Product updates, the weekly threat signal, and monthly trends — what shipped, what's exploited, and where we're heading.
Some bugs are dangerous because they're clever. CVE-2025-67038 is dangerous because it's simple, it's on a device that should never have been on the internet, and it lands you at the doorway to an…
CVE-2026-45657 is the marquee bug of the June 2026 Patch Tuesday — a record 208-CVE release — and the reason it stands out is deceptively simple: the vulnerable surface is the Windows Kernel…
Microsoft labelled this one "Remote Code Execution." The CVSS vector tells the real story: AV:L / UI:R — a user previews or opens a crafted graphics file in the Windows File Explorer Preview Pane,…
The software running on your endpoints to catch malware just became the malware's foothold. CVE-2026-50656 — nicknamed RoguePlanet by the researcher who found and published it — is an Elevation…
CVE-2026-35273 is a critical (CVSS 9.8), unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 — specifically the Environment Management Hub…
SimpleHelp is remote-support / RMM software — the kind of tool that, by design, can remote into, transfer files to, and run scripts on every machine it manages. CVE-2026-48558 turns that reach…
On its own, CVE-2026-34910 is a command-injection flaw in a UniFi OS Server update endpoint. The reason it's an emergency is the company it keeps: Bishop Fox showed it chains with two sibling bugs…
FFmpeg's libavcodec is the quiet engine behind a staggering amount of the internet's media handling — media servers, file-sync previews, desktop thumbnailers, NAS boxes, and AI data pipelines all…
CVE-2026-24858 keeps showing up in coverage of FortiBleed — the credential-harvesting campaign that exposed tens of thousands of Fortinet devices — so it's worth separating the two cleanly. The…
On its own, CVE-2026-34910 is a command-injection flaw in a UniFi OS Server update endpoint. The reason it's an emergency is the company it keeps: Bishop Fox showed it chains with two sibling bugs…
Cisco's Catalyst SD-WAN management plane took another hit. CVE-2026-20245 lets an authenticated attacker who already holds netadmin rights run arbitrary commands as root on SD-WAN Controller…
Ubiquiti's UniFi OS collected three CVSS-10 bugs on CISA's KEV in one June 23 batch. A casual, no-FUD roundup of what's actually being exploited — and how to prioritise it.
Hey there 👋 It's been a busy couple of weeks, and almost all of it lands right where you'll see it. We've been making it easier to tell what actually matters today, to browse CVEs the way you…
Raw vulnerability data is a mess. The same vendor shows up spelled five different ways. A single product is scattered across dozens of near-duplicate version strings. Ask a simple question — "show…
Hey there 👋 It's been a big week. cve.tools grew two whole new public sections — a security news feed and monthly trend reports — and the database itself got smarter about who is affected, not…
Over the past two weeks we shipped the things you've been asking for: personal API keys, a public place to file bugs and ideas, and a much more lively landing page. Smaller polish along the way.
We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store
