A FOSSBilling template injection flaw (CVE-2026-28496, CVSS 9.4) is exploited in the wild. Patch to 0.8.0 now to stop server-side template injection.

TL;DR Dell released urgent security updates for its thin client management platform. Two critical Dell Wyse vulnerabilities allow attackers to execute arbitrary code. Network administrators must a…

TL;DR Attackers began exploiting the Kemp LoadMaster RCE vulnerability, tracked as CVE-2026-8037, on June 29, 2026. That timing matched the public release of proof-of-concept exploit code. The fla…

TL;DR WatchGuard has patched seven WatchGuard Firebox vulnerabilities in its Fireware OS. The worst, CVE-2026-13368 (CVSS 9.2), lets a remote unauthenticated attacker run code on affected applianc…

Siber güvenlik dünyasında “en tehlikeli” zafiyetlerin başında gelen Remote Code Execution (RCE), bir saldırganın hedef sistem üzerinde…

Introduction

TL;DR Researchers have published full technical details and proof-of-concept code for a SharePoint remote code execution flaw. Tracked as CVE-2026-33112 (CVSS 8.8), it lets a low-privilege user ru…

TL;DR CISA published an advisory for three flaws in the Gardyn IoT Hub, the controller for Gardyn’s indoor smart gardens. The worst, CVE-2026-13768, earns a maximum CVSS score of 10 and allo…

TL;DR ServiceNow has patched a critical ServiceNow sandbox escape flaw, tracked as CVE-2026-6875 (CVSS 9.5), in its AI Platform. The bug could let an unauthenticated attacker, in certain circumsta…

TL;DR Netwrix has fixed two Netwrix Password Secure vulnerabilities disclosed in advisory ADV-2026-008. The most severe flaw, rated CVSS 3.1 9.9 (CVSS 4.0 9.4), lets an authenticated attacker achi…

TL;DR Four critical Coolify vulnerabilities now have patches. Three score CVSS 9.9, and they let low-privileged members reach remote code execution as root. The maintainers fixed them across sever…

TL;DR The Zero Day Initiative published advisory ZDI-26-444 on July 15, 2026. It covers a 7-Zip vulnerability tracked as CVE-2026-14266, scored CVSS 7.0, that can lead to remote code execution. Ve…

TL;DR Metabase has patched three critical flaws in its H2 database handling. Two carry CVE IDs and enable Metabase remote code execution. CVE-2026-59827 scores 9.9 on CVSS, and CVE-2026-59826 scor…

TL;DR SonicWall patched a critical SonicWall SMA1000 vulnerability, CVE-2026-15409, on July 14, 2026. Attackers are exploiting it in the wild to reach remote code execution. A public proof-of-conc…

NGINX developer F5 recently published a fresh security advisory about a dangerous bug. This flaw receives the tracking number CVE-2026-42533. Under certain settings, a hacker can easily exploit th…

TL;DR CVE-2026-50522 is a critical SharePoint RCE flaw rated CVSS 9.8. Researchers report active exploitation attempts, and a public proof-of-concept exploit is now available. Microsoft patched th…

TL;DR Researcher Kirill Firsov disclosed a fastjson RCE on July 19, 2026. It affects fastjson 1.2.68 through 1.2.83 under stock default settings. Full technical details are public, and third parti…

TL;DR CERT/CC published vulnerability note VU#326070 on July 16, 2026. It details an SGLang vulnerability, CVE-2026-14890, rated CVSS 9.1. An unauthenticated attacker can run code on the host, and…

TL;DR A researcher published full technical details and working proof-of-concept exploit code for a Knot Resolver RCE bug. The heap out-of-bounds write sits in the DNS-over-QUIC listener and needs…

TL;DR A critical FastJson RCE vulnerability, CVE-2026-16723, carries a CVSS score of 9.0. Full technical details and working proof-of-concept exploit code are now public. Imperva reports active ex…