Product updates, the weekly threat signal, and monthly trends — what shipped, what's exploited, and where we're heading.
CVE-2026-8037 lets an attacker who can merely reach a Progress LoadMaster's management API execute operating-system commands on the appliance as root, with no credentials. The bug lives in the API…
Cacti is the open-source performance and fault-monitoring framework that ISPs and enterprises use to graph network health — SNMP polling, RRDtool graphs, the works. CVE-2026-39893 lives in its…
Product lifecycle management (PLM) software rarely makes security headlines — but it holds the crown jewels: the CAD models, bills of materials, and manufacturing specs of aerospace, defense,…
CVE-2025-61882 lets an attacker who can merely reach your Oracle E-Business Suite web tier run code on it -- no login, no user interaction. It is not theoretical: it powered a mass data-theft and…
CVE-2026-46817 lets an attacker who can merely reach your Oracle E-Business Suite over HTTP read files off the server -- no login, no user interaction. The bug lives in the Oracle Payments (iPayment)…
A CVSS calculator turns a vector into a 0–10 number in a second — the trap is treating that number as your risk. Here's how to read the score, recompute it for your environment, and layer EPSS and CISA KEV on top to actually prioritize.
Hey there 👋 The last few days were all about making the why clearer — a sharper read on what a CVE actually means, and a proper home for these very updates. Here's what landed.
Some bugs are dangerous because they're clever. CVE-2025-67038 is dangerous because it's simple, it's on a device that should never have been on the internet, and it lands you at the doorway to an…
CVE-2026-45657 is the marquee bug of the June 2026 Patch Tuesday — a record 208-CVE release — and the reason it stands out is deceptively simple: the vulnerable surface is the Windows Kernel…
Microsoft labelled this one "Remote Code Execution." The CVSS vector tells the real story: AV:L / UI:R — a user previews or opens a crafted graphics file in the Windows File Explorer Preview Pane,…
The software running on your endpoints to catch malware just became the malware's foothold. CVE-2026-50656 — nicknamed RoguePlanet by the researcher who found and published it — is an Elevation…
CVE-2026-35273 is a critical (CVSS 9.8), unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 — specifically the Environment Management Hub…
SimpleHelp is remote-support / RMM software — the kind of tool that, by design, can remote into, transfer files to, and run scripts on every machine it manages. CVE-2026-48558 turns that reach…
On its own, CVE-2026-34910 is a command-injection flaw in a UniFi OS Server update endpoint. The reason it's an emergency is the company it keeps: Bishop Fox showed it chains with two sibling bugs…
FFmpeg's libavcodec is the quiet engine behind a staggering amount of the internet's media handling — media servers, file-sync previews, desktop thumbnailers, NAS boxes, and AI data pipelines all…
CVE-2026-24858 keeps showing up in coverage of FortiBleed — the credential-harvesting campaign that exposed tens of thousands of Fortinet devices — so it's worth separating the two cleanly. The…
On its own, CVE-2026-34910 is a command-injection flaw in a UniFi OS Server update endpoint. The reason it's an emergency is the company it keeps: Bishop Fox showed it chains with two sibling bugs…
Cisco's Catalyst SD-WAN management plane took another hit. CVE-2026-20245 lets an authenticated attacker who already holds netadmin rights run arbitrary commands as root on SD-WAN Controller…
Ubiquiti's UniFi OS collected three CVSS-10 bugs on CISA's KEV in one June 23 batch. A casual, no-FUD roundup of what's actually being exploited — and how to prioritise it.
Hey there 👋 It's been a busy couple of weeks, and almost all of it lands right where you'll see it. We've been making it easier to tell what actually matters today, to browse CVEs the way you…
