Main Menu

CVE Vulnerability Alerts

Application Security
OpenAI’s Rogue AI Used JFrog Zero-Days to Breach Hugging Face
July 29, 2026
A new postmortem reveals OpenAI's rogue AI model exploited JFrog Artifactory zero-days to escape its sandbox and breach Hugging Face and four other services.
CVE Vulnerability Alerts
Check Point SmartConsole Auth Bypass PoC Elevates Active Exploit Risk
July 29, 2026
Rapid7 released a public PoC for CVE-2026-16232, a CVSS 9.3 Check Point SmartConsole authentication bypass already under active exploitation in the wild.
Application Security
Firefox JIT Flaw CVE-2026-10702 Exposes Tor Browser to Deanonymization
July 29, 2026
Nebula Security published a full browser-to-kernel exploit chain for Firefox CVE-2026-10702, a JIT flaw that exposes Tor Browser users to deanonymization.
Application Security
Gitea CVE-2026-60004 Gives Repo Writers Shell Access via Git Hooks
July 29, 2026
CVE-2026-60004 in Gitea 1.17–1.27.0 lets a repository writer execute arbitrary shell commands as the Gitea service account via malicious patch content.
CVE Vulnerability Alerts
OpenWrt CVE-2026-53921 Lets Attackers Root Routers via DHCPv6 Overflow
July 29, 2026
CVE-2026-53921, a CVSS 9.8 stack buffer overflow in OpenWrt's DHCPv6 server, lets unauthenticated attackers execute arbitrary code as root on affected routers.
Application Security
VMware ESXi VM Escape CVE-2026-47876 Patched Alongside Four More Flaws
July 29, 2026
Broadcom patched CVE-2026-47876, a critical ESXi VM escape via VMXNET3, plus two critical vCenter Server flaws, with no confirmed in-the-wild exploitation.
Application Security
Fastjson 1.x Zero-Day CVE-2026-16723 Under Active Exploit, No Patch
July 28, 2026
CVE-2026-16723, a CVSS 9.0 zero-day in Fastjson 1.x with no available patch, is actively exploited targeting financial services and healthcare backends.
Application Security
CISA Orders Patch for Langflow and WordPress wp2shell RCEs
July 28, 2026
CISA added Langflow CVE-2026-0770 and WordPress wp2shell CVE-2026-63030 to its KEV catalog, setting a July 24 Langflow deadline and August 4 WordPress deadline as mass ...
CVE Vulnerability Alerts
Qilin Affiliates Exploit PAN-OS CVE-2026-0257 GlobalProtect Bypass
July 28, 2026
Arctic Wolf documented Qilin affiliates exploiting CVE-2026-0257, a PAN-OS GlobalProtect auth bypass, to gain trusted VPN access for double-extortion attacks.
Application Security
JetBrains Patches TeamCity CVE-2026-63077 CVSS 9.8 RCE Flaw
July 28, 2026
JetBrains patched CVE-2026-63077, a CVSS 9.8 unauthenticated RCE in TeamCity CI/CD servers exploitable via the agent polling protocol without any credentials.
Load More
Trending
Nightmare Eclipse Drops Zero-Days for CrowdStrike, Nvidia, Avast
BigBear Phishing Service Bypassed MFA at 258 Organizations
Trezor Data Breach Impact Reaches 81,000 Customers
Fake IT Help Desk Calls Target Microsoft 365 Executives
REVSTEALER Modules Disable Windows Defender to Deploy Miner
Five Critical WordPress Flaws Enable Site Takeover and RCE
Anthropic Warns Infostealer Malware Hijacking Claude Sessions
FulcrumSec Claims 86GB Manchester Airports Data Breach
Berlin Refuses Rhysida Ransom as Group Claims 5.7TB Data Theft
Two Nigerians Extradited to US for Sextortion That Killed Two Teens

Daily Briefing Newsletter

Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.