Critical
Ransomware use CVE-2026-35273
Jun 12, 2026
Oracle PeopleSoft Enterprise PeopleTools — the platform under the PeopleSoft ERP (HR, finance) — has a missing-authentication-for-critical-function flaw (CWE-306). A remote, unauthenticated attacker can take over PeopleTools. CISA listed it as known-exploited (KEV) and confirmed ransomware use (CVSS 9.8 Critical, per NVD).
- Missing authentication for a critical function (CWE-306) in PeopleTools, the platform under PeopleSoft
- A remote, unauthenticated attacker can take over PeopleTools
- Listed in CISA KEV = exploitation confirmed; also confirmed used in ransomware
Read more
Critical
Ransomware use CVE-2026-50751
Jun 8, 2026
Check Point's Security Gateway products have an improper-authentication vulnerability in IKEv1 key exchange that lets an unauthenticated remote attacker bypass user authentication and establish a remote-access VPN connection without a valid user password. CISA listed it as known-exploited (KEV) (CVSS 9.3 Critical).
- IKEv1 authentication bypass (CWE-287) in Check Point Security Gateway
- An unauthenticated remote attacker establishes a remote-access VPN connection without a valid password
- Compromise of a perimeter VPN/firewall = a foothold for internal intrusion. CVSS 9.3 (Critical)
Read more
Critical
Ransomware use CVE-2026-48027
May 27, 2026
A malicious version of "Nx Console," a popular IDE extension for the Nx build system, was published; it fetches an obfuscated payload and harvests credentials (tokens and keys) from disk and memory. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 9.8 Critical).
- A tampered build of Nx Console (an IDE extension for the Nx build system) fetched and ran an obfuscated payload
- It stole credentials from disk and memory (GitHub/npm tokens, SSH keys, cloud credentials, etc.)
- Listed in CISA KEV = exploitation confirmed; ransomware use also confirmed (CVSS 9.8 Critical)
Read more
Critical
Ransomware use CVE-2026-45321
May 27, 2026
Malicious versions of the widely used TanStack (a family of React libraries) were published to the npm registry, distributing credential-stealing malware under a trusted publisher identity. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 9.6 Critical).
- Malicious versions of TanStack (popular React libraries) were published to npm
- A trusted publisher (maintainer identity) was abused to distribute credential-stealing malware
- Listed in CISA KEV = exploitation confirmed; ransomware use also confirmed (CVSS 9.6 Critical)
Read more
High
CVE-2026-45659
Jul 1, 2026
Microsoft SharePoint Server, the widely used document-collaboration platform, contains a deserialization-of-untrusted-data vulnerability that lets an authorized attacker execute code over the network. CISA added it to the KEV (Known Exploited Vulnerabilities) catalog on July 1, 2026, setting the remediation deadline just three days later, on July 4.
- Deserialization of untrusted data (CWE-502) in SharePoint Server — crafted data injected into the restore process can execute code remotely
- Requires authorization (login) — the classic post-intrusion pattern: a stolen account or existing foothold becomes full server takeover
- Microsoft's NVD-registered assessment: CVSS 8.8 (HIGH) — low privileges, no user interaction
Read more
Critical
CVE-2026-48558
Jun 29, 2026
SimpleHelp, a remote-support (remote-access) tool, fails to verify the cryptographic signature of identity tokens in its OIDC login flow. A remote, unauthenticated attacker can submit a forged token and obtain a fully authenticated technician session — potentially bypassing MFA. The NVD-registered score is CVSS 10.0 (CRITICAL). CISA added it to KEV on June 29, 2026.
- SimpleHelp (≤5.5.15 and 6.0 pre-releases) accepts OIDC identity tokens without verifying their cryptographic signature (CWE-347)
- A remote, unauthenticated attacker can forge a token and obtain a full technician session — the doorway to the managed endpoint fleet; MFA can be bypassed in some configurations
- NVD-registered score: CVSS 10.0 (CRITICAL) — the maximum
Read more
High
CVE-2026-20230
Jun 25, 2026
Cisco Unified Communications Manager (Unified CM / SME), the call-control heart of enterprise IP telephony, contains a server-side request forgery (SSRF) flaw. A remote, unauthenticated attacker can write files to the underlying OS, usable later to escalate to root. CISA added it to KEV on June 25, 2026, with remediation due three days later, on June 28.
- SSRF (CWE-918) in Cisco Unified CM / SME — the server is made to issue internal requests on the attacker's behalf
- A remote, unauthenticated attacker can write files to the underlying OS, usable later to escalate to root
- NVD assessment: CVSS 8.6 (HIGH)
Read more
Critical
CVE-2026-34910
Jun 23, 2026
An improper-input-validation flaw (CWE-20) in Ubiquiti UniFi OS. A network-adjacent attacker can conduct command injection (running arbitrary commands on the device). On June 23, 2026, CISA added three UniFi OS flaws at once; remediation due three days later. Official NVD score: CVSS 10.0 (CRITICAL).
- Improper input validation (CWE-20) in Ubiquiti UniFi OS — command injection runs arbitrary commands on the device
- Official NVD score: CVSS 10.0 (CRITICAL)
- On June 23, 2026, CISA added three UniFi OS flaws at once; deadline June 26 (3 days)
Read more
Critical
CVE-2026-34909
Jun 23, 2026
A path-traversal flaw (CWE-22) in Ubiquiti UniFi OS. A network-adjacent attacker can reach files on the underlying system that should be off-limits and manipulate them to access an internal account. On June 23, 2026, CISA added three UniFi OS flaws at once; remediation due three days later. Official NVD score: CVSS 10.0 (CRITICAL).
- Path traversal (CWE-22) in Ubiquiti UniFi OS — reaching off-limits underlying files, a foothold to internal account takeover
- Official NVD score: CVSS 10.0 (CRITICAL)
- On June 23, 2026, CISA added three UniFi OS flaws at once; deadline June 26 (3 days)
Read more
Critical
CVE-2026-34908
Jun 23, 2026
Ubiquiti UniFi OS, widely used networking software, contains an improper access control flaw (CWE-284). An attacker with network access can make unauthorized changes to the system. On June 23, 2026, CISA added three UniFi OS flaws at once (this one, a path traversal, and an input-validation issue), all due three days later, June 26. Official NVD score: CVSS 10.0 (CRITICAL).
- Improper access control (CWE-284) in Ubiquiti UniFi OS — network-adjacent attacker makes unauthorized changes
- Official NVD score: CVSS 10.0 (CRITICAL)
- On June 23, 2026, CISA added three UniFi OS flaws at once (this, CVE-2026-34909, CVE-2026-34910); deadline June 26 (3 days)
Read more
Critical
CVE-2026-20253
Jun 18, 2026
Splunk Enterprise, a log-analytics and monitoring platform, contains a missing authentication for a critical function (CWE-306). A bundled PostgreSQL sidecar service endpoint lacks authentication, letting a network-reachable, unauthenticated user create or truncate arbitrary files. CISA added it to the KEV on 2026-06-18, with a remediation due date of 2026-06-21 (3 days). The CVSS published on NVD is 9.8 (CRITICAL).
- Missing authentication for a critical function (CWE-306) in Splunk Enterprise — the PostgreSQL sidecar endpoint has no authentication.
- Unauthenticated, network-reachable creation/truncation of arbitrary files. The CVSS published on NVD is 9.8 (CRITICAL).
- Affected: 10.2 (below 10.2.4) and 10 (below 10.0.7); 9.4 and earlier are not affected. Mitigation: disable the affected service.
Read more
Medium
CVE-2026-20262
Jun 15, 2026
Cisco Catalyst SD-WAN Manager, a network-management product, contains a directory/path traversal flaw (CWE-22). An authenticated, remote attacker can create a file or overwrite any file on the system. The CVSS published on NVD is 6.5 (MEDIUM). CISA added it to the KEV on 2026-06-15, due 2026-06-29.
- Path traversal (CWE-22) in Cisco Catalyst SD-WAN Manager — an authenticated remote attacker can create files or overwrite any file.
- The CVSS published on NVD is 6.5 (MEDIUM; PR:L, I:H — high impact to integrity).
- The target is the command post centrally managing SD-WAN (software-defined WAN) — holding the core of communications.
Read more
Critical
CVE-2026-10520
Jun 11, 2026
Ivanti Sentry (formerly MobileIron Sentry), a mobile-device management gateway, contains an OS command injection flaw that lets a remote, unauthenticated attacker execute code as root. CISA listed it as known-exploited (KEV) (CVSS 10.0 Critical, per NVD).
- OS command injection (CWE-78) in Ivanti Sentry (formerly MobileIron Sentry; a mobile-management gateway)
- In an unmanaged state, a remote, unauthenticated attacker can execute code as root
- Listed in CISA KEV = exploitation confirmed; NVD base score is the maximum 10.0 Critical
Read more
High
CVE-2026-11645
Jun 9, 2026
Google's JavaScript engine "Chromium V8" has an out-of-bounds read and write vulnerability that could let a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page. It can affect multiple Chromium-based browsers, including Chrome, Edge, and Opera. CISA listed it as known-exploited (KEV) (CVSS 8.8 High).
- Out-of-bounds read/write (CWE-787 / CWE-125) in V8, the core Chromium JavaScript engine
- A crafted HTML page could lead to arbitrary code execution inside the sandbox
- Affects multiple Chromium-based browsers (Chrome, Edge, Opera) — a shared engine ripples widely
Read more
Medium
CVE-2026-7473
Jun 9, 2026
Arista EOS, the OS for Arista network switches, has an incomplete-comparison flaw in tunnel decapsulation: the switch can wrongly decapsulate and forward unexpected tunneled packets whose destination matches its configured decapsulation IP. CISA listed it as known-exploited (KEV) (CVSS 5.8 Medium, per NVD).
- Incomplete comparison (CWE-1023) during tunnel decapsulation in Arista EOS (switch OS)
- Unexpected tunneled packets destined to the configured decapsulation IP can be wrongly decapsulated and forwarded
- Can be abused to bypass network segmentation and slip past access controls
Read more
High
CVE-2026-20245
Jun 9, 2026
An output-escaping flaw in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) lets an authenticated local attacker run arbitrary commands as root by supplying a crafted file. CISA listed it as known-exploited (KEV) (CVSS 7.8 High, per NVD).
- Improper output encoding/escaping (CWE-116) in Cisco Catalyst SD-WAN Manager (formerly vManage)
- An authenticated local attacker can run arbitrary commands as root via a crafted file
- Compromise of the central network-management platform risks propagation to many downstream sites
Read more
High
CVE-2026-42271
Jun 8, 2026
BerriAI LiteLLM, an open-source LLM proxy that unifies many LLM providers, has a command-injection vulnerability. Any authenticated user — including holders of low-privilege internal-user keys — can run arbitrary commands on the host. CISA listed it as known-exploited (KEV) (CVSS 8.8 High).
- Command injection (CWE-78 / CWE-77) in BerriAI LiteLLM (a popular OSS LLM proxy)
- Any authenticated user, including low-privilege internal-user keys, can run arbitrary commands on the host
- Host takeover can lead to theft of managed API keys/tokens and further intrusion
Read more
High
CVE-2026-28318
Jun 5, 2026
SolarWinds Serv-U, a file-transfer server, has an uncontrolled-resource-consumption (DoS) flaw: without authentication, a crafted POST request using a deflate Content-Encoding header can crash the Serv-U service. CISA listed it as known-exploited (KEV) (CVSS 7.5 High, per NVD).
- Uncontrolled resource consumption (CWE-400) in SolarWinds Serv-U (a file-transfer server)
- Without authentication, a crafted deflate-encoded POST can crash the service (DoS)
- Impact is availability only (not data theft), but it can halt core file exchange
Read more
Exploited
Ransomware use CVE-2026-12569
Jun 25, 2026
PTC Windchill / FlexPLM, product lifecycle management (PLM) platforms for manufacturing, contain an improper-input-validation flaw (CWE-20/CWE-502). An unauthenticated remote attacker can execute arbitrary code just by sending a crafted request. The official NVD score is CVSS 9.8 (CRITICAL). CISA added it to KEV on June 25, 2026, with remediation due three days later, June 28.
- Improper input validation (CWE-20/CWE-502) in manufacturing PLM platforms PTC Windchill / FlexPLM
- No authentication, no user interaction, remote code execution — the dangerous "pre-auth RCE"
- Official NVD score: CVSS 9.8 (CRITICAL)
Read more
Exploited
Ransomware use CVE-2026-0257
May 29, 2026
An authentication-bypass vulnerability in Palo Alto Networks' firewall OS, PAN-OS, lets an attacker bypass security restrictions and establish an unauthorized VPN connection. CISA listed it as known-exploited (KEV) (CVSS 9.1 Critical).
- Authentication-bypass vulnerability in PAN-OS (the OS for Palo Alto firewall products)
- An attacker can bypass security restrictions and establish an unauthorized VPN connection
- Compromise of a perimeter device = a foothold for internal intrusion. Listed in CISA KEV (CVSS 9.1 Critical)
Read more
Critical
Ransomware use CVE-2026-41940
Apr 30, 2026
cPanel & WHM and WP2, a widely used web-hosting control panel, have a missing-authentication flaw in the login flow that lets an unauthenticated remote attacker gain unauthorized access to the control panel. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 9.8 Critical).
- Missing authentication (CWE-306) in the login flow of cPanel & WHM / WP2
- An unauthenticated remote attacker gains unauthorized access to the control panel
- cPanel/WHM is the most widely used hosting control panel = one compromise ripples to many sites
Read more
High
Ransomware use CVE-2024-1708
Apr 28, 2026
ConnectWise ScreenConnect, a remote-management (RMM) / remote-support tool, has a path-traversal vulnerability that could let an attacker execute remote code or directly impact confidential data and critical systems. CISA listed it as known-exploited (KEV) with confirmed ransomware use (CVSS 8.4 High).
- Path traversal (CWE-22) in ConnectWise ScreenConnect (an RMM tool that remotely manages many endpoints)
- Can lead to remote code execution (RCE) or direct impact on confidential data and critical systems
- RMM compromise = a "lever" to push malware to many managed endpoints at once
Read more
Critical
Ransomware use CVE-2024-57726
Apr 24, 2026
The remote support/RMM tool SimpleHelp has a missing-authorization flaw that lets a low-privilege technician create an overly privileged API key and escalate to server administrator. It is listed in CISA's Known Exploited Vulnerabilities catalog and has been used in ransomware campaigns.
- Affects SimpleHelp's remote support / RMM product SimpleHelp (CVE-2024-57726).
- The weakness type is Missing Authorization.
- A low-privilege technician can create an overly privileged API key and escalate to server administrator.
Read more
High
Ransomware use CVE-2023-27351
Apr 20, 2026
PaperCut NG/MF, a print management product, contains a flaw that may allow authentication (the identity-verification step) to be bypassed, potentially letting an attacker reach administrative functions without a valid login.
- Affects PaperCut NG/MF print management software through an improper authentication flaw that may allow the identity check to be bypassed.
- The KEV record states authentication may be bypassed via the SecurityRequestFilter class, potentially leading to unauthorized access to administrative functions.
- Listed by CISA in its Known Exploited Vulnerabilities (KEV) catalog (added 2026-04-20, remediation due 2026-05-04).
Read more
High
Ransomware use CVE-2024-27199
Apr 20, 2026
JetBrains TeamCity, a CI/CD server that automates building and distributing software, contains a relative path traversal flaw that can lead to limited admin actions, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog.
- Affected product is JetBrains TeamCity, a CI/CD server that automates building and distributing software.
- The flaw is relative path traversal (reaching paths that were not meant to be accessible) and can lead to limited admin actions.
- CISA added it to the KEV catalog on 2026-04-20, with a remediation due date of 2026-05-04.
Read more
High
Ransomware use CVE-2023-21529
Apr 13, 2026
Microsoft Exchange Server, an email backbone, contains a deserialization of untrusted data flaw (CWE-502) that lets an authenticated attacker run arbitrary code remotely. It has been confirmed used in ransomware attacks, and CISA added it to the KEV on 2026-04-13. The CVSS published on NVD is 8.8 (HIGH).
- Deserialization (CWE-502) in Microsoft Exchange Server — reconstructing crafted data leads to remote arbitrary code execution.
- The vector is PR:L (some privilege required), but stepping-stone attacks from stolen low-privilege accounts are standard, so "authenticated only" is no comfort.
- Confirmed use in ransomware attacks (per CISA's record).
Read more
High
CVE-2022-0492
Jun 2, 2026
An improper-authentication vulnerability in the Linux kernel cgroups v1 "release_agent" feature leads to privilege escalation. Depending on configuration it can be abused for container escape. Disclosed in 2022, but CISA listed it as known-exploited (KEV) in 2026 (CVSS 7.8 High).
- Missing privilege check in the cgroups v1 "release_agent" feature (CWE-287 / CWE-862)
- Local privilege escalation; with weak configuration, exploitable for container-to-host escape
- Disclosed in 2022 but entered KEV in 2026 = an old known vulnerability still being exploited
Read more
High
CVE-2025-48595
Jun 2, 2026
An integer-overflow vulnerability in Android's core "Framework" component leads, via code execution, to local privilege escalation. Fixed in the June 2026 Android security update. CISA listed it as known-exploited (KEV) (CVSS 8.4 High).
- Integer overflow (CWE-190) in the Android Framework (the OS foundation layer)
- Leads to local privilege escalation via code execution
- Fixed in the June 2026 Android security bulletin. Listed in CISA KEV (CVSS 8.4 High)
Read more
High
CVE-2024-21182
Jun 1, 2026
In Oracle WebLogic Server, an unauthenticated attacker with network access via the T3/IIOP protocols can compromise the server, leading to unauthorized access to critical data or to all accessible data. CISA listed it as known-exploited (KEV) (CVSS 7.5 High).
- WebLogic Server can be compromised via T3/IIOP without authentication
- Success leads to unauthorized access to critical data (in some cases all data)
- Fixed in Oracle's July 2024 Critical Patch Update. Listed in CISA KEV (CVSS 7.5 High)
Read more
High
CVE-2025-34291
May 21, 2026
Langflow, a popular tool for visually building LLM/AI workflows, has an origin-validation error (an overly permissive CORS configuration combined with a refresh-token cookie set to SameSite=None) that lets a malicious webpage make credentialed cross-origin requests, steal tokens, and ultimately achieve code execution and full system compromise. CISA listed it as known-exploited (KEV) (CVSS 8.8 High).
- Origin-validation error (CWE-346) in Langflow (a popular OSS tool for building LLM/AI workflows in a GUI)
- Permissive CORS + a SameSite=None refresh-token cookie let a malicious page steal tokens
- Stolen tokens reach authenticated endpoints → arbitrary code execution / full system compromise
Read more
Medium
CVE-2026-34926
May 21, 2026
Trend Micro Apex One (on-premise), an endpoint-protection product, has a directory-traversal vulnerability that could let a pre-authenticated local attacker modify a key table on the server to inject malicious code and deploy it to agents. CISA listed it as known-exploited (KEV) (CVSS 6.7 Medium).
- Directory traversal (CWE-23) in Trend Micro Apex One (on-premise EPP)
- A pre-authenticated local attacker modifies a key table → risk of deploying malicious code to agents
- CVSS is 6.7 (Medium; local/high complexity), but impact is large via management-server-to-endpoints spread
Read more
Critical
CVE-2026-48172
May 26, 2026
The cPanel plugin for the LiteSpeed web server has a privilege-escalation flaw: any cPanel user account can run arbitrary scripts as root. CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical, per NVD).
- Privilege escalation (CWE-266) in the LiteSpeed cPanel Plugin (LiteSpeed × cPanel integration)
- Any cPanel user account can execute arbitrary scripts with root privileges
- In shared hosting, one user's compromise leads directly to whole-server compromise
Read more
Critical
CVE-2026-9082
May 22, 2026
Drupal, a widely used open-source CMS, has a SQL injection vulnerability in its core via the database abstraction API; specially crafted requests can lead to privilege escalation and remote code execution (RCE). CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical).
- SQL injection (CWE-89) in Drupal Core via the database abstraction API
- Can lead to privilege escalation and remote code execution (RCE)
- A flaw in CMS core functionality = widely deployed, broad blast radius
Read more
Critical
CVE-2008-4250
May 20, 2026
Windows Server Service contains a buffer overflow (a flaw where data is written beyond the memory set aside for it), allowing a remote attacker to run arbitrary code without authentication.
- A buffer overflow in the Windows Server Service; the official NVD CVSS score is 9.8 (CRITICAL), the highest tier.
- No authentication (login) and no user interaction are required, allowing remote arbitrary code execution.
- Known as Microsoft's MS08-067 patch and famous for being exploited by the globally widespread Conficker worm.
Read more
High
CVE-2009-3459
May 20, 2026
A vulnerability in Adobe Acrobat and Reader (CVE-2009-3459) allows a crafted PDF to corrupt memory and potentially let a remote attacker run arbitrary code when the file is opened. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-05-20.
- Opening a crafted PDF can corrupt memory and may let a remote attacker execute arbitrary code (CVE-2009-3459).
- Exploitation requires the user to open the file (UI:R in CVSS); routinely opened PDFs can be the entry point.
- Official NVD CVSS is 8.8 (HIGH; CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Read more
High
CVE-2010-0249
May 20, 2026
A use-after-free vulnerability in Microsoft Internet Explorer that can let a remote attacker run arbitrary code when a user opens a crafted page. CVSS 8.8 (High).
- A use-after-free flaw that can lead to remote code execution (CVSS 8.8 / High).
- Exploitation is triggered when a user opens a crafted web page (UI:R).
- Famous for its use in the 2009–2010 Operation Aurora targeted attacks.
Read more
High
CVE-2026-42897
May 15, 2026
Microsoft Exchange Server, a mail server, has a cross-site scripting (XSS) vulnerability where, during web page generation in Outlook Web Access (OWA) and under certain interaction conditions, arbitrary JavaScript can be executed in the browser context. CISA listed it as known-exploited (KEV) (CVSS 8.1 High).
- Cross-site scripting (CWE-79) in Microsoft Exchange Server's Outlook Web Access (OWA)
- Under certain conditions, arbitrary JavaScript can run in the browser context
- Can lead to session hijacking, email theft, and impersonation
Read more
Critical
CVE-2026-20182
May 14, 2026
Cisco's SD-WAN products, Catalyst SD-WAN Controller and Manager, have an authentication-bypass vulnerability that lets an unauthenticated remote attacker bypass authentication and obtain administrative privileges. CVSS is a perfect 10.0 (Critical). CISA listed it as known-exploited (KEV) and issued Emergency Directive 26-03.
- Authentication bypass (CWE-287) in Cisco Catalyst SD-WAN Controller/Manager
- An unauthenticated remote attacker obtains admin privileges = seizing the network control center
- CVSS is a perfect 10.0 (Critical). Listed in CISA KEV = exploitation confirmed
Read more
Critical
CVE-2026-42208
May 8, 2026
BerriAI LiteLLM, an open-source LLM proxy/gateway that unifies many LLM providers, has a SQL injection vulnerability. An attacker can read — and potentially modify — the proxy's database, leading to unauthorized access to the proxy and the credentials (API keys, etc.) it manages. CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical).
- SQL injection (CWE-89) in BerriAI LiteLLM (a popular OSS LLM proxy/gateway)
- An attacker can read/modify the proxy's DB, reaching the proxy and the credentials it manages
- An LLM proxy centrally manages many API keys/tokens = the "keyring" is exposed at once
Read more
High
CVE-2026-6973
May 7, 2026
Ivanti Endpoint Manager Mobile (EPMM), a mobile-device management product, has an improper-input-validation vulnerability that lets a remotely authenticated user with administrative access achieve remote code execution (RCE). CISA listed it as known-exploited (KEV) (CVSS 7.2 High).
- Improper input validation (CWE-20) in Ivanti EPMM (mobile-device management; formerly MobileIron)
- A remotely authenticated user with admin access can achieve remote code execution (RCE)
- Requires auth/admin so CVSS is 7.2 (High), but impact is large given it is a management platform
Read more
Critical
CVE-2026-0300
May 6, 2026
PAN-OS, the OS for Palo Alto Networks firewalls, has an out-of-bounds write flaw in the User-ID Authentication Portal (Captive Portal). A remote, unauthenticated attacker can execute code as root on PA-Series and VM-Series firewalls via crafted packets. CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical, per NVD).
- Out-of-bounds write in the User-ID Authentication Portal (Captive Portal) of PAN-OS
- A remote, unauthenticated attacker can run code as root on PA/VM-Series via crafted packets
- Listed in CISA KEV = exploitation confirmed; NVD base score near-maximum 9.8 Critical
Read more
High
CVE-2026-31431
May 1, 2026
The Linux kernel — the core of the Linux OS — has an incorrect-resource-transfer-between-spheres flaw (CWE-669). A local attacker already on the machine can achieve privilege escalation (gaining higher privileges). CISA listed it as known-exploited (KEV) (CVSS 7.8 High, per NVD).
- Privilege escalation via incorrect resource transfer between spheres (CWE-669) in the Linux kernel
- Local escalation (attacker already has some execution), not a standalone remote intrusion
- Listed in CISA KEV = exploitation confirmed; NVD base score 7.8 High
Read more
Medium
CVE-2026-32202
Apr 28, 2026
Microsoft's Windows Shell contains a protection mechanism failure (a flaw where a safeguard that should work does not function as intended) that can be abused for network-based spoofing (impersonation). CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog of flaws confirmed to be exploited in the wild.
- Affects Microsoft Windows (Windows Shell); the weakness type is a protection mechanism failure (a safeguard that should work does not function correctly).
- An unauthorized attacker could perform spoofing (impersonation or deceptive display) over a network.
- NVD rates the severity at CVSS 3.1 4.3 (Medium); exploitation requires user interaction (UI:R).
Read more
Medium
CVE-2026-20122
Apr 20, 2026
A vulnerability stemming from improper file handling in the API interface has been reported in Cisco Catalyst SD-WAN Manager (formerly vManage). CISA issued Emergency Directive ED 26-03 with an extremely short remediation deadline.
- Affected product is Cisco Catalyst SD-WAN Manager (formerly vManage), a control point that centrally manages networks across many sites.
- The vulnerability is an incorrect use of privileged APIs; uploading a malicious file may lead to arbitrary file overwrite and acquisition of vmanage user privileges.
- The official NVD CVSS score is 5.4 (Medium), yet CISA added it to KEV and issued Emergency Directive ED 26-03.
Read more
High
CVE-2026-34197
Apr 16, 2026
A vulnerability stemming from insufficient validation of input has been identified in Apache ActiveMQ, an open-source messaging platform. It may lead to code injection (the insertion of unauthorized commands).
- Affects Apache's open-source message-relay platform ActiveMQ (CVE-2026-34197).
- The flaw type is improper input validation, which may lead to code injection (insertion of unauthorized commands).
- CISA added it to the KEV (Known Exploited Vulnerabilities) catalog on April 16, 2026.
Read more
Medium
CVE-2026-32201
Apr 14, 2026
Microsoft SharePoint Server, an enterprise information-sharing platform, contains an improper input validation flaw (CWE-20). An attacker may perform spoofing over a network. NVD's Primary assessment is CVSS 6.5 (MEDIUM). CISA added it to the KEV on 2026-04-14, due 2026-04-28.
- Improper input validation (CWE-20) in Microsoft SharePoint Server — risk of spoofing over a network.
- NVD's Primary assessment is CVSS 6.5 (MEDIUM; C:L/I:L — limited impact to confidentiality/integrity).
- SharePoint is an enterprise document-sharing and intranet-portal platform where sensitive information gathers.
Read more
Critical
CVE-2026-21643
Apr 13, 2026
Fortinet FortiClient EMS, an endpoint-management server, contains a SQL injection flaw (CWE-89). Via specially crafted HTTP requests, an unauthenticated attacker may execute unauthorized code or commands. The CVSS published on NVD is 9.8 (CRITICAL). CISA added it to the KEV on 2026-04-13, due 2026-04-16 (3 days).
- SQL injection (CWE-89) in Fortinet FortiClient EMS — crafted HTTP requests may let an unauthenticated attacker execute unauthorized code/commands.
- The CVSS published on NVD is 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) — unauthenticated, remote, no user interaction.
- The target is an endpoint-management server (EMS) — the command post centrally managing many endpoints' security.
Read more
Critical
CVE-2026-1340
Apr 8, 2026
Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core), a mobile-device-management (MDM) platform, contains a code injection flaw (CWE-94) that lets an unauthenticated attacker run arbitrary code remotely. CISA added it to the KEV on 2026-04-08, due 2026-04-11 (3 days). The CVSS published on NVD is 9.8 (CRITICAL).
- Code injection (CWE-94) in Ivanti EPMM (formerly MobileIron Core) — unauthenticated remote code execution.
- The vector is PR:N and UI:N — no privilege and no user interaction required. The CVSS published on NVD is 9.8 (CRITICAL).
- An MDM platform is the distribution source to the device fleet — a single breach can spread to the whole company's mobile estate.
Read more
Critical
CVE-2026-3055
Mar 30, 2026
Citrix NetScaler ADC/Gateway, an edge device, contains an out-of-bounds read flaw (CWE-125). When configured as a SAML IDP (the issuer of authentication), a memory overread occurs and internal memory contents can leak. CISA added it to the KEV on 2026-03-30, due 2026-04-02 (3 days). NVD's official (Primary) assessment is CVSS 9.8 (CRITICAL).
- Out-of-bounds read (CWE-125) in Citrix NetScaler ADC/Gateway — a memory overread when configured as a SAML IDP can leak internal contents.
- NVD's Primary assessment is CVSS 9.8 (CRITICAL); the assigning source's CVSS 4.0 assessment is 9.3.
- A memory leak on an edge device can lead directly to session hijacking (the same pattern as CitrixBleed).
Read more
Critical
CVE-2025-53521
Mar 27, 2026
F5 BIG-IP (the APM module), an edge device handling application delivery and access control, contains a stack-based buffer overflow flaw (CWE-121). An attacker may achieve remote code execution. The CVSS published on NVD is 9.8 (CRITICAL). CISA added it to the KEV on 2026-03-27, due 2026-03-30 (3 days).
- Stack-based buffer overflow (CWE-121) in F5 BIG-IP (APM module) — possible remote arbitrary code execution.
- The CVSS published on NVD is 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H).
- BIG-IP is an edge device handling load balancing, application delivery, and VPN — first to receive outside access.
Read more
