Vulnerabilities and patches

Vulnerabilities with fixes or active exploitation, from what needs action today to what you can plan.

137incidents in 30 days
33critical
30exploited
20updated in 24h

SonicWall Global Management System · Exploitation confirmed

Critical unpatched SonicWall GMS flaw exposes internal files without authentication

SonicWall disclosed two vulnerabilities in its Global Management System (GMS): CVE-2026-109593 (CVSS 9.1) allows access to internal files without credentials or user interaction, and CVE-2026-109594 (CVSS 6.8) allows authenticated SQL injection. No patch exists because GMS 9.5.2 and earlier (Windows and Linux) are end-of-life; the source identifies no public PoC or confirmed exploitation. Isolate the GMS server, restrict access, and plan product replacement.

Nov 03, 2026 · 1 min read

PHP · Exploitation confirmed
PHP2Shell campaign reaches several hundred victims, researcher estimates
Nov 03, 2026 · 7 min read
Vulnerabilities and patchesFortinet FortiSIEM · Exploitation confirmed
Canada's Cyber Centre reports active exploitation of FortiSIEM RCE
Oct 26, 2026 · 1 min read
Firewalls Cisco ASA e FTD · Exploitation confirmed
Exploited Cisco ASA and FTD VPN Flaw Added to CISA KEV Catalog
Oct 29, 2026 · 2 min read
Vulnerabilities and patchesGoogle · Exploitation confirmed
CISA Confirms Active Node2Shell Exploitation as WordPress Vector Emerges
Nov 02, 2026 · 4 min read
Vulnerabilities and patchesLaravel framework TokenGuard · Public exploit code
Public PoC for critical Laravel TokenGuard bypass; 2.8 million installs exposed
Oct 26, 2026 · 1 min read
Vulnerabilities and patchesCisco SD-WAN · Exploitation confirmed
KeyDrift Stole Cisco SD-WAN Encryption Keys; Infrastructure Overlaps Volt Typhoon
Oct 29, 2026 · 1 min read
Google Android · Exploitation reported
Android Patches Zero-Click RCE CVE-2026-58868; Over 40% Too Old for Fix
Nov 03, 2026 · 1 min read
Vulnerabilities and patchesBroadcom VMware ESX · Exploitation confirmed
VMware ESX: CISA Confirms Exploited Logging Flaw; Fix in VMSA-2026-0006
Oct 30, 2026 · 2 min read
Vulnerabilities and patchesAtlassian · Exploitation confirmed
CISA confirms active exploitation of CVE-2026-21589 in Atlassian Data Center
Oct 27, 2026 · 1 min read
Vulnerabilities and patchesOracle PeopleSoft · Exploitation reported
Analysis: PeopleSoft zero-day used by ShinyHunters was three chained flaws
Oct 28, 2026 · 1 min read
Vulnerabilities and patchesAdobe Commerce e Magento · Exploitation confirmed
PolyShell Attacks Breach Hundreds of Stores; CISA Confirms Active Exploitation
Oct 28, 2026 · 1 min read
Ivanti Connect Secure · Exploitation confirmed
Ivanti Releases Patches for Connect Secure Zero-Days Exploited in Chain
Nov 02, 2026 · 1 min read

Critical unpatched SonicWall GMS flaw exposes internal files without authentication

PHP2Shell campaign reaches several hundred victims, researcher estimates

Canada's Cyber Centre reports active exploitation of FortiSIEM RCE

Exploited Cisco ASA and FTD VPN Flaw Added to CISA KEV Catalog

CISA Confirms Active Node2Shell Exploitation as WordPress Vector Emerges

Public PoC for critical Laravel TokenGuard bypass; 2.8 million installs exposed

KeyDrift Stole Cisco SD-WAN Encryption Keys; Infrastructure Overlaps Volt Typhoon

Android Patches Zero-Click RCE CVE-2026-58868; Over 40% Too Old for Fix

VMware ESX: CISA Confirms Exploited Logging Flaw; Fix in VMSA-2026-0006

CISA confirms active exploitation of CVE-2026-21589 in Atlassian Data Center

Analysis: PeopleSoft zero-day used by ShinyHunters was three chained flaws

PolyShell Attacks Breach Hundreds of Stores; CISA Confirms Active Exploitation

Ivanti Releases Patches for Connect Secure Zero-Days Exploited in Chain

Vulnerabilities and patches: get new ones every morning