SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Cisco FMC Hard-Coded Credential Bug Exploited in Zero-Day Attacks, Added to CISA KEV
A static low-privilege credential baked into Cisco Secure Firewall Management Center software is being actively exploited, prompting hot fixes, IOC guidance, and…
Arista Patches Max-Severity VeloCloud Orchestrator Flaw Under Active Attack
CVE-2026-16812, an unauthenticated command injection flaw scoring a perfect 10.0, is being exploited against on-premises VeloCloud Orchestrator deployments. CISA has added it…
OpenAI Models Exploited Artifactory Zero-Days to Break Out of Test Sandbox
JFrog has confirmed that OpenAI's models found and chained previously unknown Artifactory vulnerabilities to escape an isolated evaluation environment, setting up a…
Certighost PoC Exploit Lets Low-Privileged Users Hijack Windows Domains via AD CS
Researchers released a working exploit for CVE-2026-54121, an Active Directory Certificate Services flaw that lets an authenticated attacker impersonate a domain controller…
DentaQuest Breach Tied to ShinyHunters Exposes Data on Over 23 Million People
Dental and vision benefits administrator DentaQuest is notifying millions after attackers accessed sensitive health and identity data over a four-day window in…
GitHub and PyPI Roll Out Time-Delay Defenses Against Supply Chain Attacks
GitHub's Dependabot now enforces a default 72-hour cooldown before adopting new package versions, while PyPI blocks file additions to releases older than…
UK PM Burnham Keeps Cyber Minister in Place Despite Ministry Shakeup
New Prime Minister Andy Burnham reappointed Liz Lloyd to steer cyber policy even as he dismantled the department that housed it, preserving…
Rockwell Patches Four Code Execution Flaws in Arena Simulation Software
Rockwell Automation has fixed four high-severity memory corruption vulnerabilities in Arena Simulation that could let an attacker execute arbitrary code via a…
OnTrac Discloses Data Breach After Network Intrusion
The last-mile delivery firm says an attacker accessed files over a three-day span in March, and its response language hints at a…
NodeBB Patches Eight High-Severity Flaws Found by AI Pentest Agents
Aikido Security says its AI-driven code review uncovered eight high-severity vulnerabilities in the NodeBB forum platform in just six hours, exposing admin…
RefluXFS: Nine-Year-Old Linux Kernel Flaw Grants Root via XFS Race Condition
A race condition in the XFS filesystem's reflink copy-on-write path, present since kernel 4.11, lets unprivileged local users overwrite root-owned files and…
Russian APT ‘Laundry Bear’ Exploited Zimbra Zero-Day to Steal Email at Scale
A joint advisory from CISA, NSA, FBI and international partners details a Russian state-supported campaign that used a zero-click Zimbra Collaboration Suite…