Product Updates
A CVE record tells you which upstream versions are affected. It does not tell you what Red Hat, SUSE or Cisco shipped for their products, which is the question you actually have when you run a distribution or an appliance. VulnTracker now answers it. Under the remediation guide on each
Product Updates
72,812 CVEs were published in the first nine months of 2026, not counting rejected ones, already more than in all of 2025. At that pace, the question that matters most gets harder to answer quickly: does this CVE affect something I run, and in which versions? We wanted to
RCE
Vercel has disclosed a critical remote code execution flaw in the Node.js implementation of ImageResponse in Next.js, tracked as CVE-2026-94545. It carries a CVSS of 9.5, and it is network-reachable with no authentication and no user interaction. But whether it affects you comes down to a detail
Security Alert
MikroTik RouterOS is being actively exploited, and CVE-2026-86060 is in the CISA KEV catalog. Here is the interesting part for anyone who prioritizes by severity score: at the time of writing, this CVE has no CVSS score. NVD has not analyzed it yet. If your triage process starts with "
Guide
CVE-2026-81934 is a use-after-free in Redis that was first published as a CVSS 9.8 Critical, then reassessed down to High once the real exploitation conditions were weighed. It's a clean lesson in why the number on a CVE is a starting point, not the answer.
Guide
KB5120998 is an optional, non-security preview for Windows 11 24H2 and 25H2 — no CVE fixes. But two changes matter to security teams: Administrator Protection starts rolling out, and WMIC is finally removed. Here's what to pilot and what to weigh before deploying.
Security Alert
CVE-2026-72898 is an unauthenticated SQL injection in Metabase, scored CVSS 10.0 and already in CISA KEV. One request to /api/session/reset_password gives an attacker admin access and the credentials for every connected database. If you run Metabase, patch today.
Security Alert
CVE-2026-14669 is a CVSS 8.8 HIGH heap buffer overflow in PostgreSQL's to_char function that can run arbitrary code as the database OS user, patched August 13, 2026. Two questions decide your workload: is Postgres in your stack, and is your version older than 18.5 / 17.11 / 16.15 / 15.19 / 14.24?
Security Alert
A 9.1 critical authentication bypass in PAN-OS GlobalProtect, actively exploited and now in CISA KEV. But it only bites under a specific config. The two questions that decide your workload: is the product in your stack, and does your config meet the exposure conditions?
Security Alert
Active exploitation of an unauthenticated root RCE in PAN-OS firewalls. No patch until May 13. The one question your team needs to answer in the next two hours: is the User-ID Authentication Portal exposed to the internet?
Security Alert
732-byte exploit. First-try root on every modern Linux distribution. Page-cache-only corruption that on-disk integrity tools miss. Crosses container boundaries. Surfaced by an AI-assisted audit in roughly an hour.
Guide
A CVE is a license plate for vulnerabilities. You don't need to memorize acronyms — you need three things: how to tell if a CVE matters to you, what the score means, and what to do when one shows up in your stack.
