An urgent NVIDIA NVTabular vulnerability patch fixes high-severity bugs. Secure your systems against this untrusted deserialization flaw.

A critical Apache Airflow vulnerability highlights a severe Airflow scheduler flaw. Upgrade to version 3.2.2 or later to prevent exploits.

Learn how a new Apache Fory vulnerability impacts Java platforms. Apply the urgent Apache Fory vulnerability patch to protect your enterprise nodes.

A critical Teamwork Cloud RCE vulnerability exploits an untrusted deserialization flaw. Patch No Magic and CATIA systems now.

A Jenkins RCE vulnerability (CVE-2026-53435) is under active exploitation. Honeypots are seeing attacks now, so patch your Jenkins controller fast.

NVIDIA has issued an urgent fix for its NeMo Framework, the popular open-source toolkit for building generative AI models. The update tackles an NVIDIA NeMo vulnerability set spanning three separa…

Celestial is a medium difficulty machine which focuses on deserialization exploits. It is not the most realistic, however it provides a…

A critical iba deserialization vulnerability (CVE-2026-8024) lets unauthenticated attackers gain remote code execution on ibaPDA and ibaDatCoordinator.

CVE_2026_44963 Veeam Backup and Replication Authenticated RCE

TL;DR Researchers have published full technical details and proof-of-concept code for a SharePoint remote code execution flaw. Tracked as CVE-2026-33112 (CVSS 8.8), it lets a low-privilege user ru…

TL;DR Metabase has patched three critical flaws in its H2 database handling. Two carry CVE IDs and enable Metabase remote code execution. CVE-2026-59827 scores 9.9 on CVSS, and CVE-2026-59826 scor…

TL;DR CVE-2026-50522 is a critical SharePoint RCE flaw rated CVSS 9.8. Researchers report active exploitation attempts, and a public proof-of-concept exploit is now available. Microsoft patched th…

TL;DR Researcher Kirill Firsov disclosed a fastjson RCE on July 19, 2026. It affects fastjson 1.2.68 through 1.2.83 under stock default settings. Full technical details are public, and third parti…

TL;DR A critical FastJson RCE vulnerability, CVE-2026-16723, carries a CVSS score of 9.0. Full technical details and working proof-of-concept exploit code are now public. Imperva reports active ex…

TL;DR The Apache Fory project disclosed four vulnerabilities on July 21, 2026. Three carry an important rating, and one is moderate. Version 1.4.0 fixes all of them. Why it matters Fory is a fast …

TL;DR OpenDJ 5.1.2 fixes four security flaws in the open-source LDAP directory server. The two most severe OpenDJ vulnerabilities are a CVSS 9.6 authorization bypass and a CVSS 9.4 unauthenticated…

TL;DR OpenAM 16.1.2 patches four security flaws in the open-source access management server. Three of these OpenAM vulnerabilities lead to remote code execution. The worst, CVE-2026-62379, allows …

TL;DR Splunk fixed 17 vulnerabilities across its apps and add-ons on August 19, 2026. The worst, CVE-2026-76404, is a critical remote code execution flaw in the MCP Server app. It scores 9.1. Splu…

TL;DR Jenkins shipped a large security advisory on September 2, 2026. It fixes more than 30 CVEs across Jenkins core and many plugins. The most serious Jenkins vulnerability, CVE-2026-84645, allow…

TL;DR Ivanti patched eight vulnerabilities in its Neurons for ITSM platform, including five rated Critical with CVSS scores up to 9.9. Three of the flaws allow unauthenticated remote code executio…