Main Menu

CVE Vulnerability Alerts

Application Security
CISA Adds Joomla JCE CVE-2026-48907 to KEV Amid Active Scans
June 17, 2026
CISA added CVE-2026-48907 to its KEV catalog as automated exploit campaigns target the unauthenticated file upload flaw in the Joomla Content Editor plugin.
Application Security
CVE-2026-2473: Vertex AI SDK Pickle Attack Enables Cross-Tenant RCE
June 17, 2026
Unit 42 found CVE-2026-2473 in the Vertex AI SDK lets attackers execute code in a victim's GCP tenant by squatting predictable bucket names and using ...
Application Security
Three FortiSandbox CVEs Chained for Unauthenticated Root Execution
June 16, 2026
Defused confirmed active exploitation of CVE-2026-39813 and CVE-2026-39808 in FortiSandbox, chained with CVE-2026-25089 to deliver unauthenticated root code execution across seven financial and critical infrastructure ...
CVE Vulnerability Alerts
Cisco CVE-2026-20262 Added to CISA KEV; Eighth Exploited SD-WAN Flaw
June 16, 2026
Cisco released patches for CVE-2026-20262, an unauthenticated server-side request forgery flaw in SD-WAN Manager now actively exploited, as CISA issued a 13-day federal deadline.
Application Security
LiteSpeed cPanel CVE-2026-54420 Escalates to Root on Shared Hosts
June 16, 2026
CISA added LiteSpeed cPanel CVE-2026-54420 to its KEV catalog with a 48-hour deadline as exploitation of the unauthenticated REST API privilege escalation flaw was confirmed ...
Application Security
Obsidian Finds CVSS 9.9 Attack Chain in LiteLLM AI Gateway
June 16, 2026
A three-CVE attack chain disclosed by Obsidian Security in LiteLLM AI Gateway lets low-privilege users escalate to root and steal all managed AI API keys.
Application Security
CVE-2026-48558 Exposes 14,000 SimpleHelp RMM Servers to Auth Bypass
June 16, 2026
CVE-2026-48558, a critical OIDC authentication bypass in SimpleHelp RMM, lets unauthenticated attackers gain full admin access on 14,000 exposed servers.
Application Security
CVE-2026-42824: M365 Copilot SearchLeak Enables 1-Click Email Theft
June 15, 2026
Varonis disclosed a three-step vulnerability chain in Microsoft 365 Copilot that allowed attackers to steal emails and documents with a single crafted link.
Application Security
Chrome 149 Patches 28 Flaws, Including 12 Use-After-Free Bugs
June 12, 2026
Google's Chrome 149 security update patches 28 vulnerabilities, roughly 12 use-after-free bugs, a memory corruption class tied to drive-by code execution.
Application Security
Fortinet FortiSandbox CVE-2026-25089 Allows Unauthenticated RCE
June 12, 2026
Fortinet patched CVE-2026-25089, a CVSS 9.1 OS command injection in FortiSandbox's Web UI exploitable by unauthenticated attackers via crafted HTTP requests.
Load More
Trending
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
UNC6671 Extortion Group Rebrands After Targeting Hedge Funds
ClickFix Campaign Pushes Go-Based macOS Crypto Drainer
ClickFix Malware Gate Fingerprints macOS Users Before Lures
SMOKE#SCREEN Deploys ScreenConnect via Fake Adobe, Zoom Lures
Greatness PhaaS Spoofs RingCentral to Steal Microsoft 365 Accounts
Leaked DarkSword Kit Deploys GHOSTBLADE Stealer on iOS Devices
DOUBLECUP ClickFix Loader Hides Malware in Browser Cache Images
UKGI Left Officials’ Contact Details Exposed for 40 Hours
Microsoft Links Hotel Wi-Fi Attacks to Storm-2945 Midnight Blizzard

Daily Briefing Newsletter

Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.