VulnerabilitiesExploitedCVE-2026-116606CVSS 9.34 min read
Barracuda says attackers have chained an ESG authentication bypass with a command injection bug against a small number of organizations. CISA gave federal agencies three days to patch.
VulnerabilitiesAnalysis4 min read
A threat actor has been using a critical Xen Orchestra authentication bypass to gain admin access, and a second flaw the same actor used has no fix yet. Vates says unauthorised access isn't logged.
VulnerabilitiesAnalysis4 min read
Vates says attackers are using a crafted cookie to log in as existing token owners on Xen Orchestra, with the path leading to root on XCP-ng hosts. Patched xo-server packages are out.
VulnerabilitiesAnalysis3 min read
An independent researcher published details and proof-of-concept code for 33 issues in the RMM platform. N-able says it has seen scanning but no successful exploitation, and has no hotfix out yet.
VulnerabilitiesExploitedCVE-2026-102895CVSS 9.84 min read
SignalWire says the FreeSwitch code injection flaw has been exploited in the wild; CISA's KEV listing gives federal agencies until 12 November 2026 to apply mitigations.
VulnerabilitiesExploitedCVE-2026-123158CVSS 8.12 min read
WatchTowr and Previdian say attackers are hitting the recently patched OpenSSH flaw; so far the traffic looks like botnets and crypto miners.
VulnerabilitiesExploitedCVE-2026-19868CVSS 7.52 min read
SonicWall says it investigated a report of potential exploitation of the authentication bypass in SonicOS SSLVPN. CISA added it to KEV the same day.
VulnerabilitiesExploitedCVE-2026-123158CVSS 8.12 min read
On Alpine and other musl libc builds with PAM disabled, some accounts accept any password between 257 and 1,024 characters. Fixes are in OpenSSH 10.6p2.
Threat intelBrief2 min read
A joint advisory says attackers are going after unpatched or internet-facing temperature controllers in grocery and cold storage sites, after attacks on European supermarkets and blood storage.
VulnerabilitiesExploitedCVE-2023-2868CVSS 9.42 min read
An authentication bypass in Email Security Gateway and a command injection in shared appliance code can be combined for root access, Barracuda says.
VulnerabilitiesCVE-2026-110186CVSS 9.81 min read
IBM lists multiple Langflow vulnerabilities with different authentication requirements; operators should review the affected releases and remediation.
VulnerabilitiesExploitedCVE-2026-104935CVSS 8.62 min read
Ivanti updated its advisory on October 29 to add a privilege escalation bug and a file upload bug, both now fixed and both in CISA's KEV list. Volexity says the chain was used against an appliance from October 3.
