critical-cve news, stories and analysis

Abstract data visualization showing escalating attack bars across a timeline from 2025 to 2026, with four peaks representing Langflow CVEs at CVSS 9.8, 9.8, 9.4, and 9.8, illustrating the Langflow RCE exploitation pattern

Langflow RCE chain under active attack: 15,000 hits and counting

Langflow RCE flaws face active exploitation with over 15,000 successful attacks. Attackers harvest AI provider keys and cloud credentials from exposed instances.

Lars Cornelissen · Sep 1, 2026

Abstract data visualization of the PaperCut CVE-2026-81578 and CVE-2026-82078 exploit chain showing the 19-day gap between first observed exploitation on August 26, 2026, and the federal patch deadline of September 14, 2026, with CVSS scores 8.8 and 9.4

Cyber security

PaperCut zero-days hit CISA KEV as data theft attacks spread

PaperCut NG/MF zero-day chain CVE-2026-81578 and CVE-2026-82078 enables pre-auth RCE on print servers. CISA added both to KEV with a September 14 patch deadline.

Lars Cornelissen · Sep 1, 2026

Abstract data visualization showing exposed Citrix NetScaler appliances declining from approximately 32,300 in March 2026 to 23,800 in August 2026, highlighting the CVE-2026-8452 RCE exploitation window

Cyber security

Citrix NetScaler RCE exploited, CISA sets Saturday deadline

Citrix NetScaler RCE flaw CVE-2026-8452 is under active attack with web shells on compromised devices. CISA orders patching by Saturday August 29.

Lars Cornelissen · Aug 27, 2026

Bar chart comparing the two critical Next.js CVEs from August 2026: AVIF image optimization RCE scoring 9.5 and Windows path traversal RCE, both unauthenticated and both patched in versions 15.5.24 and 16.3.3.

Cyber security

Next.js RCE flaws hit AVIF and Windows servers: patch now

Next.js patches two critical unauthenticated RCE vulnerabilities in the August 2026 security release. AVIF image optimization and Windows filesystem path traversal both expose self-hosted servers. Upgrade to 15.5.24 or 16.3.3 immediately.

Lars Cornelissen · Aug 27, 2026

Bar chart of CVE-2026-18963 CVSS v3.1 base score breakdown showing Confidentiality High, Integrity High, Availability None, Attack Vector Network, Attack Complexity Low, Privileges Required None, User Interaction None, Scope Unchanged, with overall base score 9.1

Cyber security

Keycloak password reset flaw lets attackers take over any account

CVE-2026-18963 is a critical unauthenticated account takeover in Keycloak's password reset flow, rated CVSS 9.1, letting attackers bypass email verification and set new credentials on any account.

Lars Cornelissen · Aug 25, 2026

Abstract data visualization showing the collapse of the patch window for GitLab CVE-2026-19478, a CVSS 9.4 GraphQL code injection flaw, with active exploitation beginning within two days of the August 17 2026 patch release

Cyber security

GitLab CVE-2026-19478 exploited within days of patch release

GitLab CVE-2026-19478, a CVSS 9.4 GraphQL injection flaw, lets unauthenticated attackers delete repos and forge merges. It is already exploited in the wild.

Lars Cornelissen · Aug 23, 2026

Bar chart showing MLflow SSRF exposure: 238 servers exposed with 103 compromised, alongside FUXA with 60 instances exposed. MLflow SSRF vulnerability CVE-2026-64849 affects versions before 3.15.0.

Cyber security

MLflow SSRF flaw lets attackers steal cloud credentials now

MLflow SSRF vulnerability CVE-2026-64849 exposes cloud credentials on 238 servers. Attackers stole secrets from 103 within hours of disclosure.

Lars Cornelissen · Aug 19, 2026

Bar chart showing the Ray RCE vulnerability timeline from November 2025 PoC disclosure to August 2026 CISA KEV listing with a 3-day patch deadline, highlighting the 9-month exploitation gap.

Cyber security

Ray browser RCE flaw hits CISA KEV: patch your AI clusters

CVE-2025-62593 in Ray is a critical code injection flaw exploitable via Firefox and Safari, now under active attack. CISA gave federal agencies 72 hours to patch or stop using it.

Lars Cornelissen · Aug 19, 2026

Bar chart showing days between SharePoint CVE-2026-55040 milestones: 55 days from Microsoft confirmation to patch, 28 days from patch to PoC, 1 day from PoC to active exploitation

Cyber security

SharePoint CVE-2026-55040 auth bypass exploited after PoC

CVE-2026-55040 is a CVSS 9.1 SharePoint authentication bypass patched in July. Attackers are exploiting it now after Rapid7 released a PoC on August 11.

Lars Cornelissen · Aug 13, 2026

CVSS scores for three Hugging Face Diffusers vulnerabilities: CVE-2026-44827 at 8.8, CVE-2026-44513 at 8.8, and CVE-2026-45804 at 7.5

Cyber security

Hugging Face Diffusers flaws bypass trust_remote_code

Hugging Face Diffusers vulnerabilities bypass trust_remote_code in three CVEs rated 8.8 and 7.5, enabling silent RCE from model repos. Patch now.

Lars Cornelissen · Aug 3, 2026

Bar chart of Fastjson 1.x RCE exploitation growth from 0 detected attacks in June 2026 to over 800 per day by July 25, 2026. Source: ThreatBook and Imperva telemetry.

Cyber security

Fastjson 1.x RCE has no patch and Spring Boot apps are exposed

Fastjson 1.x RCE (CVE-2026-16723) is a critical CVSS 9.0 flaw actively exploited in Spring Boot apps with no official patch available. Block Fastjson 1.x endpoints, migrate to Jackson, and demand autotype safelists.

Lars Cornelissen · Jul 27, 2026

Bar chart showing Check Point SmartConsole CVE-2026-16232 at CVSS 9.3 on the severity scale, above the critical threshold of 9.0 and near the maximum of 10.0

Cyber security

Check Point SmartConsole auth bypass gives attackers full admin

Check Point SmartConsole CVE-2026-16232 is a critical authentication bypass with a CVSS of 9.3, actively exploited and listed in CISA KEV. Patch your Security Management servers now.

Lars Cornelissen · Jul 23, 2026

Step chart showing CVE-2026-50522 threat escalation from Microsoft's July 14 patch to mass exploitation on July 20, with threat level rising from 1 to 10 over six days

Cyber security

SharePoint RCE steals machine keys even after you patch

CVE-2026-50522 is a critical SharePoint RCE flaw with CVSS 9.8 that attackers exploit to steal machine keys for persistence after patching.

Lars Cornelissen · Jul 23, 2026

Timeline of ServiceNow CVE-2026-6875 from April 1 discovery to July 18 active exploitation, showing a 5-day gap between July 13 patch release and first attacks. CVSS 9.5.

Cyber security

ServiceNow CVE-2026-6875 exploited: patch your instances now

ServiceNow CVE-2026-6875 is a CVSS 9.5 pre-auth sandbox escape RCE in the AI Platform, now actively exploited. Patch self-hosted instances immediately.

Lars Cornelissen · Jul 21, 2026

Abstract stepped ascending pattern representing Windows LegacyHive privilege escalation from standard user to admin. Four of eight Nightmare Eclipse zero-day disclosures remain unpatched.

Cyber security

LegacyHive Windows zero-day puts admin access at risk

LegacyHive is a public Windows zero-day that escalates standard users to admin on patched systems. No CVE or patch yet, but MDE detection queries exist.

Lars Cornelissen · Jul 19, 2026

wp2shell vulnerability affecting WordPress 6.9 and 7.0 with over 500 million sites potentially exposed, 5 vulnerable releases on 6.9.x and 2 on 7.0.x with full RCE chain

Cyber security

WordPress wp2shell RCE hits 500 million sites, patch now

wp2shell is a pre-authentication remote code execution chain in WordPress Core. Two CVEs let anonymous attackers run code on 6.9 and 7.0 sites with no plugins.

Lars Cornelissen · Jul 19, 2026

Bar chart comparing CVSS scores for two SonicWall SMA 1000 zero-day vulnerabilities: CVE-2026-15409 at 10.0 critical SSRF and CVE-2026-15410 at 7.2 high code injection, both actively exploited in the wild and added to CISA KEV on July 14 2026

Cyber security

Two SonicWall SMA 1000 zero-days under active attack

Two SonicWall SMA 1000 zero-day vulnerabilities including a CVSS 10.0 SSRF are under active exploitation. CISA KEV-listed with a July 17 patch deadline.

Lars Cornelissen · Jul 15, 2026

Abstract data art representing a single HTTP header piercing through a layered authentication barrier, symbolizing the Gitea Docker auth bypass CVE-2026-20896 where one X-WEBAUTH-USER header lets attackers impersonate any user including admins across approximately 6,200 exposed instances.

Cyber security

Gitea Docker auth bypass lets attackers impersonate admins

A critical Gitea Docker auth bypass, CVE-2026-20896, lets attackers impersonate any user with one HTTP header. Over 6,200 instances are exposed online.

Lars Cornelissen · Jul 11, 2026

Abstract visualization of the Bad Epoll CVE-2026-46242 race condition in the Linux kernel epoll subsystem, showing overlapping execution threads colliding in a narrow six-instruction window that triggers a use-after-free granting root access on v6.4+ kernels including Android.

Cyber security

Bad Epoll kernel flaw CVE-2026-46242 roots Linux and Android

Bad Epoll (CVE-2026-46242) is a Linux epoll use-after-free giving unprivileged users root on v6.4+ kernels and Android. No workaround exists. Apply patch a6dc643c6931 now.

Lars Cornelissen · Jul 5, 2026

SharePoint CVE-2026-45659 patch clock showing 40 days from NVD publication on May 22, 2026 to CISA KEV addition on July 1, 2026, and 3 days from KEV addition to the July 4, 2026 federal due date.

Cyber security

SharePoint CVE-2026-45659 puts patching on a 3 day clock

SharePoint CVE-2026-45659 is an actively exploited RCE risk in CISA KEV. Patch exposed servers and check compromise now.

Lars Cornelissen · Jul 3, 2026

SimpleHelp CVE-2026-48558 exposure chart showing 14,000 exposed SimpleHelp servers and about 1,008 estimated OIDC-configured exposed servers.

Cyber security

SimpleHelp CVE-2026-48558 needs a patch drill

SimpleHelp CVE-2026-48558 is an actively exploited auth bypass. Patch 5.5.16 or 6.0 RC2, then hunt for TaskWeaver and Djinn.

Lars Cornelissen · Jul 1, 2026

Cisco Unified CM CVE timeline showing 22 days from Cisco's June 3 advisory to CISA's June 25 KEV addition, then 3 days to the June 28 deadline.

Cyber security

Cisco Unified CM CVE gets a weekend patch clock

Cisco Unified CM CVE is now a patch-or-isolate job: CISA set a June 28 deadline after active exploitation of CVE-2026-20230.

Lars Cornelissen · Jun 27, 2026

CISA KEV vulnerabilities added on June 23, 2026: Ubiquiti has 3 entries and Lantronix has 1 entry, with three CVSS 10.0 UniFi OS flaws and one CVSS 9.8 Lantronix flaw.

Cyber security

CISA KEV vulnerabilities put edge gear on watch now

CISA KEV vulnerabilities are a live patch queue: four exploited Lantronix and UniFi OS bugs now demand edge inventory and compromise checks.

Lars Cornelissen · Jun 25, 2026

Splunk CVE-2026-20253 timeline showing day 0 disclosure on June 10, day 2 public technical write-up on June 12, day 8 CISA KEV addition on June 18, and day 11 federal due date on June 21.

Cyber security

Splunk CVE-2026-20253 puts SIEMs on a 72-hour clock

Splunk CVE-2026-20253 is an actively exploited critical flaw. Patch exposed Enterprise 10.0 and 10.2 nodes by June 21.

Lars Cornelissen · Jun 21, 2026

Splunk Enterprise flaw CVE-2026-20253 response timeline showing disclosure at day 0 on June 10, public technical writeup at day 2 on June 12, exploitation warning at day 8 on June 18, and the CISA remediation deadline at day 11 on June 21.

Cyber security

Splunk Enterprise flaw turns logs into attack surface

Splunk Enterprise flaw CVE-2026-20253 is under active exploitation. Patch by June 21 or disable the PostgreSQL sidecar safely.

Lars Cornelissen · Jun 20, 2026