InYourGeek — Security advisories

Microsoft.WindowsDesktop.App.Runtime.win-x64 — Unsafe deserialisation → 10.0.10

Tue, 08 Sep 2026 00:00:00 GMT

An unsafe deserialisation flaw affects the NuGet package Microsoft.WindowsDesktop.App.Runtime.win-x64. Affected versions: >= 10.0.0, <= 10.0.9. Fixed from version 10.0.10. CVSS score 7.8.

nltk — Path traversal → 3.10.2

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the PyPI package nltk. Affected versions: >= 3.10.0, < 3.10.2. Fixed from version 3.10.2. CVSS score 7.5.

nltk — Path traversal → 3.10.0

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the PyPI package nltk. Affected versions: <= 3.9.4. Fixed from version 3.10.0. CVSS score 5.9.

Microsoft.Native.Quic.MsQuic.OpenSSL — Remote code execution → 2.5.10

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the NuGet package Microsoft.Native.Quic.MsQuic.OpenSSL. Affected versions: >= 2.5.3, < 2.5.10. Fixed from version 2.5.10. CVSS score 9.8.

liquidjs — Denial of service → 10.27.2

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the npm package liquidjs. Affected versions: <= 10.27.1. Fixed from version 10.27.2. CVSS score 7.5.

nltk — Path traversal → 3.9.4

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the PyPI package nltk. Affected versions: <= 3.9.3. Fixed from version 3.9.4. CVSS score 6.2.

github.com/siyuan-note/siyuan/kernel — Authentication bypass → 0.0.0-20260726020813-a25c2dd06aae

Tue, 08 Sep 2026 00:00:00 GMT

An authentication bypass flaw affects the Go package github.com/siyuan-note/siyuan/kernel. Affected versions: < 0.0.0-20260726020813-a25c2dd06aae. Fixed from version 0.0.0-20260726020813-a25c2dd06aae. CVSS score 8.6.

github.com/semaphoreui/semaphore — Remote code execution → 0.0.0-20260704181911-7e8a9434bd81

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the Go package github.com/semaphoreui/semaphore. Affected versions: < 0.0.0-20260704181911-7e8a9434bd81. Fixed from version 0.0.0-20260704181911-7e8a9434bd81. CVSS score 9.9.

io.netty:netty-handler — Other → 4.2.17.Final

Tue, 08 Sep 2026 00:00:00 GMT

A security flaw affects the Maven package io.netty:netty-handler. Affected versions: >= 4.2.0.Final, <= 4.2.16.Final. Fixed from version 4.2.17.Final.

next — Path traversal → 15.5.24

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the npm package next. Affected versions: >= 13.4.0, < 15.5.24. Fixed from version 15.5.24. CVSS score 9.

[EXPLOITED] Adobe Commerce and Magento — Remote code execution

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects Adobe Commerce and Magento. Apply the vendor’s patch. It is being actively exploited: patch now.

multer — Denial of service → 2.3.0

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the npm package multer. Affected versions: = 2.2.0. Fixed from version 2.3.0. CVSS score 7.5.

multer — Denial of service → 2.3.0

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the npm package multer. Affected versions: < 2.3.0. Fixed from version 2.3.0. CVSS score 7.5.

cakephp/cakephp — Injection → 5.3.7

Tue, 08 Sep 2026 00:00:00 GMT

An injection flaw affects the Composer package cakephp/cakephp. Affected versions: >= 5.3.0, < 5.3.7. Fixed from version 5.3.7.

GitPython — Path traversal → 3.1.59

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the PyPI package GitPython. Affected versions: <= 3.1.58. Fixed from version 3.1.59. CVSS score 8.4.

GitPython — Remote code execution → 3.1.59

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the PyPI package GitPython. Affected versions: <= 3.1.58. Fixed from version 3.1.59. CVSS score 9.8.

GitPython — Path traversal → 3.1.59

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the PyPI package GitPython. Affected versions: <= 3.1.58. Fixed from version 3.1.59. CVSS score 7.5.

nltk — Unsafe deserialisation → 3.10.0

Tue, 08 Sep 2026 00:00:00 GMT

An unsafe deserialisation flaw affects the PyPI package nltk. Affected versions: <= 3.9.4. Fixed from version 3.10.0.

nltk — Unsafe deserialisation → 3.10.3

Tue, 08 Sep 2026 00:00:00 GMT

An unsafe deserialisation flaw affects the PyPI package nltk. Affected versions: <= 3.10.2. Fixed from version 3.10.3.

nltk — Denial of service → 3.10.0

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the PyPI package nltk. Affected versions: <= 3.9.4. Fixed from version 3.10.0. CVSS score 7.5.

mongodb/mongodb — Injection → 1.21.4

Tue, 08 Sep 2026 00:00:00 GMT

An injection flaw affects the Composer package mongodb/mongodb. Affected versions: < 1.21.4. Fixed from version 1.21.4. CVSS score 8.1.

[EXPLOITED] Microsoft Windows — Path traversal

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects Microsoft Windows. Apply the vendor’s patch. It is being actively exploited: patch now.

multer — Denial of service → 2.3.0

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the npm package multer. Affected versions: < 2.3.0. Fixed from version 2.3.0. CVSS score 7.5.

composer/composer — Remote code execution → 2.10.3

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the Composer package composer/composer. Affected versions: >= 2.3.0, < 2.10.3. Fixed from version 2.10.3.

svgo — Cross-site scripting → 2.8.4

Tue, 08 Sep 2026 00:00:00 GMT

A cross-site scripting flaw affects the npm package svgo. Affected versions: >= 1.0.0, < 2.8.4. Fixed from version 2.8.4. CVSS score 8.2.

predis/predis — Remote code execution → 3.3.0

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the Composer package predis/predis. Affected versions: >= 3.0.0-RC1, < 3.3.0. Fixed from version 3.3.0. CVSS score 9.8.

maatwebsite/excel — Path traversal → 3.1.70

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the Composer package maatwebsite/excel. Affected versions: >= 3.1.8, < 3.1.70. Fixed from version 3.1.70. CVSS score 7.5.

js-yaml — Denial of service → 4.3.2

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the npm package js-yaml. Affected versions: >= 4.0.0, < 4.3.2. Fixed from version 4.3.2. CVSS score 7.5.

httpcore2 — Other → 2.10.0

Tue, 08 Sep 2026 00:00:00 GMT

A security flaw affects the PyPI package httpcore2. Affected versions: < 2.10.0. Fixed from version 2.10.0. CVSS score 8.1.

httpx2 — Denial of service → 2.12.0

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the PyPI package httpx2. Affected versions: < 2.12.0. Fixed from version 2.12.0. CVSS score 7.5.

google.golang.org/grpc — Denial of service → 1.82.2

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the Go package google.golang.org/grpc. Affected versions: < 1.82.2. Fixed from version 1.82.2.

winml-cli — Authentication bypass → 0.4.0

Tue, 08 Sep 2026 00:00:00 GMT

An authentication bypass flaw affects the PyPI package winml-cli. Affected versions: < 0.4.0. Fixed from version 0.4.0.

maplibre-gl — Cross-site scripting → 6.4.1

Tue, 08 Sep 2026 00:00:00 GMT

A cross-site scripting flaw affects the npm package maplibre-gl. Affected versions: <= 6.4.0. Fixed from version 6.4.1. CVSS score 10.

[EXPLOITED] Microsoft Windows — Other

Tue, 08 Sep 2026 00:00:00 GMT

A security flaw affects Microsoft Windows. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] N-able N-central — Remote code execution

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects N-able N-central. Apply the vendor’s patch. It is being actively exploited: patch now.

astro — Remote code execution → 7.2.8

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the npm package astro. Affected versions: < 7.2.8. Fixed from version 7.2.8. CVSS score 9.8.

@typespec/openapi3 — Path traversal

Tue, 08 Sep 2026 00:00:00 GMT

A path traversal flaw affects the npm package @typespec/openapi3. Affected versions: <= 1.15.0. No fixed version published so far. CVSS score 7.1.

nodemailer — Denial of service → 9.1.0

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the npm package nodemailer. Affected versions: < 9.1.0. Fixed from version 9.1.0. CVSS score 7.5.

next — Remote code execution → 15.5.24

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the npm package next. Affected versions: >= 10.0.0, < 15.5.24. Fixed from version 15.5.24.

@tiptap/core — Denial of service → 3.30.5

Tue, 08 Sep 2026 00:00:00 GMT

A denial of service flaw affects the npm package @tiptap/core. Affected versions: >= 3.7.0, < 3.30.5. Fixed from version 3.30.5.

Microsoft.DiaSymReader.Native — Remote code execution → 18.9.0-beta1.26405.2

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the NuGet package Microsoft.DiaSymReader.Native. Affected versions: >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1. Fixed from version 18.9.0-beta1.26405.2. CVSS score 8.8.

sharp — Remote code execution → 0.35.4

Tue, 08 Sep 2026 00:00:00 GMT

A remote code execution flaw affects the npm package sharp. Affected versions: < 0.35.4. Fixed from version 0.35.4.

[EXPLOITED] Google Chromium V8 — Remote code execution

Fri, 04 Sep 2026 00:00:00 GMT

A remote code execution flaw affects Google Chromium V8. Apply the vendor’s patch. It is being actively exploited: patch now.

@typespec/spector — Authentication bypass → 0.1.0-alpha.27

Fri, 04 Sep 2026 00:00:00 GMT

An authentication bypass flaw affects the npm package @typespec/spector. Affected versions: <= 0.1.0-alpha.26. Fixed from version 0.1.0-alpha.27. CVSS score 7.5.

[EXPLOITED] Kludex Starlette — Authentication bypass

Wed, 02 Sep 2026 00:00:00 GMT

An authentication bypass flaw affects Kludex Starlette. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Kestra OSS — Remote code execution

Wed, 02 Sep 2026 00:00:00 GMT

A remote code execution flaw affects Kestra OSS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] BerriAI LiteLLM — Authentication bypass

Wed, 02 Sep 2026 00:00:00 GMT

An authentication bypass flaw affects BerriAI LiteLLM. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] JFrog Artifactory — Authentication bypass

Wed, 02 Sep 2026 00:00:00 GMT

An authentication bypass flaw affects JFrog Artifactory. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] SonicWall SMA1000 Appliances — Server-side request forgery

Wed, 02 Sep 2026 00:00:00 GMT

A server-side request forgery flaw affects SonicWall SMA1000 Appliances. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] SonicWall SMA1000 Appliances — Remote code execution

Wed, 02 Sep 2026 00:00:00 GMT

A remote code execution flaw affects SonicWall SMA1000 Appliances. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Sangoma Switchvox — Injection

Wed, 02 Sep 2026 00:00:00 GMT

An injection flaw affects Sangoma Switchvox. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] PaperCut NG/MF — Authentication bypass

Mon, 31 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects PaperCut NG/MF. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] PaperCut NG/MF — Remote code execution

Mon, 31 Aug 2026 00:00:00 GMT

A remote code execution flaw affects PaperCut NG/MF. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] ownCloud — Authentication bypass

Thu, 27 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects ownCloud. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Linux Kernel — Privilege escalation

Thu, 27 Aug 2026 00:00:00 GMT

A privilege escalation flaw affects Linux Kernel. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] JFrog Artifactory — Path traversal

Thu, 27 Aug 2026 00:00:00 GMT

A path traversal flaw affects JFrog Artifactory. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Red Hat Libuser — Privilege escalation

Wed, 26 Aug 2026 00:00:00 GMT

A privilege escalation flaw affects Red Hat Libuser. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Red Hat Automatic Bug Reporting Tool — Path traversal

Wed, 26 Aug 2026 00:00:00 GMT

A path traversal flaw affects Red Hat Automatic Bug Reporting Tool. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft SQL Server — Remote code execution

Wed, 26 Aug 2026 00:00:00 GMT

A remote code execution flaw affects Microsoft SQL Server. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Ajax.NET Professional — Unsafe deserialisation

Wed, 26 Aug 2026 00:00:00 GMT

An unsafe deserialisation flaw affects Ajax.NET Professional. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Linux Kernel — Denial of service

Wed, 26 Aug 2026 00:00:00 GMT

A denial of service flaw affects Linux Kernel. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Citrix NetScaler ADC and NetScaler Gateway — Denial of service

Wed, 26 Aug 2026 00:00:00 GMT

A denial of service flaw affects Citrix NetScaler ADC and NetScaler Gateway. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Gitea — Remote code execution

Tue, 25 Aug 2026 00:00:00 GMT

A remote code execution flaw affects Gitea. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in — Authentication bypass

Mon, 24 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Synacor Zimbra Collaboration Suite (ZCS) — Remote code execution

Fri, 21 Aug 2026 00:00:00 GMT

A remote code execution flaw affects Synacor Zimbra Collaboration Suite (ZCS). Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] TrueConf Server — Authentication bypass

Thu, 20 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects TrueConf Server. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] TrueConf Server — Remote code execution

Thu, 20 Aug 2026 00:00:00 GMT

A remote code execution flaw affects TrueConf Server. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] MLflow — Server-side request forgery

Wed, 19 Aug 2026 00:00:00 GMT

A server-side request forgery flaw affects MLflow. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Internet Key Exchange (IKE) Service Extensions — Remote code execution

Tue, 18 Aug 2026 00:00:00 GMT

A remote code execution flaw affects Microsoft Internet Key Exchange (IKE) Service Extensions. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft SharePoint — Authentication bypass

Tue, 18 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects Microsoft SharePoint. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Broadcom VMware vCenter — Path traversal

Tue, 18 Aug 2026 00:00:00 GMT

A path traversal flaw affects Broadcom VMware vCenter. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Apple macOS — Authentication bypass

Tue, 18 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects Apple macOS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Ray-Project Ray — Remote code execution

Mon, 17 Aug 2026 00:00:00 GMT

A remote code execution flaw affects Ray-Project Ray. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) — Denial of service

Tue, 11 Aug 2026 00:00:00 GMT

A denial of service flaw affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Windows Ancillary Function Driver for WinSock — Other

Tue, 11 Aug 2026 00:00:00 GMT

A security flaw affects Microsoft Windows Ancillary Function Driver for WinSock. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Metabase — Injection

Tue, 11 Aug 2026 00:00:00 GMT

An injection flaw affects Metabase. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Progress LoadMaster — Remote code execution

Fri, 07 Aug 2026 00:00:00 GMT

A remote code execution flaw affects Progress LoadMaster. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] JetBrains TeamCity — Unsafe deserialisation

Wed, 05 Aug 2026 00:00:00 GMT

An unsafe deserialisation flaw affects JetBrains TeamCity. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] N-able N-central — Authentication bypass

Tue, 04 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects N-able N-central. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Apache Tomcat — Other

Tue, 04 Aug 2026 00:00:00 GMT

A security flaw affects Apache Tomcat. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] IBM Langflow — Remote code execution

Tue, 04 Aug 2026 00:00:00 GMT

A remote code execution flaw affects IBM Langflow. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] N-able N-central — Authentication bypass

Mon, 03 Aug 2026 00:00:00 GMT

An authentication bypass flaw affects N-able N-central. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Cisco Secure Firewall Management Center (FMC) — Other

Wed, 29 Jul 2026 00:00:00 GMT

A security flaw affects Cisco Secure Firewall Management Center (FMC). Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Fortinet FortiOS — Information disclosure

Mon, 27 Jul 2026 00:00:00 GMT

An information disclosure flaw affects Fortinet FortiOS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Arista VeloCloud Orchestrator — Remote code execution

Mon, 27 Jul 2026 00:00:00 GMT

A remote code execution flaw affects Arista VeloCloud Orchestrator. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Check Point SmartConsole — Authentication bypass

Wed, 22 Jul 2026 00:00:00 GMT

An authentication bypass flaw affects Check Point SmartConsole. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft SharePoint — Unsafe deserialisation

Wed, 22 Jul 2026 00:00:00 GMT

An unsafe deserialisation flaw affects Microsoft SharePoint. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] DD-WRT — Other

Tue, 21 Jul 2026 00:00:00 GMT

A security flaw affects DD-WRT. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Langflow — Supply chain

Tue, 21 Jul 2026 00:00:00 GMT

A supply chain compromise flaw affects Langflow. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] WordPress Core — Injection

Tue, 21 Jul 2026 00:00:00 GMT

An injection flaw affects WordPress Core. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] WordPress Core — Remote code execution

Tue, 21 Jul 2026 00:00:00 GMT

A remote code execution flaw affects WordPress Core. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Fortinet FortiSandbox — Remote code execution

Thu, 16 Jul 2026 00:00:00 GMT

A remote code execution flaw affects Fortinet FortiSandbox. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Fortinet FortiSandbox — Remote code execution

Thu, 16 Jul 2026 00:00:00 GMT

A remote code execution flaw affects Fortinet FortiSandbox. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft SharePoint — Unsafe deserialisation

Thu, 16 Jul 2026 00:00:00 GMT

An unsafe deserialisation flaw affects Microsoft SharePoint. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] KNX Association KNX Protocol Connection Authorization Option 1 — Other

Wed, 15 Jul 2026 00:00:00 GMT

A security flaw affects KNX Association KNX Protocol Connection Authorization Option 1. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Oracle E-Business Suite — Authentication bypass

Wed, 15 Jul 2026 00:00:00 GMT

An authentication bypass flaw affects Oracle E-Business Suite. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] SonicWall SMA1000 Appliances — Server-side request forgery

Tue, 14 Jul 2026 00:00:00 GMT

A server-side request forgery flaw affects SonicWall SMA1000 Appliances. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] SonicWall SMA1000 Appliances — Remote code execution

Tue, 14 Jul 2026 00:00:00 GMT

A remote code execution flaw affects SonicWall SMA1000 Appliances. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Active Directory Federation Services — Authentication bypass

Tue, 14 Jul 2026 00:00:00 GMT

An authentication bypass flaw affects Microsoft Active Directory Federation Services. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft SharePoint Server — Authentication bypass

Tue, 14 Jul 2026 00:00:00 GMT

An authentication bypass flaw affects Microsoft SharePoint Server. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Cisco IOS — Other

Mon, 13 Jul 2026 00:00:00 GMT

A security flaw affects Cisco IOS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] iCagenda — Other

Fri, 10 Jul 2026 00:00:00 GMT

A security flaw affects iCagenda. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Balbooa Forms — Remote code execution

Fri, 10 Jul 2026 00:00:00 GMT

A remote code execution flaw affects Balbooa Forms. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Adobe ColdFusion — Path traversal

Tue, 07 Jul 2026 00:00:00 GMT

A path traversal flaw affects Adobe ColdFusion. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] JoomShaper SP Page Builder — Other

Tue, 07 Jul 2026 00:00:00 GMT

A security flaw affects JoomShaper SP Page Builder. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Langflow — Authentication bypass

Tue, 07 Jul 2026 00:00:00 GMT

An authentication bypass flaw affects Langflow. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Joomlack Page Builder — Remote code execution

Tue, 07 Jul 2026 00:00:00 GMT

A remote code execution flaw affects Joomlack Page Builder. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft SharePoint Server — Unsafe deserialisation

Wed, 01 Jul 2026 00:00:00 GMT

An unsafe deserialisation flaw affects Microsoft SharePoint Server. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] SimpleHelp — Cryptographic weakness

Mon, 29 Jun 2026 00:00:00 GMT

A cryptographic weakness flaw affects SimpleHelp. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] PTC Windchill and FlexPLM — Unsafe deserialisation

Thu, 25 Jun 2026 00:00:00 GMT

An unsafe deserialisation flaw affects PTC Windchill and FlexPLM. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Cisco Unified Communications Manager — Server-side request forgery

Thu, 25 Jun 2026 00:00:00 GMT

A server-side request forgery flaw affects Cisco Unified Communications Manager. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Lantronix EDS5000 — Remote code execution

Tue, 23 Jun 2026 00:00:00 GMT

A remote code execution flaw affects Lantronix EDS5000. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Ubiquiti UniFi OS — Authentication bypass

Tue, 23 Jun 2026 00:00:00 GMT

An authentication bypass flaw affects Ubiquiti UniFi OS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Ubiquiti UniFi OS — Path traversal

Tue, 23 Jun 2026 00:00:00 GMT

A path traversal flaw affects Ubiquiti UniFi OS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Ubiquiti UniFi OS — Remote code execution

Tue, 23 Jun 2026 00:00:00 GMT

A remote code execution flaw affects Ubiquiti UniFi OS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Splunk Enterprise — Authentication bypass

Thu, 18 Jun 2026 00:00:00 GMT

An authentication bypass flaw affects Splunk Enterprise. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Widget Factory Joomla Content Editor — Authentication bypass

Tue, 16 Jun 2026 00:00:00 GMT

An authentication bypass flaw affects Widget Factory Joomla Content Editor. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Cisco Catalyst SD-WAN Manager — Path traversal

Mon, 15 Jun 2026 00:00:00 GMT

A path traversal flaw affects Cisco Catalyst SD-WAN Manager. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] LiteSpeed cPanel Plugin — Path traversal

Mon, 15 Jun 2026 00:00:00 GMT

A path traversal flaw affects LiteSpeed cPanel Plugin. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Oracle PeopleSoft Enterprise PeopleTools — Authentication bypass

Fri, 12 Jun 2026 00:00:00 GMT

An authentication bypass flaw affects Oracle PeopleSoft Enterprise PeopleTools. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Ivanti Sentry — Remote code execution

Thu, 11 Jun 2026 00:00:00 GMT

A remote code execution flaw affects Ivanti Sentry. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Google Chromium V8 — Remote code execution

Tue, 09 Jun 2026 00:00:00 GMT

A remote code execution flaw affects Google Chromium V8. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Cisco Catalyst SD-WAN Manager — Other

Tue, 09 Jun 2026 00:00:00 GMT

A security flaw affects Cisco Catalyst SD-WAN Manager. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Arista Extensible Operating System — Other

Tue, 09 Jun 2026 00:00:00 GMT

A security flaw affects Arista Extensible Operating System. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] BerriAI LiteLLM — Remote code execution

Mon, 08 Jun 2026 00:00:00 GMT

A remote code execution flaw affects BerriAI LiteLLM. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Check Point Security Gateway — Authentication bypass

Mon, 08 Jun 2026 00:00:00 GMT

An authentication bypass flaw affects Check Point Security Gateway. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] SolarWinds Serv-U — Denial of service

Fri, 05 Jun 2026 00:00:00 GMT

A denial of service flaw affects SolarWinds Serv-U. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Mirasvit Full Page Cache Warmer — Unsafe deserialisation

Wed, 03 Jun 2026 00:00:00 GMT

An unsafe deserialisation flaw affects Mirasvit Full Page Cache Warmer. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Linux Kernel — Authentication bypass

Tue, 02 Jun 2026 00:00:00 GMT

An authentication bypass flaw affects Linux Kernel. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Android Framework — Privilege escalation

Tue, 02 Jun 2026 00:00:00 GMT

A privilege escalation flaw affects Android Framework. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Oracle WebLogic Server — Other

Mon, 01 Jun 2026 00:00:00 GMT

A security flaw affects Oracle WebLogic Server. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Palo Alto Networks PAN-OS — Authentication bypass

Fri, 29 May 2026 00:00:00 GMT

An authentication bypass flaw affects Palo Alto Networks PAN-OS. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] TanStack — Other

Wed, 27 May 2026 00:00:00 GMT

A security flaw affects TanStack. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Nx Console — Supply chain

Wed, 27 May 2026 00:00:00 GMT

A supply chain compromise flaw affects Nx Console. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Daemon Tools Lite — Supply chain

Wed, 27 May 2026 00:00:00 GMT

A supply chain compromise flaw affects Daemon Tools Lite. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] LiteSpeed cPanel Plugin — Privilege escalation

Tue, 26 May 2026 00:00:00 GMT

A privilege escalation flaw affects LiteSpeed cPanel Plugin. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Drupal Core — Injection

Fri, 22 May 2026 00:00:00 GMT

An injection flaw affects Drupal Core. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Langflow — Remote code execution

Thu, 21 May 2026 00:00:00 GMT

A remote code execution flaw affects Langflow. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Trend Micro Apex One — Path traversal

Thu, 21 May 2026 00:00:00 GMT

A path traversal flaw affects Trend Micro Apex One. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Windows — Remote code execution

Wed, 20 May 2026 00:00:00 GMT

A remote code execution flaw affects Microsoft Windows. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft DirectX — Remote code execution

Wed, 20 May 2026 00:00:00 GMT

A remote code execution flaw affects Microsoft DirectX. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Adobe Acrobat and Reader — Remote code execution

Wed, 20 May 2026 00:00:00 GMT

A remote code execution flaw affects Adobe Acrobat and Reader. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Internet Explorer — Remote code execution

Wed, 20 May 2026 00:00:00 GMT

A remote code execution flaw affects Microsoft Internet Explorer. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Internet Explorer — Remote code execution

Wed, 20 May 2026 00:00:00 GMT

A remote code execution flaw affects Microsoft Internet Explorer. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Defender — Path traversal

Wed, 20 May 2026 00:00:00 GMT

A path traversal flaw affects Microsoft Defender. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft Defender — Denial of service

Wed, 20 May 2026 00:00:00 GMT

A denial of service flaw affects Microsoft Defender. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Microsoft — Cross-site scripting

Fri, 15 May 2026 00:00:00 GMT

A cross-site scripting flaw affects Microsoft. Apply the vendor’s patch. It is being actively exploited: patch now.

[EXPLOITED] Cisco Catalyst SD-WAN — Authentication bypass

Thu, 14 May 2026 00:00:00 GMT

An authentication bypass flaw affects Cisco Catalyst SD-WAN. Apply the vendor’s patch. It is being actively exploited: patch now.