CVE

Brotli bug reaches far beyond Node.js (CVE-2026-111497)

October 27, 2026

A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as …

PHP2Shell: Critical PHP vulnerabilities patched, update now!

October 21, 2026

The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers …

CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products

October 15, 2026

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a …

Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)

October 14, 2026

In another record-breaking Patch Tuesday, Microsoft has squashed over 1,400 security bugs, including a Mark of the Web bypass vulnerability (CVE-2026-96951) exploited by …

GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)

October 13, 2026

GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers …

High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring

October 9, 2026

Hundreds of internet-exposed graphics processing unit (GPU) servers were open to a high-severity flaw in NVIDIA’s DCGM Exporter (CVE-2026-47483) that lets unauthenticated …

Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)

October 7, 2026

One day after Atlassian released patches fixing a critical arbitrary file access vulnerability (CVE-2026-21589) in its self-managed Data Center products, and a few hours after …

Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)

October 6, 2026

Attackers who know where to look can read files from Atlassian Data Center installations without logging in, the company has warned. About CVE-2026-21589 CVE-2026-21589, a …

The vulnerabilities AI finds are the ones attackers want

October 1, 2026

Attackers exploited a flaw found by an AI research agent within four days of its public disclosure, and they are exploiting more vulnerabilities overall, according to new …

Ubuntu kernel CVE fixes are moving to a weekly release schedule

September 24, 2026

Ubuntu kernels will ship every week under a new release schedule from Canonical, which is merging its four-week cycle for regular Stable Release Updates (SRUs) and its …

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

September 23, 2026

Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, …

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)