Product updates, the weekly threat signal, and monthly trends — what shipped, what's exploited, and where we're heading.
CVE-2026-10520 is a CVSS 10.0, EPSS 0.99, KEV-listed OS command injection in Ivanti Standalone Sentry that gives unauthenticated attackers root. There is no workaround — here is the fix path, the attack chain, and the honest status of public exploit code.
Microsoft's record July 2026 Patch Tuesday brought 570+ fixes and two exploited zero-days that scored 7.8 and 5.3, not 9.8. A pentester's take on why the big red number is the wrong sort order - and exactly what to fix first.
CVE-2026-56155 is an exploited AD FS elevation-of-privilege flaw. Its CVSS is a 'local' 7.8, but it lets a low-privileged attacker steal the token-signing key and forge identities across Microsoft 365 — the Golden SAML technique. Here's who's exposed, how the chain works, and how to fix it (patch, remediate the ACL, rotate keys) before the July 28 deadline.
Two Joomla extensions both got a CVSS 9.8 unauthenticated RCE and both landed in CISA KEV — but CVE-2026-48907 (JCE editor) carries an 80% EPSS versus its sibling's 1.6%. Here's how the JCE access-control flaw becomes a PHP webshell, and why EPSS is the tiebreaker when severity and KEV can't rank two bugs.
CVE-2026-56164 is an unauthenticated missing-authentication flaw in on-prem SharePoint Server. It scores just 5.3, but it's on CISA's KEV list and exploited in the wild. Here's who's exposed, how the chain works, and how to fix it before the July 17 deadline.
A CVSS 9.9 use-after-free in Windows VMSwitch lets a low-privileged guest VM escape to SYSTEM on the Hyper-V host. It's patched and not yet exploited — here's who's exposed, how the chain works, and how to fix it.
WavePlayer < 3.8.0 lets an anonymous attacker upload a PHP webshell in about two requests. Here's the exploitation chain, why EPSS and KEV both under-called it, and how to fix and hunt for it.
LiteLLM's MCP preview endpoints accepted a full stdio server config — command, args, env — and dutifully spawned it as a subprocess on the proxy host, gated by nothing but a valid API key. CVE-2026-42271 is authenticated remote command execution on your AI gateway. Here's the mechanism, who's exposed, and what to do today.
A single unauthenticated HTTP POST is enough to run your code on an internet-facing Langflow server. The endpoint POST /api/v1/buildpublictmp/{flowid}/flow is meant to be public — it builds public…
Most remote code execution bugs are about a parser you didn't know was reachable. CVE-2026-61447 is stranger and more modern: the component is designed to run code, and the code comes from a language…
One anonymous HTTP request is the whole exploit. SP Page Builder exposes an upload task, asset.uploadCustomIcon, that shipped with no authentication, no anti-CSRF token, and no server-side file-type…
CVE-2026-55255 lets any logged-in Langflow user execute another user's flow and coax out its embedded LLM, cloud and database secrets. EPSS is low, but it's on CISA KEV and exploited in the wild. Here's the chain, who's exposed, and how to shut it.
The Gitea Docker image shipped REVERSE_PROXY_TRUSTED_PROXIES=* by default. On instances that enabled reverse-proxy login, an unauthenticated request carrying X-WEBAUTH-USER: admin was enough to take over. Here is exactly how it works, who is actually exposed, and how to shut it down.
The flaw lets an attacker abuse ColdFusion's RDS file handler to write a file outside the directory it should be confined to -- and because the file lands in a web-reachable folder as executable…
CVE-2021-29441 lets anyone who can merely reach an Alibaba Nacos server perform any administrative action with no credentials. The flaw lives in the AuthFilter servlet filter, which was built with a…
Two new ways to be part of CVE Tools: leave feedback on any page in one click, and get notified — in the app and on your device — when something you care about happens.
There are over 340,000 published CVEs, and more land every day. Scroll any feed and it's a wall of severity badges. But almost none of them are your problem — and the ones that are, you can rarely…
CVE-2025-3248 lets anyone who can merely reach a Langflow server execute code on it with no credentials. The bug lives in POST /api/v1/validate/code -- an endpoint whose entire job is to check…
The flaw lets an authenticated SharePoint user send a crafted, malicious object to the server and have it run code -- classic untrusted-data deserialization. It is not the unauthenticated 2025…
Hey there 👋 This was a big one. Over the past few days your Stack turned into a real triage console, the CVSS page became a full toolkit, the homepage got a ground-up rewrite, and we added a…
