Product updates, the weekly threat signal, and monthly trends — what shipped, what's exploited, and where we're heading.
CVE-2026-46817 lets an attacker who can merely reach your Oracle E-Business Suite over HTTP read files off the server -- no login, no user interaction. The bug lives in the Oracle Payments (iPayment)…
A CVSS calculator turns a vector into a 0–10 number in a second — the trap is treating that number as your risk. Here's how to read the score, recompute it for your environment, and layer EPSS and CISA KEV on top to actually prioritize.
Hey there 👋 The last few days were all about making the why clearer — a sharper read on what a CVE actually means, and a proper home for these very updates. Here's what landed.
Some bugs are dangerous because they're clever. CVE-2025-67038 is dangerous because it's simple, it's on a device that should never have been on the internet, and it lands you at the doorway to an…
CVE-2026-45657 is the marquee bug of the June 2026 Patch Tuesday — a record 208-CVE release — and the reason it stands out is deceptively simple: the vulnerable surface is the Windows Kernel…
Microsoft labelled this one "Remote Code Execution." The CVSS vector tells the real story: AV:L / UI:R — a user previews or opens a crafted graphics file in the Windows File Explorer Preview Pane,…
The software running on your endpoints to catch malware just became the malware's foothold. CVE-2026-50656 — nicknamed RoguePlanet by the researcher who found and published it — is an Elevation…
CVE-2026-35273 is a critical (CVSS 9.8), unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 — specifically the Environment Management Hub…
SimpleHelp is remote-support / RMM software — the kind of tool that, by design, can remote into, transfer files to, and run scripts on every machine it manages. CVE-2026-48558 turns that reach…
On its own, CVE-2026-34910 is a command-injection flaw in a UniFi OS Server update endpoint. The reason it's an emergency is the company it keeps: Bishop Fox showed it chains with two sibling bugs…
FFmpeg's libavcodec is the quiet engine behind a staggering amount of the internet's media handling — media servers, file-sync previews, desktop thumbnailers, NAS boxes, and AI data pipelines all…
CVE-2026-24858 keeps showing up in coverage of FortiBleed — the credential-harvesting campaign that exposed tens of thousands of Fortinet devices — so it's worth separating the two cleanly. The…
On its own, CVE-2026-34910 is a command-injection flaw in a UniFi OS Server update endpoint. The reason it's an emergency is the company it keeps: Bishop Fox showed it chains with two sibling bugs…
Cisco's Catalyst SD-WAN management plane took another hit. CVE-2026-20245 lets an authenticated attacker who already holds netadmin rights run arbitrary commands as root on SD-WAN Controller…
Ubiquiti's UniFi OS collected three CVSS-10 bugs on CISA's KEV in one June 23 batch. A casual, no-FUD roundup of what's actually being exploited — and how to prioritise it.
Hey there 👋 It's been a busy couple of weeks, and almost all of it lands right where you'll see it. We've been making it easier to tell what actually matters today, to browse CVEs the way you…
Raw vulnerability data is a mess. The same vendor shows up spelled five different ways. A single product is scattered across dozens of near-duplicate version strings. Ask a simple question — "show…
Hey there 👋 It's been a big week. cve.tools grew two whole new public sections — a security news feed and monthly trend reports — and the database itself got smarter about who is affected, not…
Over the past two weeks we shipped the things you've been asking for: personal API keys, a public place to file bugs and ideas, and a much more lively landing page. Smaller polish along the way.
