Topic
17 posts tagged “Vulnerability”.
Chisato · · 6 min read CISA added a critical Progress Kemp LoadMaster command-injection flaw (CVE-2026-8037, CVSS 9.6) to its KEV catalog after active exploitation. What to do.
Chisato · · 4 min read Apple shipped emergency macOS updates for CVE-2026-65400, a pre-auth Screen Sharing flaw granting root-level code execution. Affected versions and how to respond.
Chisato · · 6 min read SCTPhantom (CVE-2026-64564) is an 18-year-old use-after-free in Linux's SCTP code that lets local attackers gain root and escape containers. Patch details.
Chisato · · 6 min read CVE-2026-66066 is a CVSS 9.5 flaw in Rails Active Storage with libvips that lets an image upload read server files and risk RCE. What's affected and how to patch.
Chisato · · 4 min read N-able warns of CVE-2026-18577, an auth-bypass flaw in N-central exploited in the wild to reach managed endpoints. CISA set a federal patch deadline.
Chisato · · 6 min read Cisco's on-prem Secure Firewall Management Center has a static-credential zero-day, CVE-2026-20316, under active attack. CISA set an August 1 patch deadline.
Chisato · · 5 min read A CVSS 10.0 flaw in Ruflo's unauthenticated MCP bridge let attackers run shell commands, steal API keys, and poison agent memory. Patch is in 3.16.3.
Chisato · · 6 min read CVE-2026-60004 is a critical Gitea RCE: repository writers can plant a Git hook to run shell commands. CVSS 9.8, public PoC — upgrade to 1.27.1 now.
Chisato · · 6 min read JetBrains patched CVE-2026-63077, an unauthenticated RCE affecting all TeamCity On-Premises versions. Why a CI/CD server is a supply-chain crown jewel.
Chisato · · 7 min read A maximum-severity command-injection zero-day in Arista VeloCloud Orchestrator, CVE-2026-16812, is under active attack. Who's exposed and how to patch.
Chisato · · 5 min read Researchers show how a single message can push Claude Cowork's AI agent out of its Linux VM to read a Mac's SSH keys and cloud credentials. The SharedRoot chain, explained.
Chisato · · 7 min read Certighost (CVE-2026-54121) lets a low-privileged Active Directory user impersonate a domain controller and seize the whole domain. How it works and the fix.
Chisato · · 5 min read Zoom patched CVE-2026-53412, a CVSS 9.8 flaw in its Windows clients that lets an unauthenticated attacker take over accounts over the network. Update now.
Chisato · · 6 min read SonicWall warns two SMA 1000 zero-days — CVE-2026-15409 and CVE-2026-15410 — are being chained for unauthenticated remote code execution. Patch now.
Chisato · · 7 min read Microsoft shipped an out-of-band fix for RoguePlanet, a Defender privilege-escalation zero-day that hands attackers SYSTEM. What it is and how to check you're patched.
Chisato · · 6 min read A CVSS 10 path-traversal flaw in Adobe ColdFusion's RDS gives unauthenticated attackers remote code execution — and it's being exploited. What to do now.
Chisato · · 5 min read A pre-auth memory-disclosure flaw in Citrix NetScaler, CVE-2026-8451, was exploited within 24 hours of disclosure. How it leaks session cookies and what to do now.
