Exploited bugs, new critical vulnerabilities, and what defenders should check.
ExploitedCVE-2026-7273CVSS 8.82 min read
Attackers compromised nearly 1,000 switches across 48 countries before the flaw was identified as a separate bug from the one CISA flagged in September.
ExploitedCVE-2023-2868CVSS 9.42 min read
An authentication bypass in Email Security Gateway and a command injection in shared appliance code can be combined for root access, Barracuda says.
ExploitedCVE-2026-119977CVSS 8.12 min read
The bug is a race condition in full-package core upgrades that can let an unauthenticated attacker run code on the server during the upgrade window. CISA set a November 6 remediation deadline.
CVE-2026-98432CVSS 9.82 min read
Fixed kernels for Red Hat Enterprise Linux 8, 9 and 10 are out. Ubuntu's fixes for its three newest long-term-support releases are still in the opt-in testing channel, with no date for a regular update.
ExploitedCVE-2026-116606CVSS 9.32 min read
Barracuda says the bugs only matter to someone who can already reach the admin interface, and that combining them gets an attacker root on the appliance.
ExploitedCVE-2026-116606CVSS 9.31 min read
A pre-authentication authorization bypass and a command injection can be combined, according to Barracuda's disclosure. The advisory doesn't say anyone has done it.
CVE-2026-58115CVSS 10.02 min read
VulnCheck says attackers are scanning for Node-RED instances without adminAuth and firing a single HTTP request to plant bots and webshells.
CVE-2026-81648CVSS 10.01 min read
Defused Cyber says exploitation attempts are hitting a maximum-severity bug in the WordPress plugin, which can let unauthenticated users delete files and pull wallet credentials.
CVE-2026-58115CVSS 10.02 min read
VulnCheck reports attackers are exploiting a maximum-severity missing-authentication bug in Siemens SIMATIC IoT2050 Advanced devices to plant remote command backdoors.
Brief1 min read
Microsoft has documented fixes for a Windows issue that could prevent enabling Smart App Control, with different guidance for affected Windows versions.
CVE-2026-110186CVSS 9.81 min read
IBM lists multiple Langflow vulnerabilities with different authentication requirements; operators should review the affected releases and remediation.
CVE-2026-112816CVSS 10.01 min read
A certificate-validation flaw affects remote API authentication in Canonical LXD and MicroCloud; administrators should review fixed snap releases.
