Advertisement
CVE-2025-66376: ZCS Cross-Site Scripting Actively Exploited
CISA adds CVE-2025-66376, a Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting vulnerability, to its KEV Catalog due to active exploitation.
CVE-2026-20963: Microsoft SharePoint Deserialization Exploit — Patch Now
CISA adds CVE-2026-20963, a Microsoft SharePoint deserialization vulnerability, to its KEV catalog due to active exploitation.
ConnectWise ScreenConnect Flaw Allows Unauthorized Access
ConnectWise ScreenConnect users must patch a critical cryptographic signature verification flaw enabling unauthorized access and privilege escalation.
CVE-2024-4510: Zimbra Collaboration Suite XSS Exploitation Guide
CISA adds CVE-2024-4510 to the KEV catalog following active exploitation of a Zimbra Collaboration Suite XSS vulnerability. Patch ZCS version 9.0.0 today.
Ivanti vTM Authentication Bypass: CVE-2024-7593 Mitigation Guide
Ivanti patches a critical authentication bypass in Virtual Traffic Manager. Learn how CVE-2024-7593 allows unauthenticated administrative access.
WhatsApp View Once Bypass via Modified Clients - Meta Won't Patch
A new WhatsApp View Once bypass allows recipients to persist media via modified clients. Meta declines patching, citing client-side enforcement limits.
Advertisement
Ubuntu CVE-2026-3888: Privilege Escalation via systemd Timing Flaw
A high-severity flaw in Ubuntu 24.04+ allows local attackers to gain root access via a systemd cleanup timing exploit tracked as CVE-2026-3888.
CVE-2026-32746: GNU InetUtils Telnetd RCE Mitigation Guide
Unauthenticated root RCE discovered in GNU InetUtils telnetd (CVE-2026-32746). Learn how to detect CVE-2026-32746 exploit attempts and secure port 23.
CVE-2026-20643: Apple Patches WebKit Same-Origin Policy Bypass
Apple addresses CVE-2026-20643, a critical WebKit Navigation API flaw allowing Same-Origin Policy bypass on iOS and macOS. Deploy updates immediately.
Apple CVE-2026-20643: WebKit Flaw Fixed via Background Update
Apple deploys the first Background Security Improvements update to address a critical WebKit vulnerability (CVE-2026-20643) across iOS and macOS platforms.
CVE-2025-13957: Hard-coded Credentials in Schneider EcoStruxure DCE
Hard-coded credentials in Schneider Electric EcoStruxure Data Center Expert v9.0 and prior (CVE-2025-13957) allow information disclosure and RCE if SOCKS Proxy is…
Siemens SICAM SIAPP SDK RCE and DoS Vulnerabilities: Patch Guide
Siemens releases security updates for SICAM SIAPP SDK versions prior to 2.1.7 to address high-severity RCE, command injection, and buffer overflow flaws.
Windows 11 24H2 Samsung Galaxy Book C: Drive Access Fix
Microsoft releases technical guidance to resolve C: drive access denied errors and application failures on Samsung Galaxy Book devices running Windows 11.
CVE-2025-47813: CISA Warns of Wing FTP Server Path Leakage Exploitation
CISA adds CVE-2025-47813 to its KEV catalog, highlighting active exploitation of a Wing FTP Server information disclosure flaw that leaks internal server paths.
CVE-2025-47813: Wing FTP Server Information Disclosure Added to KEV
CISA adds CVE-2025-47813 to the Known Exploited Vulnerabilities catalog, signaling active exploitation of Wing FTP Server. Immediate patching is required.
CVE-2024-50498: Wing FTP Server Exploited in RCE Chains — Patch Now
CISA adds CVE-2024-50498 to its KEV catalog after reports of active exploitation. Learn how to secure Wing FTP Server versions prior to 7.5.0 from RCE chains.
Windows 11 24H2 RRAS RCE: Microsoft Issues OOB Hotpatch Fix
Microsoft releases an out-of-band hotpatch for Windows 11 24H2 to address critical RRAS remote code execution vulnerabilities CVE-2024-43513 and CVE-2024-49053.
OpenClaw AI Agent Flaws: Prompt Injection and Data Exfiltration Risk
CNCERT warns of critical security flaws in OpenClaw AI agents, enabling prompt injection and data exfiltration due to weak default configurations.
CVE-2024-47460: Critical HPE AOS-CX Password Reset Bypass - Patch Now
HPE Aruba Networking fixes a critical vulnerability (CVE-2024-47460) in AOS-CX switches allowing unauthenticated remote attackers to reset admin passwords.
Windows 11 C: Drive Access Failure on Samsung PCs - Mitigation Guide
Microsoft investigates an issue where February 2026 Windows 11 security updates prevent C: drive access on Samsung laptops, blocking all applications.
CVE-2026-3909 & CVE-2026-3910: Actively Exploited Google Vulnerabilities
CISA added two Google vulnerabilities (Skia Out-of-Bounds Write, Chromium V8 unspecified) to its KEV Catalog due to active exploitation. Patch now.
Cisco SD-WAN vManage RCE: Fake PoCs & CVE-2023-20252 Exploitation
Threat intelligence reveals fake PoCs for Cisco SD-WAN vManage CVE-2023-20252. Understand actual RCE risks and critical patching for affected systems.
Google's $17M Bug Bounty: Insights on Chrome & Cloud Security
Google paid out $17 million in bug bounties in 2025, with major rewards for Chrome and cloud security flaws. Understand the implications for enterprise defense.
CrackArmor: Nine Linux AppArmor Flaws Enable Root Escalation
Qualys researchers reveal nine CrackArmor vulnerabilities in the Linux AppArmor module, allowing unprivileged users to bypass container isolation and gain root.