Security Alert
CVE-2026-14669 is a CVSS 8.8 HIGH heap buffer overflow in PostgreSQL's to_char function that can run arbitrary code as the database OS user, patched August 13, 2026. Two questions decide your workload: is Postgres in your stack, and is your version older than 18.5 / 17.11 / 16.15 / 15.19 / 14.24?
Security Alert
A 9.1 critical authentication bypass in PAN-OS GlobalProtect, actively exploited and now in CISA KEV. But it only bites under a specific config. The two questions that decide your workload: is the product in your stack, and does your config meet the exposure conditions?
Security Alert
Active exploitation of an unauthenticated root RCE in PAN-OS firewalls. No patch until May 13. The one question your team needs to answer in the next two hours: is the User-ID Authentication Portal exposed to the internet?
Security Alert
732-byte exploit. First-try root on every modern Linux distribution. Page-cache-only corruption that on-disk integrity tools miss. Crosses container boundaries. Surfaced by an AI-assisted audit in roughly an hour.
Security Alert
A 27-character omission gave any network-adjacent attacker full control over 2,689+ publicly exposed nginx servers. The real story: every other app bolting MCP onto existing auth stacks.
Security Alert
CVE-2026-32201 allows unauthenticated spoofing on SharePoint Server. CISA added it to KEV immediately. Third SharePoint zero-day in under a year — ToolShell echoes loom large.
Zero-Day
CVE-2026-34621 chains two logic bugs to escape Adobe Reader's sandbox — no memory corruption needed. Exploited since December 2025, patched April 11. Russian-language lures targeting oil & gas sector.
Zero-Day
Same product, different vulnerability class, same outcome: unauthenticated RCE on your endpoint management server. Exploitation started Easter weekend.
Security Alert
Two CVSS 9.8 vulnerabilities hit Cisco management infrastructure. IMC auth bypass lets attackers take over any admin account. SSM On-Prem gives unauthenticated root access. Neither requires credentials.
Supply Chain
For two hours on March 31, anyone who ran npm install axios got a North Korean RAT. The real package, the real registry, the real maintainer account — compromised.
Security Alert
A critical SQL injection in FortiClient EMS 7.4.4 allows unauthenticated attackers to dump admin credentials, endpoint data, and certificates with a single HTTP request. Active exploitation confirmed.
Security Alert
Google just released an urgent Chrome update patching eight high-severity vulnerabilities — all capable of enabling remote code execution, targeting GPU, audio, fonts, and federated auth components.