15 articles · newest first
CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.
Lena Fischer · 5d ago · 6 min
CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
Priya Nair · 6d ago · 7 min
A 9.8-severity flaw in TeamCity On-Premises lets anyone with network access run commands on your build server — no credentials, no phishing, just a crafted request.
Priya Nair · Aug 4 · 6 min
A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.
Priya Nair · Aug 3 · 6 min
Hackers were already exploiting Fastjson's default config for over a week before Alibaba's patch quietly showed up on a wiki page.
Priya Nair · Jul 31 · 7 min
A researcher found a way to turn a page number into a working PHP shell — no login required. vBulletin patched it in July. A lot of self-hosted forums haven't.
Priya Nair · Jul 31 · 7 min
CVE-2026-56188 is a race condition in a core Windows Server network driver that an unauthenticated attacker can exploit remotely. It affects every supported Windows Server. Patch it.
Priya Nair · Jul 30 · 9 min
CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.
Priya Nair · Jul 28 · 9 min
Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.
Priya Nair · Jul 28 · 9 min
CVE-2026-60198 and four siblings let an unauthenticated attacker take over Oracle WebLogic Server over T3, IIOP, HTTP or SOAP. Five critical holes, one July patch — here's what to do.
Priya Nair · Jul 28 · 9 min
CVE-2026-56190 lets an attacker run code on a Windows machine over Remote Desktop with no login and no clicks. It's the same profile as BlueKeep — the RDP bug that became a worm. It isn't exploited yet. 'Yet' is the word to act on.
Priya Nair · Jul 28 · 7 min
CVE-2026-10520 scores a maximum 10.0 — the rarest severity rating there is. No login, one network request, and an attacker owns the box as root. It's on CISA's exploited list, with public exploit code and confirmed backdoors.
Priya Nair · Jul 28 · 7 min
CVE-2026-58608 is a fresh remote code execution flaw in the same Windows service that gave us PrintNightmare. It's on by default on virtually every Windows machine — and most servers have no reason to run it at all.
Priya Nair · Jul 24 · 7 min
CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — no login, no clicks, network access is the only requirement. It got overshadowed, and Microsoft says exploitation is 'more likely.'
Priya Nair · Jul 23 · 7 min
CVE-2026-35273 is a 9.8 pre-auth RCE ShinyHunters used as a zero-day on universities before Oracle had a patch. It's fixed in the July CPU — here's the patch-now checklist, and why patching alone isn't enough.
Priya Nair · Jul 22 · 7 min