SectionVulnerabilities
Patches, advisories and the CVEs behind them.
GitLab Fixes Critical 9.9 Flaw in Self-Hosted AI Gateway
A critical vulnerability in GitLab's self-hosted AI Gateway could let an authenticated user with Duo Agent Platform access execute commands on the…
Cisco Patches Actively Exploited SD-WAN Manager Auth Bypass, Added to CISA KEV
A critical zero-day in Cisco Catalyst SD-WAN Manager lets unauthenticated attackers hijack the API with admin privileges, and Cisco says it is…
Apple Zero-Day CVE-2026-86950 Actively Exploited, Added to CISA’s KEV Catalog
Apple has confirmed a zero-day out-of-bounds write flaw is being weaponized in targeted attacks, prompting CISA to add the vulnerability to its…
Unsloth Studio Bug Let Malicious AI Models Run Code During Inspection
A now-patched flaw in Unsloth Studio allowed a booby-trapped AI model to execute arbitrary Python simply by being loaded for review, exploiting…
Kiteworks Patches Critical Flaw, Lifts Precautionary Shutdown Advisory
Kiteworks brought hosted customer systems back online after patching a critical vulnerability in a niche feature and finding no evidence of compromise…
Cloudflare Patches Cross-Tenant Data Leak Bug in Containers Service
A flaw in Cloudflare's shared storage pool let Workers Paid customers recover residual data, including credentials and databases, left behind by other…
Microsoft Pauses KB5002907 After Update Deactivates Perpetual Office Installs
An optional Microsoft 365 update meant to refresh out-of-date installations instead deactivated, and in some cases completely removed, perpetual Office 2016 and…
Two Unpatched Citrix NetScaler Zero-Days Under Active RCE Exploitation
Security firm watchTowr says attackers are actively exploiting two unpatched remote code execution flaws in Citrix NetScaler ADC and Gateway appliances, with…
ShinyHunters Breached Clop’s Own Leak Site via Unpatched Grav CMS Flaw
An unauthenticated path traversal bug in Grav CMS 1.7 let ShinyHunters deface and steal data from Clop's Tor leak site, prompting Clop…
CISA Confirms Active Exploitation of SharePoint and MikroTik RouterOS Flaws
A critical SharePoint code injection bug and a MikroTik RouterOS vulnerability have both been added to CISA's Known Exploited Vulnerabilities catalog after…
CISA Flags Active Exploitation of WSO2 and Adobe Commerce Critical Flaws
CISA has added critical WSO2 and Adobe Commerce vulnerabilities to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 27 to…
Attackers Weaponize Critical WordPress RCE Flaw Within Hours of Patch
CVE-2026-87902, a critical unauthenticated path traversal bug in WordPress core, is under active exploitation just hours after a fix landed in version…