SeverityCritical briefings
Only the stories rated critical: the flaws to patch first.
Dutch NCSC Warns of Imminent Attacks on Critical Check Point VPN Flaws
Two unauthenticated remote code execution bugs in Check Point's VPN stack have patches available, and the Netherlands' national cyber agency says exploitation…
Cisco FMC Bugs Exploited by Qilin Ransomware and Sandworm-Linked Hackers
Cisco Talos says three separate threat clusters, including ransomware affiliates and a group overlapping with the Russian Sandworm APT, exploited two Secure…
CISA Flags Active Exploits in JFrog and ConnectWise as GitLab Rushes Critical Patch
CISA added three actively exploited flaws in JFrog Artifactory and ConnectWise ScreenConnect to its KEV catalog, while GitLab pushed emergency fixes for…
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Researchers at Wordfence and Patchstack have disclosed five critical vulnerabilities across popular WordPress plugins and themes, including one authentication bypass flaw scoring…
Critical GiveWP Flaw Lets Unauthenticated Attackers Run Server Commands
A maximum-severity vulnerability in the popular GiveWP WordPress donation plugin lets attackers register accounts even when signups are disabled, then chain that…
Cosmos EVM Balance Flaw Exploited Across Six Chains After Cosmos Labs Knew Risk Existed
A critical balance-handling bug in the shared Cosmos EVM module was used to drain funds from six blockchains over five days in…
PaperCut Zero-Day Under Active Exploitation, Hits All NG and MF Versions
PaperCut has confirmed active zero-day attacks against all versions of its NG and MF print management software, releasing emergency patches while urging…
Critical Avada WordPress Theme Flaw Chains Six Bugs Into Zero-Click RCE
A critical vulnerability chain in the Avada theme and Fusion Builder plugin lets unauthenticated attackers achieve full server compromise, though exploitation requires…
Chrome 152 Fixes Over 300 Bugs, Most Found by Google’s AI Tools
Google's latest Chrome release patches 327 vulnerabilities, including 10 critical use-after-free flaws, with the vast majority uncovered internally through AI-assisted vulnerability research.
Attackers Chain miniOrange SAML Bugs for WordPress Admin Takeover
Two unauthenticated auth bypass flaws in the Xecurify miniOrange SAML SSO plugin are being actively exploited to forge signatures and hijack WordPress…
Microsoft Warns of Max-Severity Entra ID RCE Flaw Exploited in the Wild
Microsoft disclosed a CVSS 10.0 remote code execution vulnerability in Entra ID that has already been exploited, though it says customers do…
Critical Elementor Pro Flaw Lets Attackers Upload PHP and Execute Code
A CVSS 9.0 vulnerability in Elementor Pro's File Upload module lets attackers smuggle malicious PHP past validation and execute it on WordPress…