SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Ernst & Young Discloses Breach Tied to Third-Party Support Ticket System
A compromised support platform used by EY's IT staff exposed client documents containing tax and financial information, with unauthorized access dating back…
HollowByte: 11-Byte Payload Can Bloat OpenSSL Server Memory to Exhaustion
An unauthenticated denial-of-service flaw dubbed HollowByte lets attackers exploit how OpenSSL handles TLS handshake length headers, forcing servers to allocate memory that…
CISA Adds Actively Exploited SharePoint RCE Flaw CVE-2026-58644 to KEV Catalog
A critical deserialization bug in on-premises SharePoint Server has joined at least three other actively exploited flaws under active attack, with CISA…
Ransomware Attack on Coca-Cola’s Fairlife Halts US Dairy Production
Coca-Cola disclosed in an SEC filing that a ransomware intrusion at its Fairlife dairy subsidiary forced a temporary suspension of US production,…
F5 Issues Emergency Patches for Critical NGINX Flaw, Seven Other Bugs
F5 has released an out-of-band update fixing eight vulnerabilities across NGINX and BIG-IP, including a critical, unauthenticated heap buffer overflow rated 9.2…
Old Microsoft-Signed UEFI Shims Let Attackers Bypass Secure Boot
ESET found 11 outdated, still-trusted Microsoft-signed shim bootloaders that could let attackers run untrusted code during boot and plant bootkits, prompting Microsoft…
Revoked UEFI Shim Bootloaders Left Secure Boot Wide Open for Years
Nearly a dozen vulnerable UEFI shim bootloaders remained trusted on systems long after being flagged and revoked, giving attackers a viable path…
Zoom Patches Critical Windows Flaw That Allows Unauthenticated Account Takeover
Zoom has disclosed a critical, internally discovered vulnerability in its Windows desktop client, VDI client, and Meeting SDK that could let an…
ICS Patch Tuesday: Siemens, Schneider, Rockwell Fix Critical Flaws in July 2026
Siemens leads July's ICS Patch Tuesday with a maximum-severity authentication bypass in Opencenter X, while Rockwell and Schneider Electric address critical and…
Progress Confirms Zero-Day Behind ShareFile Outage, Restores Access
Progress Software says a path traversal zero-day in ShareFile Storage Zones Controller prompted an emergency shutdown of customer servers, with patched access…
SAP Patches Critical CVSS 9.9 NetWeaver Flaw Among 16 July Fixes
SAP's July 2026 patch batch closes three critical vulnerabilities in NetWeaver, Approuter, and Commerce Cloud, headlined by a near-maximum-severity memory corruption bug…
SonicWall SMA1000 Zero-Days Under Active Attack, CISA Sets Federal Patch Deadline
SonicWall confirms two SMA1000 vulnerabilities, including a maximum-severity SSRF flaw, are being exploited in the wild. CISA has added both to its…