cve

15 articles · newest first

A business intelligence dashboard interface displaying charts and data tables, representative of the kind of analytics platform Metabase provides

One free BI tool had a password-reset bug that handed out admin — hackers found it first

A single API endpoint let anyone become an administrator on thousands of self-hosted Metabase servers, and Framework, n8n and Kilo Code already got hit before the patch even shipped.

Priya Nair · Aug 24 · 7 min

Rows of networking equipment and server racks in a data center, the kind of infrastructure Cisco's Crosswork and Secure Workload platforms manage

Hardware

Cisco just found five perfect-10 bugs in its own network tools — before anyone else did

Nine vulnerabilities, five of them maximum severity, were sitting in the software that runs and secures corporate networks — Cisco caught them first, but that clock is already running.

Ravi Malhotra · Aug 24 · 6 min

A data center server rack, representing the ColdFusion and Campaign Classic servers affected by Adobe's critical August 2026 patches

Software

adobe just patched THREE perfect 10/10 security bugs on the same day — and that many at once isn't normal

CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.

Priya Nair · Aug 18 · 7 min

A padlock icon overlaid on lines of code, representing the CI/CD credentials exposed in the LiteLLM/Trivy supply chain attack

the tool built to catch security bugs got hacked — and quietly leaked into 2,500 companies' pipelines

A poisoned vulnerability scanner sat inside a widely-trusted build pipeline for five days before anyone noticed, and Cisco, S&P Global and the European Commission are on the list of who it touched.

Lena Fischer · Aug 18 · 7 min

Person entering payment details at an online store checkout on a laptop

Software

your online store's checkout might be one request away from a total takeover — no password needed

Adobe just patched a 9.1 in Commerce and Magento that needs zero credentials to exploit — and it rated the fix Priority 2, not the top tier.

Priya Nair · Aug 17 · 6 min

Person checking an email inbox on a laptop in an office

Software

hackers showed microsoft exactly how to read every inbox on your exchange server — live, at a hacking contest

CVE-2026-62911 only scores an 8.0, but it came with working exploit code demonstrated at Pwn2Own Berlin — and it doesn't stop at one mailbox.

Priya Nair · Aug 17 · 7 min

Software

a hacker tweeted a map-server bug tuesday morning. by wednesday, attackers were already inside

GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.

Priya Nair · Aug 17 · 6 min

Hardware

Cisco's server controller scored a 9.8 bug that hands out root — exploit code is already public

CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.

Ravi Malhotra · Aug 10 · 6 min

Cloud server infrastructure representing Microsoft Azure services patched for critical vulnerabilities

Software

Microsoft just fixed three perfect-10 bugs in Azure and Teams — five days before Patch Tuesday

Three CVSS 10.0 vulnerabilities in Planetary Computer Pro, Azure SQL Database, and Teams got quietly patched on August 6 — completely outside Microsoft's scheduled August 11 Patch Tuesday.

Priya Nair · Aug 9 · 6 min

A terminal window showing npm package install output, representing the compromised JavaScript package ecosystem

Software

a hacked github account just turned npm into a credential-stealing worm

One compromised maintainer account, ten trojanized packages, two billion downloads a month — and the malware is specifically hunting for your Claude and Cursor configs.

Priya Nair · Aug 9 · 6 min

A Framework laptop, the computer maker that disclosed a data breach tied to a Metabase zero-day vulnerability

Software

framework just told every customer their data leaked — the bug was a password reset box

A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.

Priya Nair · Aug 9 · 6 min

Networking and firewall equipment mounted in a server rack

Software

Cisco's firewall management tool shipped with a hidden login — and attackers found it first

CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.

Priya Nair · Aug 5 · 6 min

Developer typing code on a laptop screen showing a web application

Software

A booby-trapped image upload can now steal your Rails app's secret keys — no login needed

CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.

Priya Nair · Aug 5 · 7 min

Rows of Linux servers in a data center rack

Software

This Linux bug has quietly handed out root access since 2017 — and it leaves zero trace

Qualys just named a nine-year-old race condition in XFS that turns any local login into root, and the disk never shows it happened.

Priya Nair · Aug 5 · 6 min

Software

chrome just shipped 370 security fixes in one update — and found the scariest ones itself

no external researcher gets credit for the four ugliest bugs in Chrome 151 — Google's own team found them first, patched them, and shipped before anyone could weaponize a single one.

Priya Nair · Aug 2 · 6 min