Google patches Chrome zero-day CVE-2026-2441, an actively exploited memory flaw. With PoC exploit code now publicly disclosed, update to v145 immediately.

A critical 9.8 CVSS authentication bypass (CVE-2026-0953) in Tutor LMS Pro is being actively exploited in the wild. Update to version 3.9.6 immediately.

Security teams are on high alert as Fortinet confirms that a critical vulnerability in its FortiClient EMS (Endpoint Management Server) is currently being leveraged by attackers in active campaign…

TL;DR Attackers are exploiting a Cisco Unified CM RCE flaw in live attacks. Tracked as CVE-2026-20230, it carries a CVSS score of 8.6. Researchers have now published full technical details and pro…

TL;DR Attackers are exploiting a Citrix NetScaler vulnerability in the wild, tracked as CVE-2026-8451 (CVSS 8.8). The pre-auth memory overread affects appliances configured as a SAML identity prov…

TL;DR CVE-2026-1207 is a high-severity Django SQL injection flaw, scored 8.3. It affects RasterField lookups when Django runs on a PostGIS database. Security firm CrowdSec and Canada’s cyber…

TL;DR CVE-2026-50522 is a critical SharePoint RCE flaw rated CVSS 9.8. Researchers report active exploitation attempts, and a public proof-of-concept exploit is now available. Microsoft patched th…

TL;DR Check Point disclosed a SmartConsole authentication bypass on July 22, 2026. The flaw, CVE-2026-16232, is already exploited in the wild against a handful of customers. It carries a CVSS scor…

TL;DR A critical FastJson RCE vulnerability, CVE-2026-16723, carries a CVSS score of 9.0. Full technical details and working proof-of-concept exploit code are now public. Imperva reports active ex…

TL;DR: Arista confirmed that CVE-2026-16812, a VeloCloud command injection flaw, is under active attack. The bug scores a maximum CVSS 10.0 and needs no credentials. Arista also patched two relate…

TL;DR: Attackers are actively exploiting a N-central account takeover flaw tracked as CVE-2026-18577. N-able says an incomplete patch for an earlier bug left the door open. A hotfix for version 20…

TL;DR CISA added three actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 4, 2026. The headline bug is an N-able N-central authentication bypass, now exploited in th…

TL;DR CVE-2026-63077 is a critical unauthenticated remote code execution flaw in JetBrains TeamCity. An attacker who reaches the server can run OS commands without credentials. CISA confirmed the …

TL;DR Metabase disclosed a critical SQL injection zero-day rated CVSS 10. An unauthenticated remote attacker can gain full administrator access to an instance. Metabase confirms active exploitatio…

TL;DR Cisco disclosed a Cisco ASA and FTD VPN vulnerability on August 11, 2026. Tracked as CVE-2026-20349 (CVSS 8.6), it lets an unauthenticated attacker crash the firewall remotely. Cisco confirm…