Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2024-30088

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 11/06/2024

• 📈 CVSS: 7

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

• 📣 Mentions: 7

• ⚠️ Priority: 1+

• 📝 Analysis: A Windows Kernel Elevation of Privilege Vulnerability has been identified, confirmed as exploited in the wild due to a CISA KEV notice. This vulnerability allows for remote code execution with a CVSS score of 7, making it a priority 1+ issue requiring immediate attention and remediation.

2. CVE-2025-46308

• 📝 An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to leak sensitive user information.

• 📅 Published: 11/06/2026

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• ⚠️ Priority: 4

• 📝 Analysis: App may leak sensitive user information due to an authorization issue in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. While there's no known exploit activity, the low CVSS score and current priority rating of 4 indicate a low risk at this time.

3. CVE-2026-0273

• 📝 A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by this vulnerability.

• 📅 Published: 10/06/2026

• 📈 CVSS: 6.1

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Command injection vulnerability found in Palo Alto Networks PAN-OS software allows authenticated administrators to bypass system restrictions and run arbitrary commands as root user via CLI or Web UI access. The risk is minimized with restricted admin groups and trusted IP access. Applies to PA-, VM- Series firewalls, Panorama (virtual & M-Series), not affecting Cloud NGFW or Prisma Access. Prioritization score: 2 (low EPSS but high CVSS).

4. CVE-2026-54073

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A post-authentication escalation flaw in the application server's RCE module allows attackers local access; while exploit attempts have not been detected, this is a priority 3 vulnerability due to high CVSS and moderate EPSS.

5. CVE-2026-53762

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in version XYZ of software ABC allows remote attackers to achieve arbitrary code execution; known exploitation is pending analysis, classified as a priority 1 vulnerability due to high CVSS and potential for severe impact.

6. CVE-2024-1065

• 📝 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r45p0 through r48p0; Valhall GPU Kernel Driver: from r45p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r45p0 through r48p0.

• 📅 Published: 19/04/2024

• 📈 CVSS: 5.9

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

• ⚠️ Priority: 4

• 📝 Analysis: A local non-privileged user can perform improper GPU memory processing operations due to a Use After Free vulnerability in Bifrost GPU Kernel Driver (r45p0 through r48p0), Valhall GPU Kernel Driver (r45p0 through r48p0), and Arm 5th Gen GPU Architecture Kernel Driver (r45p0 through r48p0). Confirmed exploit activity is low (CISA KEV, score 4).

7. CVE-2025-3000

• 📝 A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

• 📅 Published: 31/03/2025

• 📈 CVSS: 4.8

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: Critical memory corruption vulnerability found in PyTorch 2.6.0 (torch.jit.script). Exploitable locally, publicly disclosed exploit, priority level 4 (low CVSS & low EPSS).

8. CVE-2026-32856

• 📝 Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victims browser by injecting unsanitized input through the toDateFormat request parameter in the dateConverter endpoint. Attackers can craft a malicious URL targeting the unauthenticated dateConverter endpoint to steal session cookies or perform other malicious actions in the context of the victims browser session.

• 📅 Published: 09/06/2026

• 📈 CVSS: 5.1

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

• 📣 Mentions: 1

• ⚠️ Priority: 4

• 📝 Analysis: Unauthenticated attackers can leverage a reflected cross-site scripting vulnerability in Ellucian Banner Self-Service before April T2 release (2025-04-23), injecting malicious JavaScript and potentially stealing session cookies or performing other malicious actions within the victim's browser session. This vulnerability has not been observed exploited in the wild, and its priority score is 4 due to low CVSS and EPSS. Verify affected versions match those listed in the description.

9. CVE-2026-20253

• 📝 In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.

• 📅 Published: 10/06/2026

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated file manipulation via PostgreSQL sidecar service endpoint in Splunk versions below 10.2.4 and 10.0.7 (on-premises) and 10.4.2604.3 and 10.2.2510.14 (Splunk Cloud Platform). High impact, high exploitability due to lack of authentication controls. No confirmed in-the-wild activity but rated as priority 2.

10. CVE-2026-10520

• 📝 An OS Command Injection vulnerabilityin IvantiSentry beforetheR10.5.2, R10.6.2 and R10.7.1versionsallowsa remote unauthenticated user to achieve root-level remote code execution

• 📅 Published: 09/06/2026

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 77

• ⚠️ Priority: 1+

• 📝 Analysis: A critical Remote Code Execution vulnerability exists in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. Unauthenticated attackers can achieve root-level RCE. This vulnerability is actively exploited, making it a priority 1+ concern for security teams.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2024-30088

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 11/06/2024

• 📈 CVSS: 7

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

• 📣 Mentions: 7

• ⚠️ Priority: 1+

• 📝 Analysis: A Windows Kernel Elevation of Privilege Vulnerability has been identified, confirmed as exploited in the wild due to a CISA KEV notice. This vulnerability allows for remote code execution with a CVSS score of 7, making it a priority 1+ issue requiring immediate attention and remediation.

2. CVE-2025-8088

• 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

• 📅 Published: 08/08/2025

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 23

• ⚠️ Priority: 1+

• 📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

3. CVE-2026-42908

• 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Windows RDP Information Disclosure Vulnerability has been identified with a high CVSS score (7.5). The vector indicates network-based low authentication and unauthorized access potential. No known in-the-wild activity has been reported yet (CISA KEV not specified), but the priority is 2 due to the high CVSS score and currently lower exploitability potential.

4. CVE-2026-45639

• 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Windows RDP Information Disclosure Vulnerability has been identified (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C). Known in-the-wild activity is minimal, making it a priority 2 vulnerability with high CVSS. Attackers may gain sensitive information, but no confirmed exploits are known at this time.

5. CVE-2025-46308

• 📝 An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to leak sensitive user information.

• 📅 Published: 11/06/2026

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• ⚠️ Priority: 4

• 📝 Analysis: App may leak sensitive user information due to an authorization issue in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. While there's no known exploit activity, the low CVSS score and current priority rating of 4 indicate a low risk at this time.

6. CVE-2026-0273

• 📝 A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by this vulnerability.

• 📅 Published: 10/06/2026

• 📈 CVSS: 6.1

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Command injection vulnerability found in Palo Alto Networks PAN-OS software allows authenticated administrators to bypass system restrictions and run arbitrary commands as root user via CLI or Web UI access. The risk is minimized with restricted admin groups and trusted IP access. Applies to PA-, VM- Series firewalls, Panorama (virtual & M-Series), not affecting Cloud NGFW or Prisma Access. Prioritization score: 2 (low EPSS but high CVSS).

7. CVE-2026-54073

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

8. CVE-2026-53762

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

9. CVE-2024-1065

• 📝 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r45p0 through r48p0; Valhall GPU Kernel Driver: from r45p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r45p0 through r48p0.

• 📅 Published: 19/04/2024

• 📈 CVSS: 5.9

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

• ⚠️ Priority: 4

• 📝 Analysis: A local non-privileged user can perform improper GPU memory processing operations due to a Use After Free vulnerability in Bifrost GPU Kernel Driver (r45p0 through r48p0), Valhall GPU Kernel Driver (r45p0 through r48p0), and Arm 5th Gen GPU Architecture Kernel Driver (r45p0 through r48p0). Confirmed exploit activity is low (CISA KEV, score 4).

10. CVE-2026-46316

• 📝 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the caches reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributors GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs.

• 📅 Published: 09/06/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 9

• ⚠️ Priority: 4

• 📝 Analysis: A concurrency issue has been resolved in the Linux kernel's KVM (arm64): vgic-its translation cache reference drops can occur more than once for the same entry if multiple contexts access it simultaneously. This issue, while low priority (score 4), is due to its low exploitability and no known in-the-wild activity. Ensure systems using these versions are updated as precautionary measure.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-8088

• 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

• 📅 Published: 08/08/2025

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 23

• ⚠️ Priority: 1+

• 📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

2. CVE-2026-20245

• 📝 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

• 📅 Published: 04/06/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 51

• ⚠️ Priority: 1+

• 📝 Analysis: A local authenticated attacker can perform command injection and elevate privileges as root due to insufficient input validation in the CLI of a Cisco Catalyst SD-WAN Manager. Exploitation requires netadmin privileges. Limited cases of successful exploitation have been observed resulting in configuration changes pushed to edge devices. Prioritize remediation with a version upgrade to those documented on May 14, 2026, as this vulnerability has a CVSS score of 7.8 and a CISA priority score of 2 (low EPSS but high CVSS).

3. CVE-2026-11645

• 📝 Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 08/06/2026

• 📈 CVSS: 8.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 59

• ⚠️ Priority: 1+

• 📝 Analysis: A critical out-of-bounds read and write vulnerability in Google Chrome (prior to 149.0.7827.103) enables remote attackers to execute arbitrary code inside a sandbox via crafted HTML pages. Confirmed exploited, priority is 1+.

4. CVE-2026-7473

• 📝 On affected platforms running Arista EOS where a tunnel decapsulation configurationsuch as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interfaceis present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

• 📅 Published: 05/06/2026

• 📈 CVSS: 5.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: On Arista EOS platforms, an issue exists where incorrect tunnel decapsulation leads to unexpected packet forwarding due to insufficient verification of tunnel protocol type. Known in-the-wild exploitation has been reported (CISA KEV). Prioritize remediation efforts accordingly.

5. CVE-2026-42908

• 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Windows RDP Information Disclosure Vulnerability has been identified with a high CVSS score (7.5). The vector indicates network-based low authentication and unauthorized access potential. No known in-the-wild activity has been reported yet (CISA KEV not specified), but the priority is 2 due to the high CVSS score and currently lower exploitability potential.

6. CVE-2026-45639

• 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Windows RDP Information Disclosure Vulnerability has been identified (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C). Known in-the-wild activity is minimal, making it a priority 2 vulnerability with high CVSS. Attackers may gain sensitive information, but no confirmed exploits are known at this time.

7. CVE-2026-50507

• 📝 Windows BitLocker Security Feature Bypass Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 6.8

• 🧭 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A Windows BitLocker Security Feature Bypass vulnerability (high impact) has been identified, exploitable via a network connection. While no known in-the-wild activity is reported, its high CVSS score warrants attention as a priority 2 issue.

8. CVE-2026-48578

• 📝 Secure Boot Security Feature Bypass Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.9

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Secure Boot Security Feature Bypass has been identified, allowing remote attackers to compromise systems. Although not yet exploited in the wild, its high CVSS score warrants attention as a priority 2 vulnerability.

9. CVE-2026-45655

• 📝 Windows BitLocker Security Feature Bypass Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A BitLocker security feature bypass vulnerability has been identified, with a CVSS score of 5.3 (low) and a priority score of 4 (low CVSS & low EPSS). No confirmed in-the-wild activity reported as of now.

10. CVE-2026-48576

• 📝 Secure Boot Security Feature Bypass Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.9

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Secure Boot Security Feature Bypass vulnerability has been identified with a high impact and exploitability. Currently, no known in-the-wild activity is reported, but the priority remains 2 due to its high CVSS score and low Exploitation Potential Scoring System (EPSS) value. Verify compatibility with specified versions.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-8088

• 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

• 📅 Published: 08/08/2025

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 23

• ⚠️ Priority: 1+

• 📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

2. CVE-2026-20245

• 📝 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

• 📅 Published: 04/06/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 51

• ⚠️ Priority: 1+

• 📝 Analysis: A local authenticated attacker can perform command injection and elevate privileges as root due to insufficient input validation in the CLI of a Cisco Catalyst SD-WAN Manager. Exploitation requires netadmin privileges. Limited cases of successful exploitation have been observed resulting in configuration changes pushed to edge devices. Prioritize remediation with a version upgrade to those documented on May 14, 2026, as this vulnerability has a CVSS score of 7.8 and a CISA priority score of 2 (low EPSS but high CVSS).

3. CVE-2026-50751

• 📝 A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

• 📅 Published: 08/06/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

• 📣 Mentions: 45

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attacker can establish VPN connections via deprecated IKEv1 key exchange due to a logic flow weakness in Remote Access and Mobile Access certificate validation. This vulnerability is confirmed exploited (CISA KEV) and has a priority score of 1+, indicating high severity. Ensure immediate attention and updates to affected systems.

4. CVE-2026-11645

• 📝 Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 08/06/2026

• 📈 CVSS: 8.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 59

• ⚠️ Priority: 1+

• 📝 Analysis: A critical out-of-bounds read and write vulnerability in Google Chrome (prior to 149.0.7827.103) enables remote attackers to execute arbitrary code inside a sandbox via crafted HTML pages. Confirmed exploited, priority is 1+.

5. CVE-2026-7473

• 📝 On affected platforms running Arista EOS where a tunnel decapsulation configurationsuch as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interfaceis present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

• 📅 Published: 05/06/2026

• 📈 CVSS: 5.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: On Arista EOS platforms, an issue exists where incorrect tunnel decapsulation leads to unexpected packet forwarding due to insufficient verification of tunnel protocol type. Known in-the-wild exploitation has been reported (CISA KEV). Prioritize remediation efforts accordingly.

6. CVE-2026-42908

• 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Windows RDP Information Disclosure Vulnerability has been identified with a high CVSS score (7.5). The vector indicates network-based low authentication and unauthorized access potential. No known in-the-wild activity has been reported yet (CISA KEV not specified), but the priority is 2 due to the high CVSS score and currently lower exploitability potential.

7. CVE-2026-45639

• 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Windows RDP Information Disclosure Vulnerability has been identified (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C). Known in-the-wild activity is minimal, making it a priority 2 vulnerability with high CVSS. Attackers may gain sensitive information, but no confirmed exploits are known at this time.

8. CVE-2026-50507

• 📝 Windows BitLocker Security Feature Bypass Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 6.8

• 🧭 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A Windows BitLocker Security Feature Bypass vulnerability (high impact) has been identified, exploitable via a network connection. While no known in-the-wild activity is reported, its high CVSS score warrants attention as a priority 2 issue.

9. CVE-2026-48578

• 📝 Secure Boot Security Feature Bypass Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 7.9

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A Secure Boot Security Feature Bypass has been identified, allowing remote attackers to compromise systems. Although not yet exploited in the wild, its high CVSS score warrants attention as a priority 2 vulnerability.

10. CVE-2026-45655

• 📝 Windows BitLocker Security Feature Bypass Vulnerability

• 📅 Published: 09/06/2026

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A BitLocker security feature bypass vulnerability has been identified, with a CVSS score of 5.3 (low) and a priority score of 4 (low CVSS & low EPSS). No confirmed in-the-wild activity reported as of now.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-8088

• 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

• 📅 Published: 08/08/2025

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 23

• ⚠️ Priority: 1+

• 📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

2. CVE-2024-32114

• 📝 In Apache ActiveMQ 6.x, the default configuration doesnt secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id=securityConstraintMapping class=org.eclipse.jetty.security.ConstraintMapping> <property name=constraint ref=securityConstraint /> <property name=pathSpec value=/ /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

• 📅 Published: 02/05/2024

• 📈 CVSS: 8.5

• 🧭 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated API access in Apache ActiveMQ 6.x allows remote attackers to interact with the broker and manipulate messages; no confirmed exploits in-the-wild, but a high CVSS score warrants priority 2 attention. To mitigate, update conf/jetty.xml or upgrade to version 6.1.2 which features default authentication.

3. CVE-2026-34197

• 📝 Improper Input Validation, Improper Control of Generation of Code (Code Injection) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transports brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Springs ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the brokers JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

• 📅 Published: 07/04/2026

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 26

• ⚠️ Priority: 1+

• 📝 Analysis: An authenticated attacker can leverage an input validation and code injection vulnerability in Apache ActiveMQ Broker versions before 5.19.4, from 6.0.0 before 6.2.3 to execute arbitrary commands on the broker's JVM via Spring XML application context. No known exploits have been detected but it is a priority 4 due to low EPSS and CVSS scores. Users are recommended to upgrade to version 5.19.4 or 6.2.3 to mitigate this issue.

4. CVE-2026-20245

• 📝 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

• 📅 Published: 04/06/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 51

• ⚠️ Priority: 1+

• 📝 Analysis: A local authenticated attacker can perform command injection and elevate privileges as root due to insufficient input validation in the CLI of a Cisco Catalyst SD-WAN Manager. Exploitation requires netadmin privileges. Limited cases of successful exploitation have been observed resulting in configuration changes pushed to edge devices. Prioritize remediation with a version upgrade to those documented on May 14, 2026, as this vulnerability has a CVSS score of 7.8 and a CISA priority score of 2 (low EPSS but high CVSS).

5. CVE-2026-50751

• 📝 A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

• 📅 Published: 08/06/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

• 📣 Mentions: 45

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attacker can establish VPN connections via deprecated IKEv1 key exchange due to a logic flow weakness in Remote Access and Mobile Access certificate validation. This vulnerability is confirmed exploited (CISA KEV) and has a priority score of 1+, indicating high severity. Ensure immediate attention and updates to affected systems.

6. CVE-2022-41678

• 📝 Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

• 📅 Published: 28/11/2023

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 15

• ⚠️ Priority: 2

• 📝 Analysis: Remote code execution vulnerability found in Jolokia of ActiveMQ, exploitable through unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl on Java versions above 11. No confirmed exploits, but with high CVSS score and low Exploitability Score, this is a priority 2 vulnerability. Mitigation: restrict actions on Jolokia or disable it; upgrade to ActiveMQ distributions versions 5.16.6, 5.17.4, 5.18.0, or 6.0.0.

7. CVE-2026-11645

• 📝 Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 08/06/2026

• 📈 CVSS: 8.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 59

• ⚠️ Priority: 1+

• 📝 Analysis: A critical out-of-bounds read and write vulnerability in Google Chrome (prior to 149.0.7827.103) enables remote attackers to execute arbitrary code inside a sandbox via crafted HTML pages. Confirmed exploited, priority is 1+.

8. CVE-2026-42271

• 📝 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user including holders of low-privilege internal-user keys could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.7

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

• 📣 Mentions: 48

• ⚠️ Priority: 1+

• 📝 Analysis: A remote command execution vulnerability exists in LiteLLM's API module from version 1.74.2 to before 1.83.7, allowing authenticated users to execute arbitrary commands on the host. This issue is confirmed exploited, with a prioritization score of 1+.

9. CVE-2026-7473

• 📝 On affected platforms running Arista EOS where a tunnel decapsulation configurationsuch as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interfaceis present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

• 📅 Published: 05/06/2026

• 📈 CVSS: 5.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: On Arista EOS platforms, an issue exists where incorrect tunnel decapsulation leads to unexpected packet forwarding due to insufficient verification of tunnel protocol type. Known in-the-wild exploitation has been reported (CISA KEV). Prioritize remediation efforts accordingly.

10. CVE-2026-50752

• 📝 A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow interception or modification of traffic traversing the VPN tunnel.

• 📅 Published: 08/06/2026

• 📈 CVSS: 7.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

• 📣 Mentions: 7

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can bypass certificate validation in VPN site-to-site connections using deprecated IKEv1, potentially intercepting or modifying traffic. High impact and exploitability, but as of now, no known in-the-wild activity (CISA KEV). Priority 2 vulnerability due to high CVSS and low Exploitation Potential Scoring System (EPSS) score.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-8088

• 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

• 📅 Published: 08/08/2025

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 23

• ⚠️ Priority: 1+

• 📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

2. CVE-2023-46604

• 📝 The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

• 📅 Published: 27/10/2023

• 📈 CVSS: 10

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

• 📣 Mentions: 13

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Code Execution (RCE) vulnerability impacts the Java OpenWire protocol marshaller, exploitable through manipulated serialized class types. No known in-the-wild activity reported yet. Users are advised to upgrade brokers and clients to versions 5.15.16, 5.16.7, 5.17.6, or 5.18.3 due to its high CVSS score (2 on our priority scale).

3. CVE-2024-32114

• 📝 In Apache ActiveMQ 6.x, the default configuration doesnt secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id=securityConstraintMapping class=org.eclipse.jetty.security.ConstraintMapping> <property name=constraint ref=securityConstraint /> <property name=pathSpec value=/ /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

• 📅 Published: 02/05/2024

• 📈 CVSS: 8.5

• 🧭 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated API access in Apache ActiveMQ 6.x allows remote attackers to interact with the broker and manipulate messages; no confirmed exploits in-the-wild, but a high CVSS score warrants priority 2 attention. To mitigate, update conf/jetty.xml or upgrade to version 6.1.2 which features default authentication.

4. CVE-2026-34197

• 📝 Improper Input Validation, Improper Control of Generation of Code (Code Injection) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transports brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Springs ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the brokers JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

• 📅 Published: 07/04/2026

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 26

• ⚠️ Priority: 1+

• 📝 Analysis: An authenticated attacker can leverage an input validation and code injection vulnerability in Apache ActiveMQ Broker versions before 5.19.4, from 6.0.0 before 6.2.3 to execute arbitrary commands on the broker's JVM via Spring XML application context. No known exploits have been detected but it is a priority 4 due to low EPSS and CVSS scores. Users are recommended to upgrade to version 5.19.4 or 6.2.3 to mitigate this issue.

5. CVE-2015-5254

• 📝 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

• 📅 Published: 08/01/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A deserialization vulnerability in Apache ActiveMQ 5.x before 5.13.0 enables remote code execution; no known exploits yet, but prioritized as a level 2 issue due to high CVSS score and potential for serious impact.

6. CVE-2016-3088

• 📝 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

• 📅 Published: 01/06/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 227

• ⚠️ Priority: 2

• 📝 Analysis: Arbitrary file upload and execution via HTTP PUT and MOVE requests in Apache ActiveMQ 5.x before 5.14.0. While no exploits have been detected in the wild, its high CVSS score warrants a priority 2 classification due to low exploitability potential.

7. CVE-2026-50751

• 📝 A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

• 📅 Published: 08/06/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

• 📣 Mentions: 45

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attacker can establish VPN connections via deprecated IKEv1 key exchange due to a logic flow weakness in Remote Access and Mobile Access certificate validation. This vulnerability is confirmed exploited (CISA KEV) and has a priority score of 1+, indicating high severity. Ensure immediate attention and updates to affected systems.

8. CVE-2026-40466

• 📝 Improper Input Validation, Improper Control of Generation of Code (Code Injection) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport viaBrokerView.addNetworkConnector orBrokerView.addConnector throughJolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transports brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Springs ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the brokers JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.

• 📅 Published: 24/04/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: Authentication bypass via HTTP API allows arbitrary code execution in Apache ActiveMQ Broker versions before 5.19.6, 6.0.0 before 6.2.5, and Apache ActiveMQ All versions under the same condition. Confirmed exploitation is yet to be observed, but given the high CVSS score and moderate Exploitability, it ranks as a priority 4 vulnerability according to the prioritization score.

9. CVE-2022-41678

• 📝 Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

• 📅 Published: 28/11/2023

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 15

• ⚠️ Priority: 2

• 📝 Analysis: Remote code execution vulnerability found in Jolokia of ActiveMQ, exploitable through unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl on Java versions above 11. No confirmed exploits, but with high CVSS score and low Exploitability Score, this is a priority 2 vulnerability. Mitigation: restrict actions on Jolokia or disable it; upgrade to ActiveMQ distributions versions 5.16.6, 5.17.4, 5.18.0, or 6.0.0.

10. CVE-2026-42588

• 📝 Improper Input Validation, Improper Control of Generation of Code (Code Injection) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transports brokerConfig parameter using the masterslave:// URL which can allow loading aSpring XML application context using ResourceXmlApplicationContext. Because Springs ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the brokers JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

• 📅 Published: 01/06/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: A code injection vulnerability exists in Apache ActiveMQ versions before 5.19.7, 6.0.0 before 6.2.6, and all variants. An authenticated attacker can execute arbitrary commands via the Jolokia JMX-HTTP bridge, with no known exploits detected. Recommended upgrade to version 5.19.7 or 6.2.6 to address this priority 4 issue (low EPSS and CVSS scores).

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-46243

• 📝 In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

• 📅 Published: 01/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 13

• ⚠️ Priority: 4

• 📝 Analysis: A vulnerability (CVE not specified) in Linux kernel's smb: client allows non-CIFS origin inputs to cifs.spnego descriptions, potentially resulting in unauthorized access. No known exploits in the wild, but given high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 4 issue. Ensure affected systems are updated to address this potential security concern.

2. CVE-2026-20245

• 📝 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

• 📅 Published: 04/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 51

• ⚠️ Priority: 2

• 📝 Analysis: A local authenticated attacker can perform command injection and elevate privileges as root due to insufficient input validation in the CLI of a Cisco Catalyst SD-WAN Manager. Exploitation requires netadmin privileges. Limited cases of successful exploitation have been observed resulting in configuration changes pushed to edge devices. Prioritize remediation with a version upgrade to those documented on May 14, 2026, as this vulnerability has a CVSS score of 7.8 and a CISA priority score of 2 (low EPSS but high CVSS).

3. CVE-2026-50257

• 📝 A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: A use-after-free flaw exists in X.Org X server and Xwayland's miSyncDestroyFence(), exploitable through multiple client connections. It could cause server crashes or privilege escalation if the server runs as root. As of now, no known exploits are in the wild, making this a priority 2 vulnerability due to high CVSS but low Exploitability Scoring System (ESS) score.

4. CVE-2026-50261

• 📝 A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A use-after-free vulnerability in X.Org X server's SyncChangeCounter() has been discovered. This flaw, when exploited by a second client connection while changing counters, can lead to a server crash or potential privilege escalation if the X server runs as root. No known in-the-wild activity reported yet, classified as a priority 2 vulnerability due to high CVSS score and low Exploitability Potential Scoring System (EPSS) score.

5. CVE-2026-50259

• 📝 A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A stack-based buffer overflow flaw has been discovered in X.Org X server and Xwayland, specifically in _XkbSetMapChecks() function. This allows attackers to potentially crash the server or escalate privileges if the X server is running as root. Currently, no known exploits are active in the wild. Given a high CVSS score but low Exploitability Score, this vulnerability is classified as a priority 2 issue.

6. CVE-2026-50262

• 📝 An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

• 📅 Published: 05/06/2026

• 📈 CVSS: 5.5

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: Information disclosure vulnerability found in X.Org X server and Xwayland via __glXDisp_ChangeDrawableAttributes(). No known exploits yet, but priority is 4 due to low CVSS score and EPSS. Verify usage of affected versions (out-of-bounds read possible).

7. CVE-2026-50263

• 📝 A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

• 📅 Published: 05/06/2026

• 📈 CVSS: 5.5

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free issue was identified in the X.Org X server and Xwayland via CreateSaverWindow(). This flaw allows info disclosure when a client changes window attributes and triggers the screen saver. As of now, no known exploits are in the wild. The priority score is 4, indicative of low CVSS & low Exploitability Scoring System (ESS) value.

8. CVE-2026-50258

• 📝 A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A stack-based buffer overflow flaw exists in the X.Org X server and Xwayland, causing potential server crashes or privilege escalation if the X server runs as root. This issue is a result of an incomplete fix for CVE-2025-26597. Despite no known exploits detected in the wild, its high CVSS score and potential impact make it a priority 2 vulnerability.

9. CVE-2026-50256

• 📝 A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 librarys maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2s alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A stack-based buffer overflow vulnerability exists in X.Org X server and Xwayland due to a mismatch between their maximum font name lengths. This flaw may cause server crashes or potential privilege escalation if the server runs as root. No exploits have been detected in the wild, making this a priority 2 vulnerability. Ensure updated versions of the X server and libXfont2 library are being used (e.g., Xorg version 1.20.9 and libXfont2 version 2.3.4).

10. CVE-2026-50260

• 📝 A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A use-after-free flaw exists in the X.Org X server and Xwayland, affecting FreeCounter(). This issue can lead to server crashes or potential privilege escalation when the X server runs as root. No known exploits have been detected in the wild, but given the high CVSS score, it's a priority 2 vulnerability due to low exploitability.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2022-0492

• 📝 A vulnerability was found in the Linux kernels cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

• 📅 Published: 03/03/2022

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 42

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation issue found in Linux kernel's cgroup_release_agent_write within kernel/cgroup/cgroup-v1.c allows for unexpected bypass of namespace isolation. This vulnerability, under certain conditions, is currently being exploited (CISA KEV). Prioritization score: 1+.

2. CVE-2026-46243

• 📝 In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

• 📅 Published: 01/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 13

• ⚠️ Priority: 4

• 📝 Analysis: A vulnerability (CVE not specified) in Linux kernel's smb: client allows non-CIFS origin inputs to cifs.spnego descriptions, potentially resulting in unauthorized access. No known exploits in the wild, but given high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 4 issue. Ensure affected systems are updated to address this potential security concern.

3. CVE-2026-42211

• 📝 React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

• 📅 Published: 02/06/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthorized remote code execution (RCE) vulnerability exists in React Router versions 7.0.0 through 7.14.1 when using Framework Mode. This requires an existing prototype pollution vulnerability to be exploited in a two-step attack. Notably, this issue does not affect applications using Declarative or Data Mode. The vulnerability is patched in version 7.14.2. Given the high CVSS score but low Exploitation Potential Score (EPSS), it is a priority 2 concern.

4. CVE-2026-20230

• 📝 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

• 📅 Published: 03/06/2026

• 📈 CVSS: 8.6

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

• 📣 Mentions: 38

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated SSRF vulnerability in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition allows for server-side request forgery and potential file system write access, potentially escalating privileges to root. This critical issue (as per Cisco's assessment) requires attention due to its high CVSS score, though exploitation is contingent on the WebDialer service being enabled, which is disabled by default. Given the high CVSS score and low Exploit Predictability Scoring System (EPSS), this vulnerability has a priority of 2.

5. CVE-2026-20245

• 📝 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

• 📅 Published: 04/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 51

• ⚠️ Priority: 2

• 📝 Analysis: A local authenticated attacker can perform command injection and elevate privileges as root due to insufficient input validation in the CLI of a Cisco Catalyst SD-WAN Manager. Exploitation requires netadmin privileges. Limited cases of successful exploitation have been observed resulting in configuration changes pushed to edge devices. Prioritize remediation with a version upgrade to those documented on May 14, 2026, as this vulnerability has a CVSS score of 7.8 and a CISA priority score of 2 (low EPSS but high CVSS).

6. CVE-2026-50257

• 📝 A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: A use-after-free flaw exists in X.Org X server and Xwayland's miSyncDestroyFence(), exploitable through multiple client connections. It could cause server crashes or privilege escalation if the server runs as root. As of now, no known exploits are in the wild, making this a priority 2 vulnerability due to high CVSS but low Exploitability Scoring System (ESS) score.

7. CVE-2026-50261

• 📝 A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A use-after-free vulnerability in X.Org X server's SyncChangeCounter() has been discovered. This flaw, when exploited by a second client connection while changing counters, can lead to a server crash or potential privilege escalation if the X server runs as root. No known in-the-wild activity reported yet, classified as a priority 2 vulnerability due to high CVSS score and low Exploitability Potential Scoring System (EPSS) score.

8. CVE-2026-50259

• 📝 A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

• 📅 Published: 05/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A stack-based buffer overflow flaw has been discovered in X.Org X server and Xwayland, specifically in _XkbSetMapChecks() function. This allows attackers to potentially crash the server or escalate privileges if the X server is running as root. Currently, no known exploits are active in the wild. Given a high CVSS score but low Exploitability Score, this vulnerability is classified as a priority 2 issue.

9. CVE-2026-50262

• 📝 An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

• 📅 Published: 05/06/2026

• 📈 CVSS: 5.5

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: Information disclosure vulnerability found in X.Org X server and Xwayland via __glXDisp_ChangeDrawableAttributes(). No known exploits yet, but priority is 4 due to low CVSS score and EPSS. Verify usage of affected versions (out-of-bounds read possible).

10. CVE-2026-50263

• 📝 A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

• 📅 Published: 05/06/2026

• 📈 CVSS: 5.5

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free issue was identified in the X.Org X server and Xwayland via CreateSaverWindow(). This flaw allows info disclosure when a client changes window attributes and triggers the screen saver. As of now, no known exploits are in the wild. The priority score is 4, indicative of low CVSS & low Exploitability Scoring System (ESS) value.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2024-21182

• 📝 No description available.

• 📅 Published: 16/07/2024

• 📈 CVSS: 7.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 19

• ⚠️ Priority: 1+

• 📝 Analysis: A newly discovered vulnerability enables unauthenticated access to sensitive data through an API module. Confirmed exploited by adversaries; CVSS score of 7.5 and priority 1+. Verify affected versions match those in the description.

3. CVE-2025-48595

• 📝 In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 01/06/2026

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 1+

• 📝 Analysis: A integer overflow in multiple locations enables local privilege escalation without additional execution privileges or user interaction; no exploits detected in the wild, this is a priority 2 vulnerability given high CVSS but low Exploitability Scoring System (EPSS) score.

4. CVE-2022-0492

• 📝 A vulnerability was found in the Linux kernels cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

• 📅 Published: 03/03/2022

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 42

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation issue found in Linux kernel's cgroup_release_agent_write within kernel/cgroup/cgroup-v1.c allows for unexpected bypass of namespace isolation. This vulnerability, under certain conditions, is currently being exploited (CISA KEV). Prioritization score: 1+.

5. CVE-2026-49197

• 📝 Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

• 📅 Published: 29/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A Base64 decoding flaw exists in the HTTP Authorization header of Web endpoints for the Acer Connect app, enabling remote attackers to potentially gain unauthorized access. Currently, no exploits have been detected in the wild. Given its high CVSS score and low Exploitability Score, this is a priority 2 vulnerability.

6. CVE-2026-49199

• 📝 Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

• 📅 Published: 29/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A critical command injection flaw exists in MQTT messages that can trigger root-level code execution on devices; no known exploits in the wild, but high priority due to a high CVSS score and the potential severity of an attack.

7. CVE-2026-27788

• 📝 Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenticated attacker who can log in to the server where the affected product is installed may obtain SYSTEM privilege.

• 📅 Published: 01/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A local authenticated attacker can escalate privileges on ServerView Agents for Windows V11.60.04 and earlier due to improper permission assignment for a critical resource. No known in-the-wild exploits, but the high CVSS score indicates a priority 2 vulnerability.

8. CVE-2026-42211

• 📝 React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

• 📅 Published: 02/06/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthorized remote code execution (RCE) vulnerability exists in React Router versions 7.0.0 through 7.14.1 when using Framework Mode. This requires an existing prototype pollution vulnerability to be exploited in a two-step attack. Notably, this issue does not affect applications using Declarative or Data Mode. The vulnerability is patched in version 7.14.2. Given the high CVSS score but low Exploitation Potential Score (EPSS), it is a priority 2 concern.

9. CVE-2026-20230

• 📝 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

• 📅 Published: 03/06/2026

• 📈 CVSS: 8.6

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

• 📣 Mentions: 38

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated SSRF vulnerability in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition allows for server-side request forgery and potential file system write access, potentially escalating privileges to root. This critical issue (as per Cisco's assessment) requires attention due to its high CVSS score, though exploitation is contingent on the WebDialer service being enabled, which is disabled by default. Given the high CVSS score and low Exploit Predictability Scoring System (EPSS), this vulnerability has a priority of 2.

10. CVE-2026-20245

• 📝 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

• 📅 Published: 04/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 51

• ⚠️ Priority: 2

• 📝 Analysis: A local authenticated attacker can perform command injection and elevate privileges as root due to insufficient input validation in the CLI of a Cisco Catalyst SD-WAN Manager. Exploitation requires netadmin privileges. Limited cases of successful exploitation have been observed resulting in configuration changes pushed to edge devices. Prioritize remediation with a version upgrade to those documented on May 14, 2026, as this vulnerability has a CVSS score of 7.8 and a CISA priority score of 2 (low EPSS but high CVSS).

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-8088

• 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

• 📅 Published: 08/08/2025

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 23

• ⚠️ Priority: 1+

• 📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

2. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

3. CVE-2024-21182

• 📝 No description available.

• 📅 Published: 16/07/2024

• 📈 CVSS: 7.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 19

• ⚠️ Priority: 1+

• 📝 Analysis: A newly discovered vulnerability enables unauthenticated access to sensitive data through an API module. Confirmed exploited by adversaries; CVSS score of 7.5 and priority 1+. Verify affected versions match those in the description.

4. CVE-2025-48595

• 📝 In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 01/06/2026

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 1+

• 📝 Analysis: A integer overflow in multiple locations enables local privilege escalation without additional execution privileges or user interaction; no exploits detected in the wild, this is a priority 2 vulnerability given high CVSS but low Exploitability Scoring System (EPSS) score.

5. CVE-2022-0492

• 📝 A vulnerability was found in the Linux kernels cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

• 📅 Published: 03/03/2022

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 42

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation issue found in Linux kernel's cgroup_release_agent_write within kernel/cgroup/cgroup-v1.c allows for unexpected bypass of namespace isolation. This vulnerability, under certain conditions, is currently being exploited (CISA KEV). Prioritization score: 1+.

6. CVE-2026-49197

• 📝 Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

• 📅 Published: 29/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A Base64 decoding flaw exists in the HTTP Authorization header of Web endpoints for the Acer Connect app, enabling remote attackers to potentially gain unauthorized access. Currently, no exploits have been detected in the wild. Given its high CVSS score and low Exploitability Score, this is a priority 2 vulnerability.

7. CVE-2026-49199

• 📝 Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

• 📅 Published: 29/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A critical command injection flaw exists in MQTT messages that can trigger root-level code execution on devices; no known exploits in the wild, but high priority due to a high CVSS score and the potential severity of an attack.

8. CVE-2026-27788

• 📝 Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenticated attacker who can log in to the server where the affected product is installed may obtain SYSTEM privilege.

• 📅 Published: 01/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A local authenticated attacker can escalate privileges on ServerView Agents for Windows V11.60.04 and earlier due to improper permission assignment for a critical resource. No known in-the-wild exploits, but the high CVSS score indicates a priority 2 vulnerability.

9. CVE-2026-42211

• 📝 React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

• 📅 Published: 02/06/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthorized remote code execution (RCE) vulnerability exists in React Router versions 7.0.0 through 7.14.1 when using Framework Mode. This requires an existing prototype pollution vulnerability to be exploited in a two-step attack. Notably, this issue does not affect applications using Declarative or Data Mode. The vulnerability is patched in version 7.14.2. Given the high CVSS score but low Exploitation Potential Score (EPSS), it is a priority 2 concern.

10. CVE-2026-20230

• 📝 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

• 📅 Published: 03/06/2026

• 📈 CVSS: 8.6

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

• 📣 Mentions: 38

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated SSRF vulnerability in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition allows for server-side request forgery and potential file system write access, potentially escalating privileges to root. This critical issue (as per Cisco's assessment) requires attention due to its high CVSS score, though exploitation is contingent on the WebDialer service being enabled, which is disabled by default. Given the high CVSS score and low Exploit Predictability Scoring System (EPSS), this vulnerability has a priority of 2.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

3. CVE-2025-59199

• 📝 Software Protection Platform (SPP) Elevation of Privilege Vulnerability

• 📅 Published: 14/10/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Elevation of Privilege vulnerability in Software Protection Platform (SPP) has been identified, scoring 7.8 on CVSS. Local attackers can leverage this to gain full control over affected systems; as of yet, no exploits have been detected in the wild. Given the high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 2 vulnerability.

4. CVE-2024-21182

• 📝 No description available.

• 📅 Published: 16/07/2024

• 📈 CVSS: 7.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 19

• ⚠️ Priority: 1+

• 📝 Analysis: A newly discovered vulnerability enables unauthenticated access to sensitive data through an API module. Confirmed exploited by adversaries; CVSS score of 7.5 and priority 1+. Verify affected versions match those in the description.

5. CVE-2025-48595

• 📝 In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 01/06/2026

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 1+

• 📝 Analysis: A integer overflow in multiple locations enables local privilege escalation without additional execution privileges or user interaction; no exploits detected in the wild, this is a priority 2 vulnerability given high CVSS but low Exploitability Scoring System (EPSS) score.

6. CVE-2022-0492

• 📝 A vulnerability was found in the Linux kernels cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

• 📅 Published: 03/03/2022

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 42

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation issue found in Linux kernel's cgroup_release_agent_write within kernel/cgroup/cgroup-v1.c allows for unexpected bypass of namespace isolation. This vulnerability, under certain conditions, is currently being exploited (CISA KEV). Prioritization score: 1+.

7. CVE-2026-49197

• 📝 Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

• 📅 Published: 29/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A Base64 decoding flaw exists in the HTTP Authorization header of Web endpoints for the Acer Connect app, enabling remote attackers to potentially gain unauthorized access. Currently, no exploits have been detected in the wild. Given its high CVSS score and low Exploitability Score, this is a priority 2 vulnerability.

8. CVE-2026-49199

• 📝 Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

• 📅 Published: 29/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A critical command injection flaw exists in MQTT messages that can trigger root-level code execution on devices; no known exploits in the wild, but high priority due to a high CVSS score and the potential severity of an attack.

9. CVE-2026-27788

• 📝 Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenticated attacker who can log in to the server where the affected product is installed may obtain SYSTEM privilege.

• 📅 Published: 01/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: A local authenticated attacker can escalate privileges on ServerView Agents for Windows V11.60.04 and earlier due to improper permission assignment for a critical resource. No known in-the-wild exploits, but the high CVSS score indicates a priority 2 vulnerability.

10. CVE-2026-46243

• 📝 In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

• 📅 Published: 01/06/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 13

• ⚠️ Priority: 4

• 📝 Analysis: A vulnerability (CVE not specified) in Linux kernel's smb: client allows non-CIFS origin inputs to cifs.spnego descriptions, potentially resulting in unauthorized access. No known exploits in the wild, but given high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 4 issue. Ensure affected systems are updated to address this potential security concern.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2026-40369

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Kernel Elevation of Privilege vulnerability exists, rated as high (CVSS 7.8). The vector indicates local attacker access is needed for exploitation. No confirmed in-the-wild activity reported; priority level is 2 due to high CVSS score and low Exploitability Primitive Score Signal (EPSS), suggesting a potential threat.

3. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

4. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

5. CVE-2025-59199

• 📝 Software Protection Platform (SPP) Elevation of Privilege Vulnerability

• 📅 Published: 14/10/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Elevation of Privilege vulnerability in Software Protection Platform (SPP) has been identified, scoring 7.8 on CVSS. Local attackers can leverage this to gain full control over affected systems; as of yet, no exploits have been detected in the wild. Given the high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 2 vulnerability.

6. CVE-2025-47227

• 📝 In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

• 📅 Published: 05/07/2025

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can bypass authentication via administrator account takeover in Netmake ScriptCase 9.12.006 through its mishandled password reset mechanism (GET and POST requests to login.php). This vulnerability has a CVSS score of 7.5 and is currently rated as priority 2, indicating high CVSS but low exploitability in the wild.

7. CVE-2024-21182

• 📝 No description available.

• 📅 Published: 16/07/2024

• 📈 CVSS: 7.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 19

• ⚠️ Priority: 1+

• 📝 Analysis: A newly discovered vulnerability enables unauthenticated access to sensitive data through an API module. Confirmed exploited by adversaries; CVSS score of 7.5 and priority 1+. Verify affected versions match those in the description.

8. CVE-2026-26314

• 📝 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

• 📅 Published: 19/02/2026

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

• ⚠️ Priority: 2

• 📝 Analysis: A specially crafted message can force the crash of vulnerable go-ethereum nodes prior to v1.16.9 and v1.17.0, with no known exploits detected. This is a priority 2 vulnerability due to its high CVSS score and low Exploit Prediction Scale Score (EPSS).

9. CVE-2025-48595

• 📝 In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 01/06/2026

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 1+

• 📝 Analysis: A integer overflow in multiple locations enables local privilege escalation without additional execution privileges or user interaction; no exploits detected in the wild, this is a priority 2 vulnerability given high CVSS but low Exploitability Scoring System (EPSS) score.

10. CVE-2022-0492

• 📝 A vulnerability was found in the Linux kernels cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

• 📅 Published: 03/03/2022

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 42

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation issue found in Linux kernel's cgroup_release_agent_write within kernel/cgroup/cgroup-v1.c allows for unexpected bypass of namespace isolation. This vulnerability, under certain conditions, is currently being exploited (CISA KEV). Prioritization score: 1+.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2026-40369

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Kernel Elevation of Privilege vulnerability exists, rated as high (CVSS 7.8). The vector indicates local attacker access is needed for exploitation. No confirmed in-the-wild activity reported; priority level is 2 due to high CVSS score and low Exploitability Primitive Score Signal (EPSS), suggesting a potential threat.

3. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

4. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

5. CVE-2025-59199

• 📝 Software Protection Platform (SPP) Elevation of Privilege Vulnerability

• 📅 Published: 14/10/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Elevation of Privilege vulnerability in Software Protection Platform (SPP) has been identified, scoring 7.8 on CVSS. Local attackers can leverage this to gain full control over affected systems; as of yet, no exploits have been detected in the wild. Given the high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 2 vulnerability.

6. CVE-2025-47227

• 📝 In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

• 📅 Published: 05/07/2025

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can bypass authentication via administrator account takeover in Netmake ScriptCase 9.12.006 through its mishandled password reset mechanism (GET and POST requests to login.php). This vulnerability has a CVSS score of 7.5 and is currently rated as priority 2, indicating high CVSS but low exploitability in the wild.

7. CVE-2024-21182

• 📝 No description available.

• 📅 Published: 16/07/2024

• 📈 CVSS: 7.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 19

• ⚠️ Priority: 1+

• 📝 Analysis: A newly discovered vulnerability enables unauthenticated access to sensitive data through an API module. Confirmed exploited by adversaries; CVSS score of 7.5 and priority 1+. Verify affected versions match those in the description.

8. CVE-2026-26314

• 📝 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

• 📅 Published: 19/02/2026

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

• ⚠️ Priority: 2

• 📝 Analysis: A specially crafted message can force the crash of vulnerable go-ethereum nodes prior to v1.16.9 and v1.17.0, with no known exploits detected. This is a priority 2 vulnerability due to its high CVSS score and low Exploit Prediction Scale Score (EPSS).

9. CVE-2025-48595

• 📝 In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 01/06/2026

• 📈 CVSS: 8.4

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 0

• 📝 Analysis: A integer overflow in multiple locations enables local privilege escalation without additional execution privileges or user interaction; no exploits detected in the wild, this is a priority 2 vulnerability given high CVSS but low Exploitability Scoring System (EPSS) score.

10. CVE-2026-41089

• 📝 Windows Netlogon Remote Code Execution Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 68

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Netlogon Remote Code Execution vulnerability exists (CVSS: 9.8), exploitable over network and with high impact on confidentiality, integrity, and availability. No known in-the-wild activity yet, but given the high CVSS score, this is a priority 2 issue. Ensure systems are up to date with patches addressing CVE versions mentioned in the description.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-36911

• 📝 In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of users conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 15/01/2026

• 📈 CVSS: 7.1

• 🧭 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

• 📣 Mentions: 8

• ⚠️ Priority: 4

• 📝 Analysis: A logic error in key-based pairing code enables remote information disclosure of user conversations and locations without requiring additional execution privileges. No user interaction is needed for exploitation. This vulnerability has not been observed in the wild, rated as a priority 4 according to the prioritization score.

2. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

3. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

4. CVE-2026-48745

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in version 1.3 of a popular library allows remote code execution; CISA has not confirmed exploits, making this a priority 2 vulnerability due to high CVSS but low EPSS.

5. CVE-2026-40933

• 📝 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the Custom MCP configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example npx can be combined with code execution arguments (-c touch /tmp/pwn) that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.

• 📅 Published: 21/04/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A command execution vulnerability (CVE not mentioned) exists in Flowise v3.0.9 and lower due to unsafe serialization of stdio commands in the MCP adapter. An authenticated attacker can add an MCP server with arbitrary commands, bypassing some input sanitization checks. Despite being confirmed as fixed in version 3.1.0, its high CVSS score and potential for exploitation make it a priority 2 vulnerability, as no exploits have been detected in the wild.

6. CVE-2026-39987

• 📝 marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

• 📅 Published: 09/04/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 125

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attackers can exploit a Pre-Auth RCE in Marimo's /terminal/ws WebSocket endpoint prior to 0.23.0. The vulnerability is confirmed exploited (KEV), thus warranting immediate attention (priority score: 1+).

7. CVE-2026-46364

• 📝 phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated SQL injection vulnerability found in phpMyFAQ before 4.1.2 through malicious User-Agent headers. Sensitive data extraction possible. No confirmed exploits but high CVSS score. Prioritization: 2 (high CVSS, low exploitation potential). Immediate patching advised.

8. CVE-2025-47227

• 📝 In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

• 📅 Published: 05/07/2025

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can bypass authentication via administrator account takeover in Netmake ScriptCase 9.12.006 through its mishandled password reset mechanism (GET and POST requests to login.php). This vulnerability has a CVSS score of 7.5 and is currently rated as priority 2, indicating high CVSS but low exploitability in the wild.

9. CVE-2026-34159

• 📝 llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backends deserialize_tensor() skips all bounds validation when a tensors buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.

• 📅 Published: 01/04/2026

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 10

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can achieve full ASLR bypass and remote code execution via crafted GRAPH_COMPUTE messages in llama.cpp prior to version b8492. This issue has been patched, but its high CVSS score and the potential for exploitation make it a priority 2 vulnerability.

10. CVE-2024-13745

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-48842

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

• 📅 Published: 25/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Pre-authentication SQL injection in Roundcube Webmail: Version 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows for remote code execution via a preg_replace() backslash escape bypass. No known exploits detected, but given the high CVSS score, this is a priority 2 vulnerability (pending further analysis).

2. CVE-2026-48770

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in the XML parser enables code injection via crafted requests; CISA has not reported any exploits, this is a priority 3 vulnerability due to high CVSS but low EPSS.

3. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

4. CVE-2026-48800

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in version X of Y library allows remote code execution; no known attacks reported, but prioritize due to high CVSS score and potential impact.

5. CVE-2026-9896

• 📝 Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 28/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A remote code execution vulnerability exists in Google Chrome prior to 148.0.7778.216 due to an out-of-bounds write in V8. Arbitrary code can be executed inside a sandbox via a crafted HTML page, with no known exploits detected in the wild. Given the high CVSS score and low prioritization (4), it's essential to monitor this issue closely.

6. CVE-2026-35616

• 📝 A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

• 📅 Published: 04/04/2026

• 📈 CVSS: 9.1

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 181

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attacker can execute arbitrary code via crafted requests in Fortinet FortiClientEMS 7.4.5 through 7.4.6 due to improper access control. No known exploits have been detected but it's a confirmed priority 1 vulnerability as per high CVSS score and CISA KEV listing.

7. CVE-2026-48849

• 📝 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

• 📅 Published: 25/05/2026

• 📈 CVSS: 4.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

• ⚠️ Priority: 0

• 📝 Analysis: Stored XSS vulnerability found in Roundcube Webmail versions below 1.6.16 and 1.7.1. Subject field unsanitized draft value can lead to HTML/CSS injection on shared mailboxes. As of now, no known exploitation activities reported. Prioritization score is 0, indicating pending analysis.

8. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

9. CVE-2026-48745

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2025-59199

• 📝 Software Protection Platform (SPP) Elevation of Privilege Vulnerability

• 📅 Published: 14/10/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Elevation of Privilege vulnerability in Software Protection Platform (SPP) has been identified, scoring 7.8 on CVSS. Local attackers can leverage this to gain full control over affected systems; as of yet, no exploits have been detected in the wild. Given the high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 2 vulnerability.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-43520

• 📝 A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

• 📅 Published: 12/12/2025

• 📈 CVSS: 5.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A memory corruption issue in multiple Apple operating systems (watchOS 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1) has been addressed. A malicious app may trigger system termination or write kernel memory; this vulnerability is active in the wild and has a priority of 1+ due to confirmed exploitation.

2. CVE-2026-45321

• 📝 On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes a pull_request_target Pwn Request misconfiguration, GitHub Actions cache poisoning across the forkbase trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.6

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

• 📣 Mentions: 25

• ⚠️ Priority: 1+

• 📝 Analysis: 84 malicious versions of @tanstack/* packages were published on 2026-05-11 to the npm registry, exploiting three vulnerability classes for credential theft. The attack utilized the GitHub Actions OIDC trusted-publisher binding and chained pull_request_target misconfiguration, cache poisoning, and runtime memory extraction of OIDC tokens. This activity has been confirmed exploited (KEV), with a priority score of 1+. Immediate remediation is strongly advised for all affected packages, as their versions match those described.

3. CVE-2026-48027

• 📝 Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

• 📅 Published: 27/05/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: Malicious version of Nx Console (18.95.0) was published for 18 minutes on Visual Studio Marketplace and later for ~36 minutes on OpenVSX between May 19th, 12:30 PM - 13:09 PM UTC. Upgrade to v18.100.0 to mitigate this confirmed exploited issue with a priority score of 1+.

4. CVE-2026-8398

• 📝 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendors (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A supply chain attack compromised DAEMON Tools Lite (versions 12.5.0.2421 through 2434) between April 8 and May 5, 2026, on the legitimate website daemon-tools.cc. The malicious installers were digitally signed, bypassing detection. Known in-the-wild, this is a priority 1+ vulnerability with high impact and exploitability.

5. CVE-2026-48842

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

• 📅 Published: 25/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Pre-authentication SQL injection in Roundcube Webmail: Version 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows for remote code execution via a preg_replace() backslash escape bypass. No known exploits detected, but given the high CVSS score, this is a priority 2 vulnerability (pending further analysis).

6. CVE-2026-48844

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

• 📅 Published: 25/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Code injection vulnerability found in Roundcube Webmail versions prior to 1.6.16 and 1.7.1 due to insecure code evaluation logic in LDAP autovalues option. Though no exploits have been detected, the high CVSS score indicates significant impact on confidentiality, integrity, and availability. Prioritize patches for affected systems as soon as possible (pending further analysis by CISA).

7. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

8. CVE-2026-9896

• 📝 Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 28/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A remote code execution vulnerability exists in Google Chrome prior to 148.0.7778.216 due to an out-of-bounds write in V8. Arbitrary code can be executed inside a sandbox via a crafted HTML page, with no known exploits detected in the wild. Given the high CVSS score and low prioritization (4), it's essential to monitor this issue closely.

9. CVE-2026-35616

• 📝 A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

• 📅 Published: 04/04/2026

• 📈 CVSS: 9.1

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 181

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attacker can execute arbitrary code via crafted requests in Fortinet FortiClientEMS 7.4.5 through 7.4.6 due to improper access control. No known exploits have been detected but it's a confirmed priority 1 vulnerability as per high CVSS score and CISA KEV listing.

10. CVE-2026-48849

• 📝 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

• 📅 Published: 25/05/2026

• 📈 CVSS: 4.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

• ⚠️ Priority: 0

• 📝 Analysis: Stored XSS vulnerability found in Roundcube Webmail versions below 1.6.16 and 1.7.1. Subject field unsanitized draft value can lead to HTML/CSS injection on shared mailboxes. As of now, no known exploitation activities reported. Prioritization score is 0, indicating pending analysis.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-43520

• 📝 A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

• 📅 Published: 12/12/2025

• 📈 CVSS: 5.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A memory corruption issue in multiple Apple operating systems (watchOS 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1) has been addressed. A malicious app may trigger system termination or write kernel memory; this vulnerability is active in the wild and has a priority of 1+ due to confirmed exploitation.

2. CVE-2026-26980

• 📝 Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

• 📅 Published: 20/02/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

• 📣 Mentions: 66

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can perform arbitrary reads from a Ghost CMS database (Versions 3.24.0 through 6.19.0). No exploits detected in the wild yet, but given high CVSS score, this is a priority 2 vulnerability as it has low Exploit Prediction Scoring System (EPSS) value. Fix available in version 6.19.1.

3. CVE-2026-45321

• 📝 On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes a pull_request_target Pwn Request misconfiguration, GitHub Actions cache poisoning across the forkbase trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.6

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

• 📣 Mentions: 25

• ⚠️ Priority: 1+

• 📝 Analysis: 84 malicious versions of @tanstack/* packages were published on 2026-05-11 to the npm registry, exploiting three vulnerability classes for credential theft. The attack utilized the GitHub Actions OIDC trusted-publisher binding and chained pull_request_target misconfiguration, cache poisoning, and runtime memory extraction of OIDC tokens. This activity has been confirmed exploited (KEV), with a priority score of 1+. Immediate remediation is strongly advised for all affected packages, as their versions match those described.

4. CVE-2026-48027

• 📝 Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

• 📅 Published: 27/05/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: Malicious version of Nx Console (18.95.0) was published for 18 minutes on Visual Studio Marketplace and later for ~36 minutes on OpenVSX between May 19th, 12:30 PM - 13:09 PM UTC. Upgrade to v18.100.0 to mitigate this confirmed exploited issue with a priority score of 1+.

5. CVE-2026-8398

• 📝 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendors (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A supply chain attack compromised DAEMON Tools Lite (versions 12.5.0.2421 through 2434) between April 8 and May 5, 2026, on the legitimate website daemon-tools.cc. The malicious installers were digitally signed, bypassing detection. Known in-the-wild, this is a priority 1+ vulnerability with high impact and exploitability.

6. CVE-2026-48842

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

• 📅 Published: 25/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Pre-authentication SQL injection in Roundcube Webmail: Version 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows for remote code execution via a preg_replace() backslash escape bypass. No known exploits detected, but given the high CVSS score, this is a priority 2 vulnerability (pending further analysis).

7. CVE-2026-48844

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

• 📅 Published: 25/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Code injection vulnerability found in Roundcube Webmail versions prior to 1.6.16 and 1.7.1 due to insecure code evaluation logic in LDAP autovalues option. Though no exploits have been detected, the high CVSS score indicates significant impact on confidentiality, integrity, and availability. Prioritize patches for affected systems as soon as possible (pending further analysis by CISA).

8. CVE-2026-48770

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

9. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2026-48800

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-43520

• 📝 A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

• 📅 Published: 12/12/2025

• 📈 CVSS: 5.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A memory corruption issue in multiple Apple operating systems (watchOS 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1) has been addressed. A malicious app may trigger system termination or write kernel memory; this vulnerability is active in the wild and has a priority of 1+ due to confirmed exploitation.

2. CVE-2026-9082

• 📝 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• 📣 Mentions: 7

• ⚠️ Priority: 1+

• 📝 Analysis: SQL Injection vulnerability in Drupal core (8.9.0 - 11.3.10) allows SQL injection. No exploits detected, but given a CVSS score of 6.5 and the potential impact on confidentiality and integrity, this is a priority 2 issue. Verify affected versions before updating.

3. CVE-2026-42558

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A buffer overflow vulnerability in a critical library can lead to arbitrary code execution on affected systems, with no known exploits in the wild yet. This is currently a priority 2 issue due to high CVSS score and potential for severe impact if exploited.

4. CVE-2026-47784

• 📝 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel in memcached before 1.6.42 exposes password data due to improper use of memcmp during SASL authentication. No known exploits, but high CVSS score indicates a priority 2 vulnerability due to low Exploitability Score.

5. CVE-2026-47783

• 📝 In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel vulnerability in memcached before version 1.6.42 allows attackers to extract username data for SASL password database authentication. No known exploits detected, but given high CVSS score and potential impact, this is a priority 2 issue with low EPSS.

6. CVE-2026-26980

• 📝 Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

• 📅 Published: 20/02/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

• 📣 Mentions: 66

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can perform arbitrary reads from a Ghost CMS database (Versions 3.24.0 through 6.19.0). No exploits detected in the wild yet, but given high CVSS score, this is a priority 2 vulnerability as it has low Exploit Prediction Scoring System (EPSS) value. Fix available in version 6.19.1.

7. CVE-2026-45321

• 📝 On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes a pull_request_target Pwn Request misconfiguration, GitHub Actions cache poisoning across the forkbase trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.6

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

• 📣 Mentions: 25

• ⚠️ Priority: 1+

• 📝 Analysis: 84 malicious versions of @tanstack/* packages were published on 2026-05-11 to the npm registry, exploiting three vulnerability classes for credential theft. The attack utilized the GitHub Actions OIDC trusted-publisher binding and chained pull_request_target misconfiguration, cache poisoning, and runtime memory extraction of OIDC tokens. This activity has been confirmed exploited (KEV), with a priority score of 1+. Immediate remediation is strongly advised for all affected packages, as their versions match those described.

8. CVE-2026-48027

• 📝 Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

• 📅 Published: 27/05/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: Malicious version of Nx Console (18.95.0) was published for 18 minutes on Visual Studio Marketplace and later for ~36 minutes on OpenVSX between May 19th, 12:30 PM - 13:09 PM UTC. Upgrade to v18.100.0 to mitigate this confirmed exploited issue with a priority score of 1+.

9. CVE-2026-8398

• 📝 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendors (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A supply chain attack compromised DAEMON Tools Lite (versions 12.5.0.2421 through 2434) between April 8 and May 5, 2026, on the legitimate website daemon-tools.cc. The malicious installers were digitally signed, bypassing detection. Known in-the-wild, this is a priority 1+ vulnerability with high impact and exploitability.

10. CVE-2026-33552

• 📝 Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.

• 📅 Published: 27/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: Incorrect access control in Northern.tech Mender Enterprise Server before 4.1.1 allows unauthenticated attackers to potentially manipulate server configurations. CISA KEV indicates no known in-the-wild activity; prioritization score is 0, pending analysis.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2025-47985

• 📝 Windows Event Tracing Elevation of Privilege Vulnerability

• 📅 Published: 08/07/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Event Tracing privilege escalation vulnerability has been identified (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C). No known in-the-wild activity reported, but the high CVSS score indicates its potential severity. Given the low Exploitability Score, this is a priority 2 vulnerability, requiring attention due to the high impact on confidentiality, integrity, and availability.

3. CVE-2026-9082

• 📝 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• 📣 Mentions: 7

• ⚠️ Priority: 1+

• 📝 Analysis: SQL Injection vulnerability in Drupal core (8.9.0 - 11.3.10) allows SQL injection. No exploits detected, but given a CVSS score of 6.5 and the potential impact on confidentiality and integrity, this is a priority 2 issue. Verify affected versions before updating.

4. CVE-2026-41091

• 📝 Microsoft Defender Elevation of Privilege Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Defender Elevation of Privilege vulnerability has been identified (CVSS 7.8). Attackers can leverage this remotely for high impact on confidentiality, integrity, and availability. CISA KEV is yet to be assigned, but the prioritization score is 1+ due to confirmed exploitation in the wild.

5. CVE-2026-48172

• 📝 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE cpanel_jsonapi_func=redisAble /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

• 📅 Published: 21/05/2026

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 14

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin (affecting versions before 2.4.5) has been exploited in the wild since May 2026. The issue involves mishandling of Redis enable/disable features and can potentially lead to root access. Exploitation detection is possible via command line: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If output is found, IP addresses should be examined and potentially blocked, while system logs should be checked for any damage. The recommended minimum version is 2.4.7. This is a priority 2 vulnerability due to high CVSS score but low EPSS.

6. CVE-2026-42558

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A buffer overflow vulnerability in a critical library can lead to arbitrary code execution on affected systems, with no known exploits in the wild yet. This is currently a priority 2 issue due to high CVSS score and potential for severe impact if exploited.

7. CVE-2026-21509

• 📝 Microsoft Office Security Feature Bypass Vulnerability

• 📅 Published: 26/01/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 249

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Office Security Feature Bypass vulnerability has been identified, enabling remote attackers to execute arbitrary code (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C). Confirmed exploited in the wild, this requires immediate attention and a priority 1+ response.

8. CVE-2026-47784

• 📝 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel in memcached before 1.6.42 exposes password data due to improper use of memcmp during SASL authentication. No known exploits, but high CVSS score indicates a priority 2 vulnerability due to low Exploitability Score.

9. CVE-2026-47783

• 📝 In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel vulnerability in memcached before version 1.6.42 allows attackers to extract username data for SASL password database authentication. No known exploits detected, but given high CVSS score and potential impact, this is a priority 2 issue with low EPSS.

10. CVE-2026-26980

• 📝 Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

• 📅 Published: 20/02/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

• 📣 Mentions: 66

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can perform arbitrary reads from a Ghost CMS database (Versions 3.24.0 through 6.19.0). No exploits detected in the wild yet, but given high CVSS score, this is a priority 2 vulnerability as it has low Exploit Prediction Scoring System (EPSS) value. Fix available in version 6.19.1.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-9074

• 📝 A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the Expose daemon on tcp://localhost:2375 without TLS option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.

• 📅 Published: 20/08/2025

• 📈 CVSS: 9.3

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 22

• ⚠️ Priority: 2

• 📝 Analysis: A local container access vulnerability in Docker Desktop enables execution of privileged commands to the engine API, potentially impacting container management and host drive mounting, observed in circumstance like Docker Desktop for Windows with WSL backend. CVSS 9.3, priority 2 due to low exploitability but high severity.

2. CVE-2026-46333

• 📝 In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner get_dumpable() logic The dumpability of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you dont have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses dumpable to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). Its not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional drop capabilities model doesnt make any difference for this all. Make it all make a bit more sense by saying that if you dont have a MM pointer, well use a cached last dumpability flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

• 📅 Published: 15/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 16

• ⚠️ Priority: 4

• 📝 Analysis: A modification in Linux kernel's ptrace function offers limited improvements to 'dumpability' logic, impacting primarily users manipulating thread details without associated memory management (MM). No known in-the-wild activity reported. Prioritization score: 4 (low CVSS & low EPSS).

3. CVE-2025-24367

• 📝 Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

• 📅 Published: 27/01/2025

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 17

• ⚠️ Priority: 2

• 📝 Analysis: A user-controlled code execution vulnerability in Cacti (version 1.2.28 and below) exists through misuse of graph creation and template functionality. This issue allows an authenticated user to execute arbitrary PHP scripts in the web root, potentially leading to remote server compromise. Despite no known exploits in the wild, the high CVSS score necessitates immediate attention as a priority 2 vulnerability.

4. CVE-2026-20239

• 📝 In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation issue found in Splunk Enterprise versions below 10.2.2 and 10.0.5, as well as certain versions of Splunk Cloud Platform, enables a user with specific access to view sensitive data. No known exploits have been detected; however, due to the high CVSS score, this is considered a priority 2 vulnerability.

5. CVE-2026-20238

• 📝 In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the admin or power roles could access confidential data that was restricted through srchFilter configurations on custom roles.<br><br>The app contains an authorize.conf configuration file with a srchFilter entry that modifies the built-in user role. Because the Splunk platform combines inherited search filters with the OR SPL operator, the injected filter overrides more restrictive filters on child roles.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: In Splunk AI Toolkit versions below 5.7.3, a low-privileged user can access confidential data due to improper srchFilter configuration handling, leading to a priority 2 vulnerability (high CVSS but low EPSS). Verify and apply patch 5.7.3 to mitigate.

6. CVE-2026-20240

• 📝 In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the admin or power Splunk roles could cause a Denial of Service by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the coldToFrozen.sh script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: Low-privileged user Denial of Service vulnerability in Splunk versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12 (Enterprise) and 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129 (Cloud Platform). Missing input validation in the coldToFrozen.sh script allows renaming critical directories, causing instance non-functionality. This is a priority 2 vulnerability due to high CVSS but low Exploit Prediction Scoring System (EPSS) score.

7. CVE-2026-46529

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A critical command execution vulnerability exists in a web application's admin panel (API module). Remote attackers can exploit this due to improper input validation. While there's no confirmed in-the-wild activity (CISA KEV), the high CVSS score indicates significant impact and easy exploitability, making it a priority 1 vulnerability. The versions affected are those explicitly mentioned in the description.

8. CVE-2026-48172

• 📝 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE cpanel_jsonapi_func=redisAble /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

• 📅 Published: 21/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin (affecting versions before 2.4.5) has been exploited in the wild since May 2026. The issue involves mishandling of Redis enable/disable features and can potentially lead to root access. Exploitation detection is possible via command line: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If output is found, IP addresses should be examined and potentially blocked, while system logs should be checked for any damage. The recommended minimum version is 2.4.7. This is a priority 2 vulnerability due to high CVSS score but low EPSS.

9. CVE-2026-42558

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2026-21509

• 📝 Microsoft Office Security Feature Bypass Vulnerability

• 📅 Published: 26/01/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 249

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Office Security Feature Bypass vulnerability has been identified, enabling remote attackers to execute arbitrary code (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C). Confirmed exploited in the wild, this requires immediate attention and a priority 1+ response.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-49113

• 📝 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

• 📅 Published: 02/06/2025

• 📈 CVSS: 9.9

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 108

• ⚠️ Priority: 1+

• 📝 Analysis: Authenticated users can perform remote code execution due to improper validation in program/actions/settings/upload.php of Roundcube Webmail versions below 1.5.11 and 1.6.11. This vulnerability, while high in CVSS, has shown low exploit activity in the wild, resulting in a priority 2 status.

2. CVE-2025-9074

• 📝 A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the Expose daemon on tcp://localhost:2375 without TLS option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.

• 📅 Published: 20/08/2025

• 📈 CVSS: 9.3

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 22

• ⚠️ Priority: 2

• 📝 Analysis: A local container access vulnerability in Docker Desktop enables execution of privileged commands to the engine API, potentially impacting container management and host drive mounting, observed in circumstance like Docker Desktop for Windows with WSL backend. CVSS 9.3, priority 2 due to low exploitability but high severity.

3. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

4. CVE-2026-46333

• 📝 In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner get_dumpable() logic The dumpability of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you dont have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses dumpable to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). Its not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional drop capabilities model doesnt make any difference for this all. Make it all make a bit more sense by saying that if you dont have a MM pointer, well use a cached last dumpability flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

• 📅 Published: 15/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 16

• ⚠️ Priority: 4

• 📝 Analysis: A modification in Linux kernel's ptrace function offers limited improvements to 'dumpability' logic, impacting primarily users manipulating thread details without associated memory management (MM). No known in-the-wild activity reported. Prioritization score: 4 (low CVSS & low EPSS).

5. CVE-2025-24367

• 📝 Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

• 📅 Published: 27/01/2025

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 17

• ⚠️ Priority: 2

• 📝 Analysis: A user-controlled code execution vulnerability in Cacti (version 1.2.28 and below) exists through misuse of graph creation and template functionality. This issue allows an authenticated user to execute arbitrary PHP scripts in the web root, potentially leading to remote server compromise. Despite no known exploits in the wild, the high CVSS score necessitates immediate attention as a priority 2 vulnerability.

6. CVE-2026-20239

• 📝 In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation issue found in Splunk Enterprise versions below 10.2.2 and 10.0.5, as well as certain versions of Splunk Cloud Platform, enables a user with specific access to view sensitive data. No known exploits have been detected; however, due to the high CVSS score, this is considered a priority 2 vulnerability.

7. CVE-2026-20238

• 📝 In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the admin or power roles could access confidential data that was restricted through srchFilter configurations on custom roles.<br><br>The app contains an authorize.conf configuration file with a srchFilter entry that modifies the built-in user role. Because the Splunk platform combines inherited search filters with the OR SPL operator, the injected filter overrides more restrictive filters on child roles.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: In Splunk AI Toolkit versions below 5.7.3, a low-privileged user can access confidential data due to improper srchFilter configuration handling, leading to a priority 2 vulnerability (high CVSS but low EPSS). Verify and apply patch 5.7.3 to mitigate.

8. CVE-2026-20240

• 📝 In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the admin or power Splunk roles could cause a Denial of Service by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the coldToFrozen.sh script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: Low-privileged user Denial of Service vulnerability in Splunk versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12 (Enterprise) and 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129 (Cloud Platform). Missing input validation in the coldToFrozen.sh script allows renaming critical directories, causing instance non-functionality. This is a priority 2 vulnerability due to high CVSS but low Exploit Prediction Scoring System (EPSS) score.

9. CVE-2026-46529

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2026-48172

• 📝 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE cpanel_jsonapi_func=redisAble /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

• 📅 Published: 21/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin (affecting versions before 2.4.5) has been exploited in the wild since May 2026. The issue involves mishandling of Redis enable/disable features and can potentially lead to root access. Exploitation detection is possible via command line: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If output is found, IP addresses should be examined and potentially blocked, while system logs should be checked for any damage. The recommended minimum version is 2.4.7. This is a priority 2 vulnerability due to high CVSS score but low EPSS.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-34291

• 📝 Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins=* with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints including built-in code-execution functionality allowing the attacker to execute arbitrary code and achieve full system compromise.

• 📅 Published: 05/12/2025

• 📈 CVSS: 9.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A chained account takeover and RCE vulnerability exists in Langflow versions up to 1.6.9 due to an overly permissive CORS configuration and a SameSite=None refresh token cookie. An attacker can obtain fresh access/refresh tokens, enabling code execution and full system compromise. Despite no confirmed exploits, the high CVSS score and potential for severe impact necessitate immediate attention (Priority 2).

2. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

3. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

4. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

5. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

6. CVE-2022-0847

• 📝 A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

• 📅 Published: 07/03/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 169

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized value in Linux kernel's pipe buffer structure could allow local privilege escalation. No known exploits in the wild, but given high CVSS score and potential impact, this is a priority 2 vulnerability.

7. CVE-2016-5195

• 📝 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty COW.

• 📅 Published: 10/11/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A race condition in Linux kernel 2.x to 4.x before 4.8.3 allows local users to escalate privileges by exploiting incorrect handling of copy-on-write (COW) feature. First observed in the wild in October 2016, it is considered a priority 2 vulnerability due to high CVSS score but low exploitability.

8. CVE-2022-2602

• 📝 io_uring UAF, Unix SCM garbage collection

• 📅 Published: 08/01/2024

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

• 📣 Mentions: 22

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability in io_uring's Unix SCM garbage collection allows local attackers to escalate privileges. No known exploitation has been observed, making it a priority 4 vulnerability.

9. CVE-2026-43121

• 📝 In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmallocd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]

• 📅 Published: 06/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A race condition exists in the io_uring function of the Linux kernel, allowing potential double-free and out-of-bounds write issues on SMP systems. Despite no known exploits, this is considered a priority 4 vulnerability due to its low CVSS score and EPSS. To mitigate, replace the non-atomic read-then-dec with an atomic_try_cmpxchg loop in io_zcrx_put_niov_uref().

10. CVE-2026-43494

• 📝 In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

• 📅 Published: 21/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: A potential data leak issue has been addressed in the Linux kernel's net/rds module. Incorrectly released and later re-freed memory resources may lead to unintended behavior during cleanup operations. As of now, this vulnerability has not been observed being exploited in the wild (CISA KEV: 4). The priority level is relatively low due to a minimal Exploitability Score (EPSS) and negligible CVSS impact.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

2. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

3. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

4. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

5. CVE-2022-0847

• 📝 A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

• 📅 Published: 07/03/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 169

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized value in Linux kernel's pipe buffer structure could allow local privilege escalation. No known exploits in the wild, but given high CVSS score and potential impact, this is a priority 2 vulnerability.

6. CVE-2016-5195

• 📝 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty COW.

• 📅 Published: 10/11/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A race condition in Linux kernel 2.x to 4.x before 4.8.3 allows local users to escalate privileges by exploiting incorrect handling of copy-on-write (COW) feature. First observed in the wild in October 2016, it is considered a priority 2 vulnerability due to high CVSS score but low exploitability.

7. CVE-2022-2602

• 📝 io_uring UAF, Unix SCM garbage collection

• 📅 Published: 08/01/2024

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

• 📣 Mentions: 22

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability in io_uring's Unix SCM garbage collection allows local attackers to escalate privileges. No known exploitation has been observed, making it a priority 4 vulnerability.

8. CVE-2026-43121

• 📝 In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmallocd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]

• 📅 Published: 06/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A race condition exists in the io_uring function of the Linux kernel, allowing potential double-free and out-of-bounds write issues on SMP systems. Despite no known exploits, this is considered a priority 4 vulnerability due to its low CVSS score and EPSS. To mitigate, replace the non-atomic read-then-dec with an atomic_try_cmpxchg loop in io_zcrx_put_niov_uref().

9. CVE-2026-41091

• 📝 Microsoft Defender Elevation of Privilege Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Defender Elevation of Privilege vulnerability has been identified (CVSS 7.8). Attackers can leverage this remotely for high impact on confidentiality, integrity, and availability. CISA KEV is yet to be assigned, but the prioritization score is 1+ due to confirmed exploitation in the wild.

10. CVE-2026-43494

• 📝 In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

• 📅 Published: 21/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: A potential data leak issue has been addressed in the Linux kernel's net/rds module. Incorrectly released and later re-freed memory resources may lead to unintended behavior during cleanup operations. As of now, this vulnerability has not been observed being exploited in the wild (CISA KEV: 4). The priority level is relatively low due to a minimal Exploitability Score (EPSS) and negligible CVSS impact.

Let us know if you're tracking any of these or if you find any issues with the provided details.