SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Cisco Warns of Actively Exploited ASA/FTD VPN Flaw Causing Device Crashes
A high-severity vulnerability in Cisco Secure Firewall ASA and FTD software is being exploited to remotely crash devices via crafted HTTP requests…
Microsoft Fixes 398 Flaws, Patches Actively Exploited Windows Kernel Driver Zero-Day
August's Patch Tuesday closes 398 vulnerabilities, including a zero-day in a core Windows networking driver that attackers are already using to gain…
Microsoft’s August Patch Tuesday Fixes Nearly 400 Flaws, One Under Active Attack
Microsoft's latest security update addresses 398 vulnerabilities, including an actively exploited Windows privilege escalation bug, as AI-assisted discovery continues to drive record…
Mozilla Rotates Firefox GPG Signing Key After Accidental GitHub Exposure
Mozilla revoked and replaced a GPG signing subkey used for Firefox and Thunderbird Linux artifacts after finding an unencrypted copy in a…
CISA Confirms Active Exploitation of Critical Kemp LoadMaster RCE Flaw
A command injection bug in Progress Kemp LoadMaster, tracked as CVE-2026-8037, is being actively exploited in the wild, prompting CISA to add…
Former Medusa Affiliate Deploys New StormEncryptor Ransomware
Microsoft says China-linked threat actor Storm-1175 has pivoted from Medusa to a new C++ ransomware strain, likely exploiting an authentication-bypass flaw in…
Critical Flaws in Belgian eID Software Exposed 2 Million Users to Identity Theft
A researcher at DEF CON detailed now-patched vulnerabilities in Connective's digital identity browser extension that let malicious websites steal eID PINs, forge…
CISA Orders Federal Patch on Actively Exploited LoadMaster Flaw
A critical unauthenticated command injection bug in Progress Kemp LoadMaster is being exploited in the wild after researchers published proof-of-concept code, prompting…
N-able Ships Second N-central Hotfix as Attackers Reach Managed Endpoints
N-able has issued a new hotfix for its N-central RMM platform after observing threat actors evolve their techniques and reach systems managed…
Metabase Zero-Day Under Active Exploitation Grants Unauthenticated Admin Access
Metabase has disclosed a maximum-severity, uncatalogued flaw in its BI platform that lets remote attackers inject SQL and seize control without credentials,…
New CSS Attacks Break Out of Email Boundaries to Steal Webmail Credentials
Researcher demonstrates how CSS embedded in email content can escape message boundaries across major webmail providers, enabling credential theft, token leaks, and…
Metabase SQL Injection Zero-Day Exploited to Steal Customer Data at Framework, Tally
An unauthenticated SQL injection flaw in Metabase, rated CVSS 10.0, was exploited as a zero-day to breach Metabase Cloud and self-hosted instances,…