cve

13 articles · newest first

Software

adobe just patched THREE perfect 10/10 security bugs on the same day — and that many at once isn't normal

CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.

Priya Nair · 4d ago · 7 min

AI

the tool built to catch security bugs got hacked — and quietly leaked into 2,500 companies' pipelines

A poisoned vulnerability scanner sat inside a widely-trusted build pipeline for five days before anyone noticed, and Cisco, S&P Global and the European Commission are on the list of who it touched.

Lena Fischer · 4d ago · 7 min

Software

your online store's checkout might be one request away from a total takeover — no password needed

Adobe just patched a 9.1 in Commerce and Magento that needs zero credentials to exploit — and it rated the fix Priority 2, not the top tier.

Priya Nair · 5d ago · 6 min

Software

hackers showed microsoft exactly how to read every inbox on your exchange server — live, at a hacking contest

CVE-2026-62911 only scores an 8.0, but it came with working exploit code demonstrated at Pwn2Own Berlin — and it doesn't stop at one mailbox.

Priya Nair · 5d ago · 7 min

Software

a hacker tweeted a map-server bug tuesday morning. by wednesday, attackers were already inside

GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.

Priya Nair · 5d ago · 6 min

Hardware

Cisco's server controller scored a 9.8 bug that hands out root — exploit code is already public

CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.

Ravi Malhotra · Aug 10 · 6 min

Software

Microsoft just fixed three perfect-10 bugs in Azure and Teams — five days before Patch Tuesday

Three CVSS 10.0 vulnerabilities in Planetary Computer Pro, Azure SQL Database, and Teams got quietly patched on August 6 — completely outside Microsoft's scheduled August 11 Patch Tuesday.

Priya Nair · Aug 9 · 6 min

Software

a hacked github account just turned npm into a credential-stealing worm

One compromised maintainer account, ten trojanized packages, two billion downloads a month — and the malware is specifically hunting for your Claude and Cursor configs.

Priya Nair · Aug 9 · 6 min

Software

framework just told every customer their data leaked — the bug was a password reset box

A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.

Priya Nair · Aug 9 · 6 min

Software

Cisco's firewall management tool shipped with a hidden login — and attackers found it first

CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.

Priya Nair · Aug 5 · 6 min

Software

A booby-trapped image upload can now steal your Rails app's secret keys — no login needed

CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.

Priya Nair · Aug 5 · 7 min

Software

This Linux bug has quietly handed out root access since 2017 — and it leaves zero trace

Qualys just named a nine-year-old race condition in XFS that turns any local login into root, and the disk never shows it happened.

Priya Nair · Aug 5 · 6 min

Software

chrome just shipped 370 security fixes in one update — and found the scariest ones itself

no external researcher gets credit for the four ugliest bugs in Chrome 151 — Google's own team found them first, patched them, and shipped before anyone could weaponize a single one.

Priya Nair · Aug 2 · 6 min