ssh for persistent access that survives patching.
CISA, the FBI, and South Korea's National Police Agency issued joint advisory AA26-222A on the Gunra ransomware group, which is breaching networks through the Fortinet FortiOS and FortiProxy authentication bypass flaws CVE-2024-55591 and CVE-2025-24472. Gunra has claimed fifty-one victims across healthcare, finance, government, and manufacturing, and tampers with VDI authentication files to create a persistent MFA bypass before destroying backups and encrypting with ChaCha20.
Read moreTencent's Zhuque Lab disclosed SCTPhantom, an 18 year old use after free flaw in the Linux kernel SCTP code tracked as CVE-2026-64564. A local unprivileged user can escalate to root and, in the researchers' testing, escape containers to take over the host. Patched stable kernels shipped August 3, 2026.
Read moreWordPress 7.0.3 patches CVE-2026-64638, a pre-authentication cross-site scripting flaw on the login screen that researchers chained all the way to PHP code execution on the server. The CVSS 8.9 bug comes from a parser disagreement between strip_tags and KSES, affects every maintained version before 7.0.3, and was backported to the 4.7 branch. No confirmed exploitation in the wild yet, but the full technique is public.
Read moreMetabase disclosed a CVSS 10.0 unauthenticated SQL injection flaw that was already being exploited as a zero-day, handing attackers administrator access and every stored database credential. Framework, Tally, and LexisNexis have all been named. No CVE was assigned, so scanners will not flag it.
Read moreCisco shipped security hardening releases for Catalyst SD-WAN and IOS XE on August 5, 2026, fixing 12 flaws including three rated CVSS 9.9 and a 9.8 command injection. There are no workarounds and no configuration mitigations, only fixed images, and the low privileges required rating means any authenticated account on SD-WAN Manager is now a critical severity foothold.
Read moreVeeam patched four flaws in Service Provider Console, the multi-tenant console that MSPs and hosting providers use to manage customer backups. The most severe, CVE-2026-58073 at CVSS 9.5, lets an unauthenticated attacker impersonate a managed agent and steal that agent's credentials. Every version 9 build through 9.2.1.33875 is affected, and build 9.3.0.35057 is the fix.
Read moreIBM Langflow carries a CVSS 9.8 unauthenticated remote code execution flaw, CVE-2026-9198, that chains a token minting auto-login endpoint with a code validation endpoint running exec(). CISA added it to the Known Exploited Vulnerabilities catalog with an August 7 federal deadline, public exploit code is circulating, and roughly 7,000 instances are reachable online. Upgrade to 1.10.1 or later and rotate every secret the instance could read.
Read morecPanel and WHM patched CVE-2026-58048, a CVSS 9.4 critical flaw that lets any authenticated hosting customer with database access execute SQL in the database root context. Shared hosting servers carry the real exposure, since the only prerequisite is a paying account. Patched builds are out across every supported release tier.
Read moreN-able confirmed that attackers exploited an authentication bypass in N-central to take over administrator accounts on customer RMM servers, then found its original patch was incomplete. CVE-2026-18577 widens the affected range to every build before 2026.3.1.7, which shipped on August 2. Attackers pivoted from compromised consoles into managed endpoints and planted Cloudflare tunnels that survive both reboots and revoked console access.
Read moreA firmware integration error shipped in March 2021 routed Coldcard seed generation to a deterministic software PRNG instead of the STM32 hardware RNG, cutting effective entropy to as low as 40 bits. An attacker drained 1,196 Bitcoin addresses of 1,082.65 BTC worth roughly $70.2 million in 41 minutes on July 30, 2026, without ever touching a device. Coinkite shipped emergency firmware on July 31, but updating does not repair a seed that was already generated.
Read moreAdobe patched a maximum severity flaw in Campaign Classic that lets an unauthenticated attacker run arbitrary code with no user interaction. CVE-2026-48449 carries a CVSS score of 10.0 and affects on-premise builds up to 7.4.3 build 9397. The fix is build 9398 and Adobe rated the advisory Priority 1.
Read moreMicrosoft has disclosed CVE-2026-66803, a CVSS 10.0 improper access control flaw in Azure Cosmos DB that let researchers escape the Gremlin query sandbox and reach a platform wide signing key capable of retrieving the primary key for any Cosmos DB account on the service. Microsoft says no customer data was accessed and no customer action is required, but the finding is a hard lesson in cloud key hygiene and blast radius.
Read moreCisco Secure Firewall Management Center ships with static credentials for a low privilege account, and attackers exploited the flaw as a zero-day before any fix existed. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29, 2026. Hot fixes are available for every affected train and no workarounds exist.
Read moreOpenWrt disclosed CVE-2026-53921, a pair of stack buffer overflows in the odhcpd DHCPv6 daemon that let an unauthenticated attacker reach code execution as root on affected devices. It scores CVSS 9.8 and is fixed in OpenWrt 24.10.8 and 25.12.5. No exploitation has been reported yet, but public proof of concept code already exists.
Read moreArista has patched CVE-2026-16812, a CVSS 10.0 unauthenticated OS command injection flaw in on-premises VeloCloud Orchestrator that is already under active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog with a July 30, 2026 federal patching deadline, and compromise of the orchestrator can extend to the VeloCloud Edge devices it manages.
Read moreJetBrains patched CVE-2026-63077, a CVSS 9.8 unauthenticated remote code execution flaw in the TeamCity On-Premises agent polling protocol. Every on-premises version ever shipped is affected, the fixes are 2025.11.7 and 2026.1.3, and TeamCity has drawn nation-state and ransomware exploitation twice before.
Read moreFastjson 1.x has an actively exploited RCE with no patch available. CVE-2026-16723 (CVSS 9.0) works against default configs in Spring Boot apps. One JSON payload gives attackers code execution. Enable SafeMode or migrate to 2.x immediately.
Read moreCl0p affiliates are actively exploiting CVE-2026-12569, a CVSS 9.8 unauthenticated RCE in PTC Windchill PDMLink and FlexPLM, chaining it with a FlexPLM WSDL information disclosure to drop JSP web shells and steal engineering data. Exploited as a zero-day since early June 2026 and on the CISA KEV list since June 25. Patch via PTC CS473270 and hunt for compromise now.
Read moreRussian state-supported actor LAUNDRY BEAR (Void Blizzard) exploited a zero-click Zimbra Collaboration XSS flaw, CVE-2025-66376, as a zero-day for months, stealing 90 days of email, Global Address Lists, saved passwords, and 2FA recovery codes from NATO and Ukrainian targets before minting rogue application passwords for persistent MFA-bypassing access. Patched in November 2025 and now on the CISA KEV list.
Read moreOur CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.
Subscribe to our newsletter and get the latest security insights delivered to your inbox.
