SeverityCritical briefings
Only the stories rated critical: the flaws to patch first.
CISA Flags Active Exploitation of WSO2 and Adobe Commerce Critical Flaws
CISA has added critical WSO2 and Adobe Commerce vulnerabilities to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 27 to…
Attackers Weaponize Critical WordPress RCE Flaw Within Hours of Patch
CVE-2026-87902, a critical unauthenticated path traversal bug in WordPress core, is under active exploitation just hours after a fix landed in version…
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Remote Code Execution
F5 has fixed a critical zero-day in BIG-IP Access Policy Manager that attackers used to achieve unauthenticated RCE, prompting CISA to order…
CISA: Three Linux Kernel Flaws Under Active Attack, One Critical
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, including a 14-year-old race condition and a critical TLS flaw,…
Critical Pre-Auth RCE in Orkes Conductor Exploited in the Wild
Fortinet warns that a critical unauthenticated remote code execution flaw in the Orkes Conductor workflow platform is being actively exploited, putting unpatched…
Maximum-Severity Cisco ISE Auth Bypass Added to CISA’s Exploited Vulnerability List
A perfect 10.0 CVSS flaw in Cisco Identity Services Engine is being actively exploited in the wild, prompting CISA to order federal…
Cisco Patches Max-Severity ISE Zero-Day Under Active Exploitation
A CVSS 10.0 authentication bypass in Cisco Identity Services Engine and ISE-PIC is being actively exploited, letting unauthenticated attackers gain root-level access…
Check Point Patches Critical Root RCE Flaw in Management Servers
An unauthenticated attacker could exploit a buffer overflow in the login process of Check Point's Security Management and Log Servers to gain…
Attackers Exploit WooCommerce Plugin Flaw to Plant PHP Web Shells
A critical unauthenticated file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin is being actively exploited to drop PHP backdoors on WordPress…
CISA Confirms Active Exploitation of Max-Severity GitLab Flaw
Attackers are exploiting a critical unauthenticated path traversal bug in GitLab's repository commits API just days after a patch shipped, prompting CISA…
China-Linked Hackers Exploit Sogou Input Method Flaw to Drop GrayRabbit Backdoor
A one-click RCE bug in Tencent's Sogou Input Method for Windows let the UNC3569 threat group chain three flaws into full code…
BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days Across Espionage Groups
Proofpoint says a newly discovered exploit kit combining two Chrome V8 zero-days and a Windows ALPC privilege escalation flaw was rapidly adopted…