vulnerability

Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643)

March 30, 2026

A critical SQL injection vulnerability (CVE-2026-21643) in Fortinet FortiClient Endpoint Management Server (EMS), a management server for FortiClient endpoint agents on …

Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521)

March 28, 2026

A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active exploitation, the US …

CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation

March 27, 2026

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33017, a recently …

Critical NetScaler ADC, Gateway flaw may soon be exploited (CVE-2026-3055)

March 24, 2026

Citrix has fixed two vulnerabilities in NetScaler ADC and NetScaler Gateway, with the more serious flaw (CVE-2026-3055) potentially allowing attackers to extract active …

32% of top-exploited vulnerabilities are over a decade old

March 24, 2026

Exploitation timelines continued to compress in enterprise environments, with newly disclosed flaws reaching active use almost immediately and older weaknesses remaining …

Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992)

March 23, 2026

Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager. The …

Unpatched ScreenConnect servers open to attack (CVE-2026-3564)

March 20, 2026

ConnectWise has patched a critical vulnerability (CVE-2026-3564) that could enable attackers to hijack ScreenConnect sessions by abusing ASP.NET machine keys to forge trusted …

CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963)

March 19, 2026

CVE-2026-20963, a remote code execution (RCE) SharePoint vulnerability Microsoft fixed in January 2026, is being exploited by attackers. The confirmation comes from the US …

Millions of UK firms on alert after Companies House data exposure

March 17, 2026

Companies House, the UK’s official company registry, said its WebFiling service is back online after being shut down on Friday to fix a security issue that may have exposed …

Microsoft patches 80+ vulnerabilities, six flagged as “more likely” to be exploited

March 11, 2026

On March 2026 Patch Tuesday, Microsoft addressed 80+ vulnerabilities affecting its software and cloud services. Of these, two were publicly disclosed, but not actively …

Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities

March 5, 2026

Cisco has confirmed that two Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20128 and CVE-2026-20122) patched in late February 2025 are being exploited by attackers. The …

FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289)