Main Menu

CVE Vulnerability Alerts

Application Security
cPanel and WHM Patch Three CVEs, Two Rated High Severity
May 11, 2026
cPanel patched two CVSS 8.8 flaws including Perl code execution in WHM, as the 40,000-server CVE-2026-41940 campaign remains active.
Twelve Critical vm2 Vulnerabilities Allow Node.js Sandbox Escape
Application Security
Twelve Critical vm2 Vulnerabilities Allow Node.js Sandbox Escape
May 8, 2026
Researchers disclosed 12 critical vulnerabilities in the widely-used vm2 Node.js sandbox library, all enabling sandbox escape and arbitrary code execution on the host system.
Nation-State Actors Exploited PAN-OS CVE-2026-0300 for Nearly a Month
CVE Vulnerability Alerts
Nation-State Actors Exploited PAN-OS CVE-2026-0300 for Nearly a Month
May 8, 2026
State-sponsored actors exploited CVE-2026-0300, a critical CVSS 9.3 RCE flaw in PAN-OS, for roughly one month before disclosure. CISA deadline is May 9.
Actively Exploited Ivanti EPMM CVE-2026-6973 Added to CISA KEV
Application Security
Actively Exploited Ivanti EPMM CVE-2026-6973 Added to CISA KEV
May 8, 2026
Ivanti disclosed CVE-2026-6973, an actively exploited RCE vulnerability in EPMM 12.8.0.0 and earlier. CISA set a May 10 federal remediation deadline.
MetInfo CVE-2026-29014 Exploited -- Unauthenticated PHP Code Injection
Application Security
MetInfo CVE-2026-29014 Exploited – Unauthenticated PHP Code Injection
May 6, 2026
CVE-2026-29014 in MetInfo CMS 7.9–8.1 is being actively exploited since April 25, 2026 via unauthenticated PHP injection achieving full server control. Patched April 7; ~2,000 ...
Apache CVE-2026-23918 Enables DoS and RCE in HTTP2 -- Patch to 2.4.67
Application Security
Apache CVE-2026-23918 Enables DoS and RCE in HTTP/2 — Patch to 2.4.67
May 6, 2026
CVE-2026-23918 is a CVSS 8.8 double-free in Apache HTTP Server 2.4.66 mod_http2, causing DoS on default deployments and RCE on Debian and Docker installations. Fixed ...
Palo Alto CVE-2026-0300 Under Active Attack -- Patch Due May 13
CVE Vulnerability Alerts
Palo Alto CVE-2026-0300 Under Active Attack — Patch Due May 13
May 6, 2026
Palo Alto Networks disclosed CVE-2026-0300 on May 6, 2026 — a CVSS 9.3 unauthenticated buffer overflow in PAN-OS Captive Portal actively exploited in the wild. ...
cPanel CVE-2026-41940 Exploited Within 24 Hours, Ransomware Deployed
Application Security
cPanel CVE-2026-41940 Exploited Within 24 Hours, Ransomware Deployed
May 6, 2026
CVE-2026-41940, a critical cPanel authentication bypass, is being actively exploited by multiple actors deploying ransomware and C2 tools against governments and MSPs across five countries.
MOVEit Is Back in the Crosshairs CVSS 9.8 Flaw in Automation
CVE Vulnerability Alerts
MOVEit Is Back in the Crosshairs: CVSS 9.8 Flaw in Automation
May 5, 2026
Progress Software patched a CVSS 9.8 authentication bypass in MOVEit Automation — the same product line that fueled the catastrophic Cl0p ransomware campaign in 2023.
Debug Mode Left Open Enterprise Platform Hit With Unauthenticated RCE
Application Security
Debug Mode Left Open: Enterprise Platform Hit With Unauthenticated RCE
May 5, 2026
CVE-2026-22679, a critical unauthenticated RCE in Weaver E-cology, has been actively exploited since March — weeks before public disclosure reached defenders.
Load More
Trending
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
UNC6671 Extortion Group Rebrands After Targeting Hedge Funds
ClickFix Campaign Pushes Go-Based macOS Crypto Drainer
ClickFix Malware Gate Fingerprints macOS Users Before Lures
SMOKE#SCREEN Deploys ScreenConnect via Fake Adobe, Zoom Lures
Greatness PhaaS Spoofs RingCentral to Steal Microsoft 365 Accounts
Leaked DarkSword Kit Deploys GHOSTBLADE Stealer on iOS Devices
DOUBLECUP ClickFix Loader Hides Malware in Browser Cache Images
UKGI Left Officials’ Contact Details Exposed for 40 Hours
Microsoft Links Hotel Wi-Fi Attacks to Storm-2945 Midnight Blizzard

Daily Briefing Newsletter

Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.