Topic
31 posts tagged “Vulnerability”.
Chisato · · 5 min read CVE-2026-86218 is a CVSS 10.0 unauthenticated RCE in N-able N-central, exploited in the wild. CISA set a federal patch deadline of September 11.
Chisato · · 6 min read CISA added seven exploited flaws to its KEV catalog on Sept. 2, and three target AI infrastructure — LiteLLM, Kestra, and Starlette. What to patch and why it matters.
Chisato · · 6 min read Cisco patched CVE-2026-20212, a CVSS 9.8 flaw letting unauthenticated attackers run code as root on Nexus 9000 switches. Affected models, ports, and fixes.
Chisato · · 5 min read SonicWall says two SMA 1000 zero-days — a CVSS 10.0 SSRF and an OS command-injection flaw — are being chained in active attacks. CISA set a Sept 5 patch deadline.
Chisato · · 4 min read Insecure deserialization lets attackers turn a trusted object format into remote code execution. How the attack works and how to prevent it.
Chisato · · 5 min read ServiceNow fixed three CVSS 10.0 flaws in its Now and AI Platforms that let unauthenticated attackers run code and SQL injection. What to do now.
Chisato · · 6 min read CISA added a maximum-severity Oracle HTTP Server and WebLogic flaw, CVE-2026-21962 (CVSS 10.0), to its KEV catalog, citing active exploitation. What to know.
Chisato · · 4 min read Privilege escalation is when an attacker gains higher-level access than they were granted — vertically to admin rights, or horizontally to a peer account.
Chisato · · 6 min read A critical CVSS 9.4 code-injection flaw in GitLab's GraphQL API is under active attack, letting unauthenticated users delete public projects. Patch now.
Chisato · · 5 min read A critical CVSS 9.4 flaw in NASA/JPL's open-source AIT-GUI console let unauthenticated attackers send commands to spacecraft. What's affected and how to fix it.
Chisato · · 6 min read CISA added Ray's CVE-2025-62593 to its exploited-vulnerabilities catalog. The browser-based RCE bug is tied to RondoDox and ShadowRay 2.0 GPU botnet attacks.
Chisato · · 7 min read CVE-2026-20349 lets an unauthenticated attacker crash Cisco ASA and FTD firewalls with one HTTP request. It's exploited in the wild; CISA set a deadline.
Chisato · · 6 min read Researchers decoded 315,320 encrypted AI reasoning blocks from OpenAI, Anthropic and Google, recovering credentials and PII. How the reasoning-trace flaw works.
Chisato · · 5 min read A CVSS 9.8 authentication bug lets attackers log in to Fortinet FortiWeb with random credentials. It's part of a batch of Fortinet auth fixes. What to do.
Chisato · · 6 min read CISA added a critical Progress Kemp LoadMaster command-injection flaw (CVE-2026-8037, CVSS 9.6) to its KEV catalog after active exploitation. What to do.
Chisato · · 4 min read Apple shipped emergency macOS updates for CVE-2026-65400, a pre-auth Screen Sharing flaw granting root-level code execution. Affected versions and how to respond.
Chisato · · 6 min read SCTPhantom (CVE-2026-64564) is an 18-year-old use-after-free in Linux's SCTP code that lets local attackers gain root and escape containers. Patch details.
Chisato · · 6 min read CVE-2026-66066 is a CVSS 9.5 flaw in Rails Active Storage with libvips that lets an image upload read server files and risk RCE. What's affected and how to patch.
Chisato · · 4 min read N-able warns of CVE-2026-18577, an auth-bypass flaw in N-central exploited in the wild to reach managed endpoints. CISA set a federal patch deadline.
Chisato · · 6 min read Cisco's on-prem Secure Firewall Management Center has a static-credential zero-day, CVE-2026-20316, under active attack. CISA set an August 1 patch deadline.
Chisato · · 5 min read A CVSS 10.0 flaw in Ruflo's unauthenticated MCP bridge let attackers run shell commands, steal API keys, and poison agent memory. Patch is in 3.16.3.
Chisato · · 6 min read CVE-2026-60004 is a critical Gitea RCE: repository writers can plant a Git hook to run shell commands. CVSS 9.8, public PoC — upgrade to 1.27.1 now.
Chisato · · 6 min read JetBrains patched CVE-2026-63077, an unauthenticated RCE affecting all TeamCity On-Premises versions. Why a CI/CD server is a supply-chain crown jewel.
Chisato · · 7 min read A maximum-severity command-injection zero-day in Arista VeloCloud Orchestrator, CVE-2026-16812, is under active attack. Who's exposed and how to patch.
Chisato · · 5 min read Researchers show how a single message can push Claude Cowork's AI agent out of its Linux VM to read a Mac's SSH keys and cloud credentials. The SharedRoot chain, explained.
Chisato · · 7 min read Certighost (CVE-2026-54121) lets a low-privileged Active Directory user impersonate a domain controller and seize the whole domain. How it works and the fix.
Chisato · · 5 min read Zoom patched CVE-2026-53412, a CVSS 9.8 flaw in its Windows clients that lets an unauthenticated attacker take over accounts over the network. Update now.
Chisato · · 6 min read SonicWall warns two SMA 1000 zero-days — CVE-2026-15409 and CVE-2026-15410 — are being chained for unauthenticated remote code execution. Patch now.
Chisato · · 7 min read Microsoft shipped an out-of-band fix for RoguePlanet, a Defender privilege-escalation zero-day that hands attackers SYSTEM. What it is and how to check you're patched.
Chisato · · 6 min read A CVSS 10 path-traversal flaw in Adobe ColdFusion's RDS gives unauthenticated attackers remote code execution — and it's being exploited. What to do now.
Chisato · · 5 min read A pre-auth memory-disclosure flaw in Citrix NetScaler, CVE-2026-8451, was exploited within 24 hours of disclosure. How it leaks session cookies and what to do now.
