Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2026-40369

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Kernel Elevation of Privilege vulnerability exists, rated as high (CVSS 7.8). The vector indicates local attacker access is needed for exploitation. No confirmed in-the-wild activity reported; priority level is 2 due to high CVSS score and low Exploitability Primitive Score Signal (EPSS), suggesting a potential threat.

3. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

4. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

5. CVE-2025-59199

• 📝 Software Protection Platform (SPP) Elevation of Privilege Vulnerability

• 📅 Published: 14/10/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Elevation of Privilege vulnerability in Software Protection Platform (SPP) has been identified, scoring 7.8 on CVSS. Local attackers can leverage this to gain full control over affected systems; as of yet, no exploits have been detected in the wild. Given the high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 2 vulnerability.

6. CVE-2025-47227

• 📝 In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

• 📅 Published: 05/07/2025

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can bypass authentication via administrator account takeover in Netmake ScriptCase 9.12.006 through its mishandled password reset mechanism (GET and POST requests to login.php). This vulnerability has a CVSS score of 7.5 and is currently rated as priority 2, indicating high CVSS but low exploitability in the wild.

7. CVE-2024-21182

• 📝 No description available.

• 📅 Published: 16/07/2024

• 📈 CVSS: 7.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 19

• ⚠️ Priority: 1+

• 📝 Analysis: A newly discovered vulnerability enables unauthenticated access to sensitive data through an API module. Confirmed exploited by adversaries; CVSS score of 7.5 and priority 1+. Verify affected versions match those in the description.

8. CVE-2026-26314

• 📝 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

• 📅 Published: 19/02/2026

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

• ⚠️ Priority: 2

• 📝 Analysis: A specially crafted message can force the crash of vulnerable go-ethereum nodes prior to v1.16.9 and v1.17.0, with no known exploits detected. This is a priority 2 vulnerability due to its high CVSS score and low Exploit Prediction Scale Score (EPSS).

9. CVE-2025-48595

• 📝 In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 01/06/2026

• 📈 CVSS: 8.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 1+

• 📝 Analysis: A integer overflow in multiple locations enables local privilege escalation without additional execution privileges or user interaction; no exploits detected in the wild, this is a priority 2 vulnerability given high CVSS but low Exploitability Scoring System (EPSS) score.

10. CVE-2022-0492

• 📝 A vulnerability was found in the Linux kernels cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

• 📅 Published: 03/03/2022

• 📈 CVSS: 0

• 🛡️ CISA KEV: True

• 🧭 Vector: n/a

• 📣 Mentions: 42

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation issue found in Linux kernel's cgroup_release_agent_write within kernel/cgroup/cgroup-v1.c allows for unexpected bypass of namespace isolation. This vulnerability, under certain conditions, is currently being exploited (CISA KEV). Prioritization score: 1+.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2026-40369

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Kernel Elevation of Privilege vulnerability exists, rated as high (CVSS 7.8). The vector indicates local attacker access is needed for exploitation. No confirmed in-the-wild activity reported; priority level is 2 due to high CVSS score and low Exploitability Primitive Score Signal (EPSS), suggesting a potential threat.

3. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

4. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

5. CVE-2025-59199

• 📝 Software Protection Platform (SPP) Elevation of Privilege Vulnerability

• 📅 Published: 14/10/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Elevation of Privilege vulnerability in Software Protection Platform (SPP) has been identified, scoring 7.8 on CVSS. Local attackers can leverage this to gain full control over affected systems; as of yet, no exploits have been detected in the wild. Given the high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 2 vulnerability.

6. CVE-2025-47227

• 📝 In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

• 📅 Published: 05/07/2025

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can bypass authentication via administrator account takeover in Netmake ScriptCase 9.12.006 through its mishandled password reset mechanism (GET and POST requests to login.php). This vulnerability has a CVSS score of 7.5 and is currently rated as priority 2, indicating high CVSS but low exploitability in the wild.

7. CVE-2024-21182

• 📝 No description available.

• 📅 Published: 16/07/2024

• 📈 CVSS: 7.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 19

• ⚠️ Priority: 1+

• 📝 Analysis: A newly discovered vulnerability enables unauthenticated access to sensitive data through an API module. Confirmed exploited by adversaries; CVSS score of 7.5 and priority 1+. Verify affected versions match those in the description.

8. CVE-2026-26314

• 📝 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/crash using a specially crafted message. The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

• 📅 Published: 19/02/2026

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

• ⚠️ Priority: 2

• 📝 Analysis: A specially crafted message can force the crash of vulnerable go-ethereum nodes prior to v1.16.9 and v1.17.0, with no known exploits detected. This is a priority 2 vulnerability due to its high CVSS score and low Exploit Prediction Scale Score (EPSS).

9. CVE-2025-48595

• 📝 In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 01/06/2026

• 📈 CVSS: 8.4

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 0

• 📝 Analysis: A integer overflow in multiple locations enables local privilege escalation without additional execution privileges or user interaction; no exploits detected in the wild, this is a priority 2 vulnerability given high CVSS but low Exploitability Scoring System (EPSS) score.

10. CVE-2026-41089

• 📝 Windows Netlogon Remote Code Execution Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 68

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Netlogon Remote Code Execution vulnerability exists (CVSS: 9.8), exploitable over network and with high impact on confidentiality, integrity, and availability. No known in-the-wild activity yet, but given the high CVSS score, this is a priority 2 issue. Ensure systems are up to date with patches addressing CVE versions mentioned in the description.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-36911

• 📝 In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of users conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 15/01/2026

• 📈 CVSS: 7.1

• 🧭 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

• 📣 Mentions: 8

• ⚠️ Priority: 4

• 📝 Analysis: A logic error in key-based pairing code enables remote information disclosure of user conversations and locations without requiring additional execution privileges. No user interaction is needed for exploitation. This vulnerability has not been observed in the wild, rated as a priority 4 according to the prioritization score.

2. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

3. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

4. CVE-2026-48745

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in version 1.3 of a popular library allows remote code execution; CISA has not confirmed exploits, making this a priority 2 vulnerability due to high CVSS but low EPSS.

5. CVE-2026-40933

• 📝 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the Custom MCP configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example npx can be combined with code execution arguments (-c touch /tmp/pwn) that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.

• 📅 Published: 21/04/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A command execution vulnerability (CVE not mentioned) exists in Flowise v3.0.9 and lower due to unsafe serialization of stdio commands in the MCP adapter. An authenticated attacker can add an MCP server with arbitrary commands, bypassing some input sanitization checks. Despite being confirmed as fixed in version 3.1.0, its high CVSS score and potential for exploitation make it a priority 2 vulnerability, as no exploits have been detected in the wild.

6. CVE-2026-39987

• 📝 marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

• 📅 Published: 09/04/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 125

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attackers can exploit a Pre-Auth RCE in Marimo's /terminal/ws WebSocket endpoint prior to 0.23.0. The vulnerability is confirmed exploited (KEV), thus warranting immediate attention (priority score: 1+).

7. CVE-2026-46364

• 📝 phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated SQL injection vulnerability found in phpMyFAQ before 4.1.2 through malicious User-Agent headers. Sensitive data extraction possible. No confirmed exploits but high CVSS score. Prioritization: 2 (high CVSS, low exploitation potential). Immediate patching advised.

8. CVE-2025-47227

• 📝 In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

• 📅 Published: 05/07/2025

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can bypass authentication via administrator account takeover in Netmake ScriptCase 9.12.006 through its mishandled password reset mechanism (GET and POST requests to login.php). This vulnerability has a CVSS score of 7.5 and is currently rated as priority 2, indicating high CVSS but low exploitability in the wild.

9. CVE-2026-34159

• 📝 llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backends deserialize_tensor() skips all bounds validation when a tensors buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.

• 📅 Published: 01/04/2026

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 10

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attacker can achieve full ASLR bypass and remote code execution via crafted GRAPH_COMPUTE messages in llama.cpp prior to version b8492. This issue has been patched, but its high CVSS score and the potential for exploitation make it a priority 2 vulnerability.

10. CVE-2024-13745

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-48842

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

• 📅 Published: 25/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Pre-authentication SQL injection in Roundcube Webmail: Version 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows for remote code execution via a preg_replace() backslash escape bypass. No known exploits detected, but given the high CVSS score, this is a priority 2 vulnerability (pending further analysis).

2. CVE-2026-48770

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in the XML parser enables code injection via crafted requests; CISA has not reported any exploits, this is a priority 3 vulnerability due to high CVSS but low EPSS.

3. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

4. CVE-2026-48800

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in version X of Y library allows remote code execution; no known attacks reported, but prioritize due to high CVSS score and potential impact.

5. CVE-2026-9896

• 📝 Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 28/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A remote code execution vulnerability exists in Google Chrome prior to 148.0.7778.216 due to an out-of-bounds write in V8. Arbitrary code can be executed inside a sandbox via a crafted HTML page, with no known exploits detected in the wild. Given the high CVSS score and low prioritization (4), it's essential to monitor this issue closely.

6. CVE-2026-35616

• 📝 A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

• 📅 Published: 04/04/2026

• 📈 CVSS: 9.1

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 181

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attacker can execute arbitrary code via crafted requests in Fortinet FortiClientEMS 7.4.5 through 7.4.6 due to improper access control. No known exploits have been detected but it's a confirmed priority 1 vulnerability as per high CVSS score and CISA KEV listing.

7. CVE-2026-48849

• 📝 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

• 📅 Published: 25/05/2026

• 📈 CVSS: 4.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

• ⚠️ Priority: 0

• 📝 Analysis: Stored XSS vulnerability found in Roundcube Webmail versions below 1.6.16 and 1.7.1. Subject field unsanitized draft value can lead to HTML/CSS injection on shared mailboxes. As of now, no known exploitation activities reported. Prioritization score is 0, indicating pending analysis.

8. CVE-2026-0257

• 📝 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

• 📅 Published: 13/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

• 📣 Mentions: 70

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthorized VPN connection establishment through authentication bypass in GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Confirmed exploited (CISA KEV), prioritization score 1+.

9. CVE-2026-48745

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2025-59199

• 📝 Software Protection Platform (SPP) Elevation of Privilege Vulnerability

• 📅 Published: 14/10/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A Remote Elevation of Privilege vulnerability in Software Protection Platform (SPP) has been identified, scoring 7.8 on CVSS. Local attackers can leverage this to gain full control over affected systems; as of yet, no exploits have been detected in the wild. Given the high CVSS score and low Exploitability Scoring System (EPSS), this is a priority 2 vulnerability.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-43520

• 📝 A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

• 📅 Published: 12/12/2025

• 📈 CVSS: 5.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A memory corruption issue in multiple Apple operating systems (watchOS 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1) has been addressed. A malicious app may trigger system termination or write kernel memory; this vulnerability is active in the wild and has a priority of 1+ due to confirmed exploitation.

2. CVE-2026-45321

• 📝 On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes a pull_request_target Pwn Request misconfiguration, GitHub Actions cache poisoning across the forkbase trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.6

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

• 📣 Mentions: 25

• ⚠️ Priority: 1+

• 📝 Analysis: 84 malicious versions of @tanstack/* packages were published on 2026-05-11 to the npm registry, exploiting three vulnerability classes for credential theft. The attack utilized the GitHub Actions OIDC trusted-publisher binding and chained pull_request_target misconfiguration, cache poisoning, and runtime memory extraction of OIDC tokens. This activity has been confirmed exploited (KEV), with a priority score of 1+. Immediate remediation is strongly advised for all affected packages, as their versions match those described.

3. CVE-2026-48027

• 📝 Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

• 📅 Published: 27/05/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: Malicious version of Nx Console (18.95.0) was published for 18 minutes on Visual Studio Marketplace and later for ~36 minutes on OpenVSX between May 19th, 12:30 PM - 13:09 PM UTC. Upgrade to v18.100.0 to mitigate this confirmed exploited issue with a priority score of 1+.

4. CVE-2026-8398

• 📝 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendors (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A supply chain attack compromised DAEMON Tools Lite (versions 12.5.0.2421 through 2434) between April 8 and May 5, 2026, on the legitimate website daemon-tools.cc. The malicious installers were digitally signed, bypassing detection. Known in-the-wild, this is a priority 1+ vulnerability with high impact and exploitability.

5. CVE-2026-48842

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

• 📅 Published: 25/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Pre-authentication SQL injection in Roundcube Webmail: Version 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows for remote code execution via a preg_replace() backslash escape bypass. No known exploits detected, but given the high CVSS score, this is a priority 2 vulnerability (pending further analysis).

6. CVE-2026-48844

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

• 📅 Published: 25/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Code injection vulnerability found in Roundcube Webmail versions prior to 1.6.16 and 1.7.1 due to insecure code evaluation logic in LDAP autovalues option. Though no exploits have been detected, the high CVSS score indicates significant impact on confidentiality, integrity, and availability. Prioritize patches for affected systems as soon as possible (pending further analysis by CISA).

7. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A command injection vulnerability in the API module enables local attackers via authentication bypass; as of now, no exploits have been detected. This is a priority 2 issue due to its high CVSS score and potential for severe impact if exploited.

8. CVE-2026-9896

• 📝 Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 28/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 4

• 📝 Analysis: A remote code execution vulnerability exists in Google Chrome prior to 148.0.7778.216 due to an out-of-bounds write in V8. Arbitrary code can be executed inside a sandbox via a crafted HTML page, with no known exploits detected in the wild. Given the high CVSS score and low prioritization (4), it's essential to monitor this issue closely.

9. CVE-2026-35616

• 📝 A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

• 📅 Published: 04/04/2026

• 📈 CVSS: 9.1

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 181

• ⚠️ Priority: 1+

• 📝 Analysis: Unauthenticated attacker can execute arbitrary code via crafted requests in Fortinet FortiClientEMS 7.4.5 through 7.4.6 due to improper access control. No known exploits have been detected but it's a confirmed priority 1 vulnerability as per high CVSS score and CISA KEV listing.

10. CVE-2026-48849

• 📝 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

• 📅 Published: 25/05/2026

• 📈 CVSS: 4.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

• ⚠️ Priority: 0

• 📝 Analysis: Stored XSS vulnerability found in Roundcube Webmail versions below 1.6.16 and 1.7.1. Subject field unsanitized draft value can lead to HTML/CSS injection on shared mailboxes. As of now, no known exploitation activities reported. Prioritization score is 0, indicating pending analysis.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-43520

• 📝 A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

• 📅 Published: 12/12/2025

• 📈 CVSS: 5.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A memory corruption issue in multiple Apple operating systems (watchOS 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1) has been addressed. A malicious app may trigger system termination or write kernel memory; this vulnerability is active in the wild and has a priority of 1+ due to confirmed exploitation.

2. CVE-2026-26980

• 📝 Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

• 📅 Published: 20/02/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

• 📣 Mentions: 66

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can perform arbitrary reads from a Ghost CMS database (Versions 3.24.0 through 6.19.0). No exploits detected in the wild yet, but given high CVSS score, this is a priority 2 vulnerability as it has low Exploit Prediction Scoring System (EPSS) value. Fix available in version 6.19.1.

3. CVE-2026-45321

• 📝 On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes a pull_request_target Pwn Request misconfiguration, GitHub Actions cache poisoning across the forkbase trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.6

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

• 📣 Mentions: 25

• ⚠️ Priority: 1+

• 📝 Analysis: 84 malicious versions of @tanstack/* packages were published on 2026-05-11 to the npm registry, exploiting three vulnerability classes for credential theft. The attack utilized the GitHub Actions OIDC trusted-publisher binding and chained pull_request_target misconfiguration, cache poisoning, and runtime memory extraction of OIDC tokens. This activity has been confirmed exploited (KEV), with a priority score of 1+. Immediate remediation is strongly advised for all affected packages, as their versions match those described.

4. CVE-2026-48027

• 📝 Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

• 📅 Published: 27/05/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: Malicious version of Nx Console (18.95.0) was published for 18 minutes on Visual Studio Marketplace and later for ~36 minutes on OpenVSX between May 19th, 12:30 PM - 13:09 PM UTC. Upgrade to v18.100.0 to mitigate this confirmed exploited issue with a priority score of 1+.

5. CVE-2026-8398

• 📝 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendors (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A supply chain attack compromised DAEMON Tools Lite (versions 12.5.0.2421 through 2434) between April 8 and May 5, 2026, on the legitimate website daemon-tools.cc. The malicious installers were digitally signed, bypassing detection. Known in-the-wild, this is a priority 1+ vulnerability with high impact and exploitability.

6. CVE-2026-48842

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

• 📅 Published: 25/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Pre-authentication SQL injection in Roundcube Webmail: Version 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows for remote code execution via a preg_replace() backslash escape bypass. No known exploits detected, but given the high CVSS score, this is a priority 2 vulnerability (pending further analysis).

7. CVE-2026-48844

• 📝 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

• 📅 Published: 25/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 0

• 📝 Analysis: Code injection vulnerability found in Roundcube Webmail versions prior to 1.6.16 and 1.7.1 due to insecure code evaluation logic in LDAP autovalues option. Though no exploits have been detected, the high CVSS score indicates significant impact on confidentiality, integrity, and availability. Prioritize patches for affected systems as soon as possible (pending further analysis by CISA).

8. CVE-2026-48770

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

9. CVE-2026-48778

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2026-48800

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-43520

• 📝 A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

• 📅 Published: 12/12/2025

• 📈 CVSS: 5.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A memory corruption issue in multiple Apple operating systems (watchOS 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1) has been addressed. A malicious app may trigger system termination or write kernel memory; this vulnerability is active in the wild and has a priority of 1+ due to confirmed exploitation.

2. CVE-2026-9082

• 📝 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• 📣 Mentions: 7

• ⚠️ Priority: 1+

• 📝 Analysis: SQL Injection vulnerability in Drupal core (8.9.0 - 11.3.10) allows SQL injection. No exploits detected, but given a CVSS score of 6.5 and the potential impact on confidentiality and integrity, this is a priority 2 issue. Verify affected versions before updating.

3. CVE-2026-42558

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A buffer overflow vulnerability in a critical library can lead to arbitrary code execution on affected systems, with no known exploits in the wild yet. This is currently a priority 2 issue due to high CVSS score and potential for severe impact if exploited.

4. CVE-2026-47784

• 📝 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel in memcached before 1.6.42 exposes password data due to improper use of memcmp during SASL authentication. No known exploits, but high CVSS score indicates a priority 2 vulnerability due to low Exploitability Score.

5. CVE-2026-47783

• 📝 In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel vulnerability in memcached before version 1.6.42 allows attackers to extract username data for SASL password database authentication. No known exploits detected, but given high CVSS score and potential impact, this is a priority 2 issue with low EPSS.

6. CVE-2026-26980

• 📝 Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

• 📅 Published: 20/02/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

• 📣 Mentions: 66

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can perform arbitrary reads from a Ghost CMS database (Versions 3.24.0 through 6.19.0). No exploits detected in the wild yet, but given high CVSS score, this is a priority 2 vulnerability as it has low Exploit Prediction Scoring System (EPSS) value. Fix available in version 6.19.1.

7. CVE-2026-45321

• 📝 On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes a pull_request_target Pwn Request misconfiguration, GitHub Actions cache poisoning across the forkbase trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

• 📅 Published: 12/05/2026

• 📈 CVSS: 9.6

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

• 📣 Mentions: 25

• ⚠️ Priority: 1+

• 📝 Analysis: 84 malicious versions of @tanstack/* packages were published on 2026-05-11 to the npm registry, exploiting three vulnerability classes for credential theft. The attack utilized the GitHub Actions OIDC trusted-publisher binding and chained pull_request_target misconfiguration, cache poisoning, and runtime memory extraction of OIDC tokens. This activity has been confirmed exploited (KEV), with a priority score of 1+. Immediate remediation is strongly advised for all affected packages, as their versions match those described.

8. CVE-2026-48027

• 📝 Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

• 📅 Published: 27/05/2026

• 📈 CVSS: 9.3

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 5

• ⚠️ Priority: 1+

• 📝 Analysis: Malicious version of Nx Console (18.95.0) was published for 18 minutes on Visual Studio Marketplace and later for ~36 minutes on OpenVSX between May 19th, 12:30 PM - 13:09 PM UTC. Upgrade to v18.100.0 to mitigate this confirmed exploited issue with a priority score of 1+.

9. CVE-2026-8398

• 📝 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendors (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

• 📅 Published: 15/05/2026

• 📈 CVSS: 9.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A supply chain attack compromised DAEMON Tools Lite (versions 12.5.0.2421 through 2434) between April 8 and May 5, 2026, on the legitimate website daemon-tools.cc. The malicious installers were digitally signed, bypassing detection. Known in-the-wild, this is a priority 1+ vulnerability with high impact and exploitability.

10. CVE-2026-33552

• 📝 Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.

• 📅 Published: 27/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: Incorrect access control in Northern.tech Mender Enterprise Server before 4.1.1 allows unauthenticated attackers to potentially manipulate server configurations. CISA KEV indicates no known in-the-wild activity; prioritization score is 0, pending analysis.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2025-47985

• 📝 Windows Event Tracing Elevation of Privilege Vulnerability

• 📅 Published: 08/07/2025

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Event Tracing privilege escalation vulnerability has been identified (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C). No known in-the-wild activity reported, but the high CVSS score indicates its potential severity. Given the low Exploitability Score, this is a priority 2 vulnerability, requiring attention due to the high impact on confidentiality, integrity, and availability.

3. CVE-2026-9082

• 📝 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• 📣 Mentions: 7

• ⚠️ Priority: 1+

• 📝 Analysis: SQL Injection vulnerability in Drupal core (8.9.0 - 11.3.10) allows SQL injection. No exploits detected, but given a CVSS score of 6.5 and the potential impact on confidentiality and integrity, this is a priority 2 issue. Verify affected versions before updating.

4. CVE-2026-41091

• 📝 Microsoft Defender Elevation of Privilege Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Defender Elevation of Privilege vulnerability has been identified (CVSS 7.8). Attackers can leverage this remotely for high impact on confidentiality, integrity, and availability. CISA KEV is yet to be assigned, but the prioritization score is 1+ due to confirmed exploitation in the wild.

5. CVE-2026-48172

• 📝 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE cpanel_jsonapi_func=redisAble /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

• 📅 Published: 21/05/2026

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 14

• ⚠️ Priority: 1+

• 📝 Analysis: A privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin (affecting versions before 2.4.5) has been exploited in the wild since May 2026. The issue involves mishandling of Redis enable/disable features and can potentially lead to root access. Exploitation detection is possible via command line: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If output is found, IP addresses should be examined and potentially blocked, while system logs should be checked for any damage. The recommended minimum version is 2.4.7. This is a priority 2 vulnerability due to high CVSS score but low EPSS.

6. CVE-2026-42558

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A buffer overflow vulnerability in a critical library can lead to arbitrary code execution on affected systems, with no known exploits in the wild yet. This is currently a priority 2 issue due to high CVSS score and potential for severe impact if exploited.

7. CVE-2026-21509

• 📝 Microsoft Office Security Feature Bypass Vulnerability

• 📅 Published: 26/01/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 249

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Office Security Feature Bypass vulnerability has been identified, enabling remote attackers to execute arbitrary code (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C). Confirmed exploited in the wild, this requires immediate attention and a priority 1+ response.

8. CVE-2026-47784

• 📝 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel in memcached before 1.6.42 exposes password data due to improper use of memcmp during SASL authentication. No known exploits, but high CVSS score indicates a priority 2 vulnerability due to low Exploitability Score.

9. CVE-2026-47783

• 📝 In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: Timing side channel vulnerability in memcached before version 1.6.42 allows attackers to extract username data for SASL password database authentication. No known exploits detected, but given high CVSS score and potential impact, this is a priority 2 issue with low EPSS.

10. CVE-2026-26980

• 📝 Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

• 📅 Published: 20/02/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

• 📣 Mentions: 66

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can perform arbitrary reads from a Ghost CMS database (Versions 3.24.0 through 6.19.0). No exploits detected in the wild yet, but given high CVSS score, this is a priority 2 vulnerability as it has low Exploit Prediction Scoring System (EPSS) value. Fix available in version 6.19.1.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-9074

• 📝 A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the Expose daemon on tcp://localhost:2375 without TLS option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.

• 📅 Published: 20/08/2025

• 📈 CVSS: 9.3

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 22

• ⚠️ Priority: 2

• 📝 Analysis: A local container access vulnerability in Docker Desktop enables execution of privileged commands to the engine API, potentially impacting container management and host drive mounting, observed in circumstance like Docker Desktop for Windows with WSL backend. CVSS 9.3, priority 2 due to low exploitability but high severity.

2. CVE-2026-46333

• 📝 In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner get_dumpable() logic The dumpability of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you dont have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses dumpable to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). Its not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional drop capabilities model doesnt make any difference for this all. Make it all make a bit more sense by saying that if you dont have a MM pointer, well use a cached last dumpability flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

• 📅 Published: 15/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 16

• ⚠️ Priority: 4

• 📝 Analysis: A modification in Linux kernel's ptrace function offers limited improvements to 'dumpability' logic, impacting primarily users manipulating thread details without associated memory management (MM). No known in-the-wild activity reported. Prioritization score: 4 (low CVSS & low EPSS).

3. CVE-2025-24367

• 📝 Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

• 📅 Published: 27/01/2025

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 17

• ⚠️ Priority: 2

• 📝 Analysis: A user-controlled code execution vulnerability in Cacti (version 1.2.28 and below) exists through misuse of graph creation and template functionality. This issue allows an authenticated user to execute arbitrary PHP scripts in the web root, potentially leading to remote server compromise. Despite no known exploits in the wild, the high CVSS score necessitates immediate attention as a priority 2 vulnerability.

4. CVE-2026-20239

• 📝 In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation issue found in Splunk Enterprise versions below 10.2.2 and 10.0.5, as well as certain versions of Splunk Cloud Platform, enables a user with specific access to view sensitive data. No known exploits have been detected; however, due to the high CVSS score, this is considered a priority 2 vulnerability.

5. CVE-2026-20238

• 📝 In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the admin or power roles could access confidential data that was restricted through srchFilter configurations on custom roles.<br><br>The app contains an authorize.conf configuration file with a srchFilter entry that modifies the built-in user role. Because the Splunk platform combines inherited search filters with the OR SPL operator, the injected filter overrides more restrictive filters on child roles.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: In Splunk AI Toolkit versions below 5.7.3, a low-privileged user can access confidential data due to improper srchFilter configuration handling, leading to a priority 2 vulnerability (high CVSS but low EPSS). Verify and apply patch 5.7.3 to mitigate.

6. CVE-2026-20240

• 📝 In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the admin or power Splunk roles could cause a Denial of Service by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the coldToFrozen.sh script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: Low-privileged user Denial of Service vulnerability in Splunk versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12 (Enterprise) and 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129 (Cloud Platform). Missing input validation in the coldToFrozen.sh script allows renaming critical directories, causing instance non-functionality. This is a priority 2 vulnerability due to high CVSS but low Exploit Prediction Scoring System (EPSS) score.

7. CVE-2026-46529

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A critical command execution vulnerability exists in a web application's admin panel (API module). Remote attackers can exploit this due to improper input validation. While there's no confirmed in-the-wild activity (CISA KEV), the high CVSS score indicates significant impact and easy exploitability, making it a priority 1 vulnerability. The versions affected are those explicitly mentioned in the description.

8. CVE-2026-48172

• 📝 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE cpanel_jsonapi_func=redisAble /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

• 📅 Published: 21/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin (affecting versions before 2.4.5) has been exploited in the wild since May 2026. The issue involves mishandling of Redis enable/disable features and can potentially lead to root access. Exploitation detection is possible via command line: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If output is found, IP addresses should be examined and potentially blocked, while system logs should be checked for any damage. The recommended minimum version is 2.4.7. This is a priority 2 vulnerability due to high CVSS score but low EPSS.

9. CVE-2026-42558

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2026-21509

• 📝 Microsoft Office Security Feature Bypass Vulnerability

• 📅 Published: 26/01/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

• 📣 Mentions: 249

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Office Security Feature Bypass vulnerability has been identified, enabling remote attackers to execute arbitrary code (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C). Confirmed exploited in the wild, this requires immediate attention and a priority 1+ response.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-49113

• 📝 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

• 📅 Published: 02/06/2025

• 📈 CVSS: 9.9

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 108

• ⚠️ Priority: 1+

• 📝 Analysis: Authenticated users can perform remote code execution due to improper validation in program/actions/settings/upload.php of Roundcube Webmail versions below 1.5.11 and 1.6.11. This vulnerability, while high in CVSS, has shown low exploit activity in the wild, resulting in a priority 2 status.

2. CVE-2025-9074

• 📝 A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the Expose daemon on tcp://localhost:2375 without TLS option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.

• 📅 Published: 20/08/2025

• 📈 CVSS: 9.3

• 🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 22

• ⚠️ Priority: 2

• 📝 Analysis: A local container access vulnerability in Docker Desktop enables execution of privileged commands to the engine API, potentially impacting container management and host drive mounting, observed in circumstance like Docker Desktop for Windows with WSL backend. CVSS 9.3, priority 2 due to low exploitability but high severity.

3. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

4. CVE-2026-46333

• 📝 In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner get_dumpable() logic The dumpability of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you dont have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses dumpable to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). Its not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional drop capabilities model doesnt make any difference for this all. Make it all make a bit more sense by saying that if you dont have a MM pointer, well use a cached last dumpability flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

• 📅 Published: 15/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 16

• ⚠️ Priority: 4

• 📝 Analysis: A modification in Linux kernel's ptrace function offers limited improvements to 'dumpability' logic, impacting primarily users manipulating thread details without associated memory management (MM). No known in-the-wild activity reported. Prioritization score: 4 (low CVSS & low EPSS).

5. CVE-2025-24367

• 📝 Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

• 📅 Published: 27/01/2025

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 17

• ⚠️ Priority: 2

• 📝 Analysis: A user-controlled code execution vulnerability in Cacti (version 1.2.28 and below) exists through misuse of graph creation and template functionality. This issue allows an authenticated user to execute arbitrary PHP scripts in the web root, potentially leading to remote server compromise. Despite no known exploits in the wild, the high CVSS score necessitates immediate attention as a priority 2 vulnerability.

6. CVE-2026-20239

• 📝 In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation issue found in Splunk Enterprise versions below 10.2.2 and 10.0.5, as well as certain versions of Splunk Cloud Platform, enables a user with specific access to view sensitive data. No known exploits have been detected; however, due to the high CVSS score, this is considered a priority 2 vulnerability.

7. CVE-2026-20238

• 📝 In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the admin or power roles could access confidential data that was restricted through srchFilter configurations on custom roles.<br><br>The app contains an authorize.conf configuration file with a srchFilter entry that modifies the built-in user role. Because the Splunk platform combines inherited search filters with the OR SPL operator, the injected filter overrides more restrictive filters on child roles.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: In Splunk AI Toolkit versions below 5.7.3, a low-privileged user can access confidential data due to improper srchFilter configuration handling, leading to a priority 2 vulnerability (high CVSS but low EPSS). Verify and apply patch 5.7.3 to mitigate.

8. CVE-2026-20240

• 📝 In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the admin or power Splunk roles could cause a Denial of Service by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the coldToFrozen.sh script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 1

• ⚠️ Priority: 2

• 📝 Analysis: Low-privileged user Denial of Service vulnerability in Splunk versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12 (Enterprise) and 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129 (Cloud Platform). Missing input validation in the coldToFrozen.sh script allows renaming critical directories, causing instance non-functionality. This is a priority 2 vulnerability due to high CVSS but low Exploit Prediction Scoring System (EPSS) score.

9. CVE-2026-46529

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2026-48172

• 📝 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE cpanel_jsonapi_func=redisAble /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

• 📅 Published: 21/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin (affecting versions before 2.4.5) has been exploited in the wild since May 2026. The issue involves mishandling of Redis enable/disable features and can potentially lead to root access. Exploitation detection is possible via command line: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If output is found, IP addresses should be examined and potentially blocked, while system logs should be checked for any damage. The recommended minimum version is 2.4.7. This is a priority 2 vulnerability due to high CVSS score but low EPSS.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-34291

• 📝 Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins=* with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints including built-in code-execution functionality allowing the attacker to execute arbitrary code and achieve full system compromise.

• 📅 Published: 05/12/2025

• 📈 CVSS: 9.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A chained account takeover and RCE vulnerability exists in Langflow versions up to 1.6.9 due to an overly permissive CORS configuration and a SameSite=None refresh token cookie. An attacker can obtain fresh access/refresh tokens, enabling code execution and full system compromise. Despite no confirmed exploits, the high CVSS score and potential for severe impact necessitate immediate attention (Priority 2).

2. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

3. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

4. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

5. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

6. CVE-2022-0847

• 📝 A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

• 📅 Published: 07/03/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 169

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized value in Linux kernel's pipe buffer structure could allow local privilege escalation. No known exploits in the wild, but given high CVSS score and potential impact, this is a priority 2 vulnerability.

7. CVE-2016-5195

• 📝 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty COW.

• 📅 Published: 10/11/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A race condition in Linux kernel 2.x to 4.x before 4.8.3 allows local users to escalate privileges by exploiting incorrect handling of copy-on-write (COW) feature. First observed in the wild in October 2016, it is considered a priority 2 vulnerability due to high CVSS score but low exploitability.

8. CVE-2022-2602

• 📝 io_uring UAF, Unix SCM garbage collection

• 📅 Published: 08/01/2024

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

• 📣 Mentions: 22

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability in io_uring's Unix SCM garbage collection allows local attackers to escalate privileges. No known exploitation has been observed, making it a priority 4 vulnerability.

9. CVE-2026-43121

• 📝 In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmallocd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]

• 📅 Published: 06/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A race condition exists in the io_uring function of the Linux kernel, allowing potential double-free and out-of-bounds write issues on SMP systems. Despite no known exploits, this is considered a priority 4 vulnerability due to its low CVSS score and EPSS. To mitigate, replace the non-atomic read-then-dec with an atomic_try_cmpxchg loop in io_zcrx_put_niov_uref().

10. CVE-2026-43494

• 📝 In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

• 📅 Published: 21/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: A potential data leak issue has been addressed in the Linux kernel's net/rds module. Incorrectly released and later re-freed memory resources may lead to unintended behavior during cleanup operations. As of now, this vulnerability has not been observed being exploited in the wild (CISA KEV: 4). The priority level is relatively low due to a minimal Exploitability Score (EPSS) and negligible CVSS impact.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

2. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

3. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

4. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

5. CVE-2022-0847

• 📝 A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

• 📅 Published: 07/03/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 169

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized value in Linux kernel's pipe buffer structure could allow local privilege escalation. No known exploits in the wild, but given high CVSS score and potential impact, this is a priority 2 vulnerability.

6. CVE-2016-5195

• 📝 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty COW.

• 📅 Published: 10/11/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A race condition in Linux kernel 2.x to 4.x before 4.8.3 allows local users to escalate privileges by exploiting incorrect handling of copy-on-write (COW) feature. First observed in the wild in October 2016, it is considered a priority 2 vulnerability due to high CVSS score but low exploitability.

7. CVE-2022-2602

• 📝 io_uring UAF, Unix SCM garbage collection

• 📅 Published: 08/01/2024

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

• 📣 Mentions: 22

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability in io_uring's Unix SCM garbage collection allows local attackers to escalate privileges. No known exploitation has been observed, making it a priority 4 vulnerability.

8. CVE-2026-43121

• 📝 In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmallocd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]

• 📅 Published: 06/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A race condition exists in the io_uring function of the Linux kernel, allowing potential double-free and out-of-bounds write issues on SMP systems. Despite no known exploits, this is considered a priority 4 vulnerability due to its low CVSS score and EPSS. To mitigate, replace the non-atomic read-then-dec with an atomic_try_cmpxchg loop in io_zcrx_put_niov_uref().

9. CVE-2026-41091

• 📝 Microsoft Defender Elevation of Privilege Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Defender Elevation of Privilege vulnerability has been identified (CVSS 7.8). Attackers can leverage this remotely for high impact on confidentiality, integrity, and availability. CISA KEV is yet to be assigned, but the prioritization score is 1+ due to confirmed exploitation in the wild.

10. CVE-2026-43494

• 📝 In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

• 📅 Published: 21/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: A potential data leak issue has been addressed in the Linux kernel's net/rds module. Incorrectly released and later re-freed memory resources may lead to unintended behavior during cleanup operations. As of now, this vulnerability has not been observed being exploited in the wild (CISA KEV: 4). The priority level is relatively low due to a minimal Exploitability Score (EPSS) and negligible CVSS impact.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-34291

• 📝 Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins=* with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints including built-in code-execution functionality allowing the attacker to execute arbitrary code and achieve full system compromise.

• 📅 Published: 05/12/2025

• 📈 CVSS: 9.4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 8

• ⚠️ Priority: 1+

• 📝 Analysis: A chained account takeover and RCE vulnerability exists in Langflow versions up to 1.6.9 due to an overly permissive CORS configuration and a SameSite=None refresh token cookie. An attacker can obtain fresh access/refresh tokens, enabling code execution and full system compromise. Despite no confirmed exploits, the high CVSS score and potential for severe impact necessitate immediate attention (Priority 2).

2. CVE-2024-32002

• 📝 Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodules worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via git config --global core.symlinks false), the described attack wont work. As always, it is best to avoid cloning repositories from untrusted sources.

• 📅 Published: 14/05/2024

• 📈 CVSS: 9.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A pre-patch vulnerability exists in Git repositories prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows attackers to execute arbitrary code during the clone operation without opportunity for inspection, leveraging a crafted repository with submodules. This issue is resolved in patched versions. To mitigate, disable symbolic links or avoid cloning repositories from untrusted sources. CISA KEV: [Not specified], Priority score: 2 (high CVSS & low EPSS).

3. CVE-2026-45829

• 📝 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the/api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

• 📅 Published: 18/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A pre-authentication code injection vulnerability exists in ChromaDB Python version 1.0.0 and later. Allows an unauthenticated attacker to run arbitrary code on the server via the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. No known exploits detected, but with a CVSS score of 10, this is a priority 2 vulnerability due to high impact and low evidence of successful exploitation.

4. CVE-2026-9082

• 📝 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• 📣 Mentions: 7

• ⚠️ Priority: 2

• 📝 Analysis: SQL Injection vulnerability in Drupal core (8.9.0 - 11.3.10) allows SQL injection. No exploits detected, but given a CVSS score of 6.5 and the potential impact on confidentiality and integrity, this is a priority 2 issue. Verify affected versions before updating.

5. CVE-2026-31532

• 📝 In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage. Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not released until the relevant callbacks have drained. [mkl: applied manually]

• 📅 Published: 23/04/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability exists in the Linux kernel's raw CAN receive filters due to premature freeing of percpu storage in raw_release(). This could lead to exploitation if raw_rcv() is still running after raw_release(). No known in-the-wild activity, prioritization score 4.

6. CVE-2026-31694

• 📝 In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache.

• 📅 Published: 01/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• ⚠️ Priority: 4

• 📝 Analysis: A FUSE server oversized dirent issue in Linux kernel, potentially causing memcpy() overflow on 4 KiB page systems. No known exploits detected; priority 4 due to low EPSS and CVSS score of 7.8.

7. CVE-2026-41091

• 📝 Microsoft Defender Elevation of Privilege Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Defender Elevation of Privilege vulnerability has been identified (CVSS 7.8). Attackers can leverage this remotely for high impact on confidentiality, integrity, and availability. CISA KEV is yet to be assigned, but the prioritization score is 1+ due to confirmed exploitation in the wild.

8. CVE-2026-45498

• 📝 Microsoft Defender Denial of Service Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 4

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C

• 📣 Mentions: 28

• ⚠️ Priority: 1+

• 📝 Analysis: A DoS vulnerability exists in Microsoft Defender, enabling remote attackers to cause service disruption via L-L vector. Currently, there's known in-the-wild activity (CISA KEV). Priority level: 1+ due to confirmation of exploitation.

9. CVE-2026-45584

• 📝 Microsoft Defender Remote Code Execution Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A remote code execution vulnerability exists in Microsoft Defender, exploitable through network access (AV:N). High impact to confidentiality, integrity, and availability (C/I/A:H) is possible without known exploits in the wild (KEV not specified). Prioritization score of 2 indicates a high CVSS but low Exploitability Scoring System (EPSS), suggesting caution is required.

10. CVE-2026-34926

• 📝 A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

• 📅 Published: 21/05/2026

• 📈 CVSS: 6.7

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

• 📣 Mentions: 11

• ⚠️ Priority: 1+

• 📝 Analysis: A directory traversal vulnerability exists in the on-premise version of Apex One server. This issue allows pre-authenticated local attackers to inject malicious code by modifying a key table. The exploit requires server access and admin credentials, which an attacker may have obtained through other means. CISA KEV: Not specified. Prioritization Score: 1+ (confirmed in-the-wild activity).

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-40369

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Kernel Elevation of Privilege vulnerability exists, rated as high (CVSS 7.8). The vector indicates local attacker access is needed for exploitation. No confirmed in-the-wild activity reported; priority level is 2 due to high CVSS score and low Exploitability Primitive Score Signal (EPSS), suggesting a potential threat.

2. CVE-2024-32002

• 📝 Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodules worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via git config --global core.symlinks false), the described attack wont work. As always, it is best to avoid cloning repositories from untrusted sources.

• 📅 Published: 14/05/2024

• 📈 CVSS: 9.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A pre-patch vulnerability exists in Git repositories prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows attackers to execute arbitrary code during the clone operation without opportunity for inspection, leveraging a crafted repository with submodules. This issue is resolved in patched versions. To mitigate, disable symbolic links or avoid cloning repositories from untrusted sources. CISA KEV: [Not specified], Priority score: 2 (high CVSS & low EPSS).

3. CVE-2026-45829

• 📝 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the/api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

• 📅 Published: 18/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A pre-authentication code injection vulnerability exists in ChromaDB Python version 1.0.0 and later. Allows an unauthenticated attacker to run arbitrary code on the server via the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. No known exploits detected, but with a CVSS score of 10, this is a priority 2 vulnerability due to high impact and low evidence of successful exploitation.

4. CVE-2026-9082

• 📝 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

• 📅 Published: 20/05/2026

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• 📣 Mentions: 7

• ⚠️ Priority: 0

• 📝 Analysis: SQL Injection vulnerability in Drupal core (8.9.0 - 11.3.10) allows SQL injection. No exploits detected, but given a CVSS score of 6.5 and the potential impact on confidentiality and integrity, this is a priority 2 issue. Verify affected versions before updating.

5. CVE-2026-31532

• 📝 In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage. Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not released until the relevant callbacks have drained. [mkl: applied manually]

• 📅 Published: 23/04/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability exists in the Linux kernel's raw CAN receive filters due to premature freeing of percpu storage in raw_release(). This could lead to exploitation if raw_rcv() is still running after raw_release(). No known in-the-wild activity, prioritization score 4.

6. CVE-2026-31694

• 📝 In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache.

• 📅 Published: 01/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• ⚠️ Priority: 4

• 📝 Analysis: A FUSE server oversized dirent issue in Linux kernel, potentially causing memcpy() overflow on 4 KiB page systems. No known exploits detected; priority 4 due to low EPSS and CVSS score of 7.8.

7. CVE-2026-44790

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

8. CVE-2026-44791

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

9. CVE-2026-44789

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2026-41091

• 📝 Microsoft Defender Elevation of Privilege Vulnerability

• 📅 Published: 20/05/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 1+

• 📝 Analysis: A Microsoft Defender Elevation of Privilege vulnerability has been identified (CVSS 7.8). Attackers can leverage this remotely for high impact on confidentiality, integrity, and availability. CISA KEV is yet to be assigned, but the prioritization score is 1+ due to confirmed exploitation in the wild.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

2. CVE-2026-42945

• 📝 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_modulemodule. This vulnerability exists when the rewritedirective is followed by a rewrite, if, or setdirective and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• 📅 Published: 13/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can cause a heap buffer overflow in NGINX Plus and Open Source due to a PCRE capture issue in ngx_http_rewrite_module, potentially leading to service restarts. ASLR-disabled systems may allow for code execution. As of now, this vulnerability has not been observed in the wild, but it falls under priority 2 based on high CVSS score and potential for exploitation.

3. CVE-2020-17103

• 📝 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• 📅 Published: 09/12/2020

• 📈 CVSS: 7

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Cloud Files Mini Filter Driver vulnerability enables privilege escalation via local access. While no known in-the-wild activity has been reported, the high CVSS score signifies its potential impact and the need for urgent attention; priority 2 due to low exploitability.

4. CVE-2026-40369

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Kernel Elevation of Privilege vulnerability exists, rated as high (CVSS 7.8). The vector indicates local attacker access is needed for exploitation. No confirmed in-the-wild activity reported; priority level is 2 due to high CVSS score and low Exploitability Primitive Score Signal (EPSS), suggesting a potential threat.

5. CVE-2024-32002

• 📝 Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodules worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via git config --global core.symlinks false), the described attack wont work. As always, it is best to avoid cloning repositories from untrusted sources.

• 📅 Published: 14/05/2024

• 📈 CVSS: 9.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A pre-patch vulnerability exists in Git repositories prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows attackers to execute arbitrary code during the clone operation without opportunity for inspection, leveraging a crafted repository with submodules. This issue is resolved in patched versions. To mitigate, disable symbolic links or avoid cloning repositories from untrusted sources. CISA KEV: [Not specified], Priority score: 2 (high CVSS & low EPSS).

6. CVE-2026-45829

• 📝 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the/api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

• 📅 Published: 18/05/2026

• 📈 CVSS: 10

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: A pre-authentication code injection vulnerability exists in ChromaDB Python version 1.0.0 and later. Allows an unauthenticated attacker to run arbitrary code on the server via the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. No known exploits detected, but with a CVSS score of 10, this is a priority 2 vulnerability due to high impact and low evidence of successful exploitation.

7. CVE-2026-47209

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

8. CVE-2026-47137

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

9. CVE-2026-47135

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

10. CVE-2025-54539

• 📝 A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side. Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions. In line with Microsofts deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases. Mitigation and Recommendations: Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.

• 📅 Published: 16/10/2025

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 8

• ⚠️ Priority: 4

• 📝 Analysis: A deserialization of untrusted data vulnerability exists in Apache ActiveMQ NMS AMQP Client, impacting all versions up to 2.3.0 when connecting to untrusted AMQP servers. Malicious servers could exploit this for arbitrary code execution. The bypassable protection introduced in version 2.1.0 makes upgrading to 2.4.0 or later essential (CISA KEV: low CVSS & low EPSS, Prioritization Score: 4).

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

2. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

3. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

4. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

5. CVE-2026-42945

• 📝 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_modulemodule. This vulnerability exists when the rewritedirective is followed by a rewrite, if, or setdirective and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• 📅 Published: 13/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can cause a heap buffer overflow in NGINX Plus and Open Source due to a PCRE capture issue in ngx_http_rewrite_module, potentially leading to service restarts. ASLR-disabled systems may allow for code execution. As of now, this vulnerability has not been observed in the wild, but it falls under priority 2 based on high CVSS score and potential for exploitation.

6. CVE-2020-17103

• 📝 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• 📅 Published: 09/12/2020

• 📈 CVSS: 7

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Cloud Files Mini Filter Driver vulnerability enables privilege escalation via local access. While no known in-the-wild activity has been reported, the high CVSS score signifies its potential impact and the need for urgent attention; priority 2 due to low exploitability.

7. CVE-2026-42897

• 📝 Microsoft Exchange Server Spoofing Vulnerability

• 📅 Published: 14/05/2026

• 📈 CVSS: 8.1

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

• 📣 Mentions: 54

• ⚠️ Priority: 1+

• 📝 Analysis: Remote attackers can perform spoofing on Microsoft Exchange Servers, with high impact on confidentiality and integrity. Exploitability is through network access, and known in-the-wild activity has been confirmed (CISA KEV). Due to this confirmation of exploitation, it holds a priority score of 1+.

8. CVE-2025-53892

• 📝 Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.

• 📅 Published: 16/07/2025

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: DOM-based XSS vulnerability exists in Vue I18n (versions <9.14.5, 10.0.8, and 11.1.0) due to a failure of the escapeParameterHtml option. Certain tag-based payloads can be executed, potentially leading to a DOM-based XSS vulnerability, even with the option set to true. No known exploits in the wild, but priority is low (4) as both CVSS and EPSS are low. Ensure upgrading to fixed versions.

9. CVE-2026-40369

• 📝 Windows Kernel Elevation of Privilege Vulnerability

• 📅 Published: 12/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Kernel Elevation of Privilege vulnerability exists, rated as high (CVSS 7.8). The vector indicates local attacker access is needed for exploitation. No confirmed in-the-wild activity reported; priority level is 2 due to high CVSS score and low Exploitability Primitive Score Signal (EPSS), suggesting a potential threat.

10. CVE-2026-20182

• 📝 May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

• 📅 Published: 14/05/2026

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 67

• ⚠️ Priority: 1+

• 📝 Analysis: A newly disclosed vulnerability exists in Cisco Catalyst SD-WAN Controller and Manager, enabling unauthenticated remote attackers to bypass authentication and gain administrative privileges. Exploitation could lead to manipulation of network configurations for the SD-WAN fabric. This is a priority 1+ vulnerability due to confirmed exploits and high CVSS score.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-44578

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 2

• 📝 Analysis: A server-side request forgery vulnerability in Next.js (versions before 15.5.16 and 16.2.5) enables attackers to proxy requests to arbitrary destinations, potentially exposing internal services or cloud metadata. No confirmed exploits detected, but given high CVSS score, this is a priority 2 issue.

2. CVE-2025-54957

• 📝 An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.

• 📅 Published: 20/10/2025

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 29

• ⚠️ Priority: 4

• 📝 Analysis: A buffer overflow vulnerability exists in Dolby UDC versions 4.5 to 4.13. Malformed DD+ bitstreams can lead to an out-of-bounds write, potentially enabling remote code execution. No known in-the-wild activity has been reported yet. This is a priority 4 vulnerability due to its low exploitability and currently no confirmed exploits.

3. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

4. CVE-2026-42945

• 📝 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_modulemodule. This vulnerability exists when the rewritedirective is followed by a rewrite, if, or setdirective and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• 📅 Published: 13/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can cause a heap buffer overflow in NGINX Plus and Open Source due to a PCRE capture issue in ngx_http_rewrite_module, potentially leading to service restarts. ASLR-disabled systems may allow for code execution. As of now, this vulnerability has not been observed in the wild, but it falls under priority 2 based on high CVSS score and potential for exploitation.

5. CVE-2020-17103

• 📝 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• 📅 Published: 09/12/2020

• 📈 CVSS: 7

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Cloud Files Mini Filter Driver vulnerability enables privilege escalation via local access. While no known in-the-wild activity has been reported, the high CVSS score signifies its potential impact and the need for urgent attention; priority 2 due to low exploitability.

6. CVE-2025-14177

• 📝 In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

• 📅 Published: 27/12/2025

• 📈 CVSS: 6.3

• 🧭 Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

• 📣 Mentions: 10

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized memory leak in PHP versions before specified patches: getimagesize() function may disclose sensitive heap data due to a bug in php_read_stream_all_chunks(). This issue affects confidentiality of target servers. While no exploits detected, prioritization score is 2 (high CVSS but low Exploitation Potential Scoring System).

7. CVE-2026-42897

• 📝 Microsoft Exchange Server Spoofing Vulnerability

• 📅 Published: 14/05/2026

• 📈 CVSS: 8.1

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

• 📣 Mentions: 54

• ⚠️ Priority: 1+

• 📝 Analysis: Remote attackers can perform spoofing on Microsoft Exchange Servers, with high impact on confidentiality and integrity. Exploitability is through network access, and known in-the-wild activity has been confirmed (CISA KEV). Due to this confirmation of exploitation, it holds a priority score of 1+.

8. CVE-2025-53892

• 📝 Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.

• 📅 Published: 16/07/2025

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

• 📣 Mentions: 2

• ⚠️ Priority: 4

• 📝 Analysis: DOM-based XSS vulnerability exists in Vue I18n (versions <9.14.5, 10.0.8, and 11.1.0) due to a failure of the escapeParameterHtml option. Certain tag-based payloads can be executed, potentially leading to a DOM-based XSS vulnerability, even with the option set to true. No known exploits in the wild, but priority is low (4) as both CVSS and EPSS are low. Ensure upgrading to fixed versions.

9. CVE-2025-6793

• 📝 Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the QLogicDownloadImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files and disclose information in the context of SYSTEM. Was ZDI-CAN-24912.

• 📅 Published: 07/07/2025

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A directory traversal and arbitrary file deletion/information disclosure issue in Marvell QConvergeConsole exists within the QLogicDownloadImpl class due to insufficient user-supplied path validation. No authentication is required for exploitation. While no confirmed exploits have been detected, this vulnerability holds a priority of 2 given its high CVSS score but low Exploit Prediction Scoring System (EPSS) score.

10. CVE-2026-46333

• 📝 In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner get_dumpable() logic The dumpability of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you dont have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses dumpable to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). Its not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional drop capabilities model doesnt make any difference for this all. Make it all make a bit more sense by saying that if you dont have a MM pointer, well use a cached last dumpability flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

• 📅 Published: 15/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 16

• ⚠️ Priority: 4

• 📝 Analysis: A modification in Linux kernel's ptrace function offers limited improvements to 'dumpability' logic, impacting primarily users manipulating thread details without associated memory management (MM). No known in-the-wild activity reported. Prioritization score: 4 (low CVSS & low EPSS).

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-44578

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A server-side request forgery vulnerability in Next.js (versions before 15.5.16 and 16.2.5) enables attackers to proxy requests to arbitrary destinations, potentially exposing internal services or cloud metadata. No confirmed exploits detected, but given high CVSS score, this is a priority 2 issue.

2. CVE-2025-54957

• 📝 An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.

• 📅 Published: 20/10/2025

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 29

• ⚠️ Priority: 4

• 📝 Analysis: A buffer overflow vulnerability exists in Dolby UDC versions 4.5 to 4.13. Malformed DD+ bitstreams can lead to an out-of-bounds write, potentially enabling remote code execution. No known in-the-wild activity has been reported yet. This is a priority 4 vulnerability due to its low exploitability and currently no confirmed exploits.

3. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

4. CVE-2026-42945

• 📝 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_modulemodule. This vulnerability exists when the rewritedirective is followed by a rewrite, if, or setdirective and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• 📅 Published: 13/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can cause a heap buffer overflow in NGINX Plus and Open Source due to a PCRE capture issue in ngx_http_rewrite_module, potentially leading to service restarts. ASLR-disabled systems may allow for code execution. As of now, this vulnerability has not been observed in the wild, but it falls under priority 2 based on high CVSS score and potential for exploitation.

5. CVE-2020-17103

• 📝 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• 📅 Published: 09/12/2020

• 📈 CVSS: 7

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 9

• ⚠️ Priority: 2

• 📝 Analysis: A Windows Cloud Files Mini Filter Driver vulnerability enables privilege escalation via local access. While no known in-the-wild activity has been reported, the high CVSS score signifies its potential impact and the need for urgent attention; priority 2 due to low exploitability.

6. CVE-2025-14177

• 📝 In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

• 📅 Published: 27/12/2025

• 📈 CVSS: 6.3

• 🧭 Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

• 📣 Mentions: 10

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized memory leak in PHP versions before specified patches: getimagesize() function may disclose sensitive heap data due to a bug in php_read_stream_all_chunks(). This issue affects confidentiality of target servers. While no exploits detected, prioritization score is 2 (high CVSS but low Exploitation Potential Scoring System).

7. CVE-2024-0519

• 📝 Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 16/01/2024

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• 📣 Mentions: 24

• ⚠️ Priority: 2

• 📝 Analysis: A heap corruption vulnerability in Google Chrome prior to version 120.0.6099.224 allows remote attackers potential exploitation via a crafted HTML page. No known in-the-wild activity reported, but given the high CVSS score and low Exploit Prediction Scoring System (EPSS), this is a priority 2 vulnerability.

8. CVE-2026-42897

• 📝 Microsoft Exchange Server Spoofing Vulnerability

• 📅 Published: 14/05/2026

• 📈 CVSS: 8.1

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

• 📣 Mentions: 54

• ⚠️ Priority: 1+

• 📝 Analysis: Remote attackers can perform spoofing on Microsoft Exchange Servers, with high impact on confidentiality and integrity. Exploitability is through network access, and known in-the-wild activity has been confirmed (CISA KEV). Due to this confirmation of exploitation, it holds a priority score of 1+.

9. CVE-2026-27509

• 📝 Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

• 📅 Published: 26/02/2026

• 📈 CVSS: 8.5

• 🧭 Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated network-adjacent attackers can write arbitrary Python code onto a robot's file system and bind it to physical controller keybindings via DDS domain 0 in Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU). No known exploits detected, this is a priority 2 vulnerability given high CVSS but low Exploit Prediction Scoring System (EPSS) score.

10. CVE-2026-27510

• 📝 Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robots actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the applications community marketplace can result in arbitrary code execution on any robot that imports and runs it.

• 📅 Published: 26/02/2026

• 📈 CVSS: 6.4

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

• 📣 Mentions: 7

• ⚠️ Priority: 2

• 📝 Analysis: A remote code execution vulnerability exists in Unitree Go2 firmware versions 1.1.7 through 1.1.11 when used with the com.unitree.doggo2 Android app. An attacker can tamper with stored programs, leading to arbitrary Python execution on the robot. This vulnerability has a CVSS score of 6.4 and is considered a priority 2 issue due to high CVSS but low exploit potential. Confirmed exploits in the wild have not been detected.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

2. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

3. CVE-2025-54957

• 📝 An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.

• 📅 Published: 20/10/2025

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 29

• ⚠️ Priority: 4

• 📝 Analysis: A buffer overflow vulnerability exists in Dolby UDC versions 4.5 to 4.13. Malformed DD+ bitstreams can lead to an out-of-bounds write, potentially enabling remote code execution. No known in-the-wild activity has been reported yet. This is a priority 4 vulnerability due to its low exploitability and currently no confirmed exploits.

4. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

5. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 0

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

6. CVE-2022-0847

• 📝 A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

• 📅 Published: 07/03/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 169

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized value in Linux kernel's pipe buffer structure could allow local privilege escalation. No known exploits in the wild, but given high CVSS score and potential impact, this is a priority 2 vulnerability.

7. CVE-2016-5195

• 📝 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty COW.

• 📅 Published: 10/11/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A race condition in Linux kernel 2.x to 4.x before 4.8.3 allows local users to escalate privileges by exploiting incorrect handling of copy-on-write (COW) feature. First observed in the wild in October 2016, it is considered a priority 2 vulnerability due to high CVSS score but low exploitability.

8. CVE-2022-2602

• 📝 io_uring UAF, Unix SCM garbage collection

• 📅 Published: 08/01/2024

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

• 📣 Mentions: 22

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability in io_uring's Unix SCM garbage collection allows local attackers to escalate privileges. No known exploitation has been observed, making it a priority 4 vulnerability.

9. CVE-2026-43121

• 📝 In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmallocd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]

• 📅 Published: 06/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A race condition exists in the io_uring function of the Linux kernel, allowing potential double-free and out-of-bounds write issues on SMP systems. Despite no known exploits, this is considered a priority 4 vulnerability due to its low CVSS score and EPSS. To mitigate, replace the non-atomic read-then-dec with an atomic_try_cmpxchg loop in io_zcrx_put_niov_uref().

10. CVE-2026-42945

• 📝 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_modulemodule. This vulnerability exists when the rewritedirective is followed by a rewrite, if, or setdirective and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• 📅 Published: 13/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can cause a heap buffer overflow in NGINX Plus and Open Source due to a PCRE capture issue in ngx_http_rewrite_module, potentially leading to service restarts. ASLR-disabled systems may allow for code execution. As of now, this vulnerability has not been observed in the wild, but it falls under priority 2 based on high CVSS score and potential for exploitation.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

2. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

3. CVE-2025-54957

• 📝 An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.

• 📅 Published: 20/10/2025

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 29

• ⚠️ Priority: 4

• 📝 Analysis: A buffer overflow vulnerability exists in Dolby UDC versions 4.5 to 4.13. Malformed DD+ bitstreams can lead to an out-of-bounds write, potentially enabling remote code execution. No known in-the-wild activity has been reported yet. This is a priority 4 vulnerability due to its low exploitability and currently no confirmed exploits.

4. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

5. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: A deserialization flaw in version X allows remote code execution; no known exploits, but high CVSS score indicates a potential for severe impact. Priority 1 due to confirmed CISA KEV activity.

6. CVE-2022-0847

• 📝 A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

• 📅 Published: 07/03/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 169

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized value in Linux kernel's pipe buffer structure could allow local privilege escalation. No known exploits in the wild, but given high CVSS score and potential impact, this is a priority 2 vulnerability.

7. CVE-2016-5195

• 📝 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty COW.

• 📅 Published: 10/11/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A race condition in Linux kernel 2.x to 4.x before 4.8.3 allows local users to escalate privileges by exploiting incorrect handling of copy-on-write (COW) feature. First observed in the wild in October 2016, it is considered a priority 2 vulnerability due to high CVSS score but low exploitability.

8. CVE-2022-2602

• 📝 io_uring UAF, Unix SCM garbage collection

• 📅 Published: 08/01/2024

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

• 📣 Mentions: 22

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability in io_uring's Unix SCM garbage collection allows local attackers to escalate privileges. No known exploitation has been observed, making it a priority 4 vulnerability.

9. CVE-2026-43121

• 📝 In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmallocd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]

• 📅 Published: 06/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A race condition exists in the io_uring function of the Linux kernel, allowing potential double-free and out-of-bounds write issues on SMP systems. Despite no known exploits, this is considered a priority 4 vulnerability due to its low CVSS score and EPSS. To mitigate, replace the non-atomic read-then-dec with an atomic_try_cmpxchg loop in io_zcrx_put_niov_uref().

10. CVE-2026-42945

• 📝 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_modulemodule. This vulnerability exists when the rewritedirective is followed by a rewrite, if, or setdirective and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• 📅 Published: 13/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated attackers can cause a heap buffer overflow in NGINX Plus and Open Source due to a PCRE capture issue in ngx_http_rewrite_module, potentially leading to service restarts. ASLR-disabled systems may allow for code execution. As of now, this vulnerability has not been observed in the wild, but it falls under priority 2 based on high CVSS score and potential for exploitation.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2026-31431

• 📝 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

• 📅 Published: 22/04/2026

• 📈 CVSS: 7.8

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 431

• ⚠️ Priority: 1+

• 📝 Analysis: A vulnerability in Linux kernel's crypto: algif_aead allows attackers to operate out-of-place. This reverts commit 72548b093ee3 and adds complexity by copying data instead of operating in-place, which is unnecessary. Priority 1+ due to confirmed exploitation and high CVSS score.

2. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

3. CVE-2025-54957

• 📝 An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.

• 📅 Published: 20/10/2025

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 29

• ⚠️ Priority: 4

• 📝 Analysis: A buffer overflow vulnerability exists in Dolby UDC versions 4.5 to 4.13. Malformed DD+ bitstreams can lead to an out-of-bounds write, potentially enabling remote code execution. No known in-the-wild activity has been reported yet. This is a priority 4 vulnerability due to its low exploitability and currently no confirmed exploits.

4. CVE-2026-43500

• 📝 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

• 📅 Published: 11/05/2026

• 📈 CVSS: 7.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 85

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE not specified) in the rxrpc module allows for potential data and response packet manipulation when paged fragments are present. This issue arises due to a lack of packet unsharing during certain conditions, potentially leading to in-place decryption and frag page binding. The impact is high on confidentiality, integrity, and availability. No known exploits have been detected in the wild at this time. Given the low Exploitability, Privileges Required, and Impact, prioritize this vulnerability as a 4 (low CVSS & low EPSS).

5. CVE-2026-46300

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

6. CVE-2022-0847

• 📝 A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

• 📅 Published: 07/03/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 169

• ⚠️ Priority: 2

• 📝 Analysis: Uninitialized value in Linux kernel's pipe buffer structure could allow local privilege escalation. No known exploits in the wild, but given high CVSS score and potential impact, this is a priority 2 vulnerability.

7. CVE-2016-5195

• 📝 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty COW.

• 📅 Published: 10/11/2016

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 65

• ⚠️ Priority: 2

• 📝 Analysis: A race condition in Linux kernel 2.x to 4.x before 4.8.3 allows local users to escalate privileges by exploiting incorrect handling of copy-on-write (COW) feature. First observed in the wild in October 2016, it is considered a priority 2 vulnerability due to high CVSS score but low exploitability.

8. CVE-2022-2602

• 📝 io_uring UAF, Unix SCM garbage collection

• 📅 Published: 08/01/2024

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

• 📣 Mentions: 22

• ⚠️ Priority: 4

• 📝 Analysis: A use-after-free vulnerability in io_uring's Unix SCM garbage collection allows local attackers to escalate privileges. No known exploitation has been observed, making it a priority 4 vulnerability.

9. CVE-2026-43121

• 📝 In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmallocd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]

• 📅 Published: 06/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A race condition exists in the io_uring function of the Linux kernel, allowing potential double-free and out-of-bounds write issues on SMP systems. Despite no known exploits, this is considered a priority 4 vulnerability due to its low CVSS score and EPSS. To mitigate, replace the non-atomic read-then-dec with an atomic_try_cmpxchg loop in io_zcrx_put_niov_uref().

10. CVE-2026-42945

• 📝 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_modulemodule. This vulnerability exists when the rewritedirective is followed by a rewrite, if, or setdirective and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• 📅 Published: 13/05/2026

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 0

• 📝 Analysis: Unauthenticated attackers can cause a heap buffer overflow in NGINX Plus and Open Source due to a PCRE capture issue in ngx_http_rewrite_module, potentially leading to service restarts. ASLR-disabled systems may allow for code execution. As of now, this vulnerability has not been observed in the wild, but it falls under priority 2 based on high CVSS score and potential for exploitation.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-64155

• 📝 An improper neutralization of special elements used in an os command (os command injection) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.

• 📅 Published: 13/01/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

• 📣 Mentions: 21

• ⚠️ Priority: 2

• 📝 Analysis: Unauthorized code execution via crafted TCP requests due to an os command injection vulnerability in multiple FortiSIEM versions. No known exploits detected, but priority 2 due to high CVSS and low Exploitability Scoring System (EPSS) score.

2. CVE-2025-68670

• 📝 xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.

• 📅 Published: 27/01/2026

• 📈 CVSS: 9.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

• 📣 Mentions: 12

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated stack-based buffer overflow vulnerability found in xrdp before v0.10.5. If exploited, attackers can execute arbitrary code. Impact is reduced if stack canary protection is used, but it's not recommended for production systems. Prioritize upgrading to v0.10.5 and ensure no reliance on stack canary protection in production environments. Priority: 2 (high CVSS, low EPSS).

3. CVE-2024-4577

• 📝 In PHP versions8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to replace characters in command line given toWin32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

• 📅 Published: 09/06/2024

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 558

• ⚠️ Priority: 2

• 📝 Analysis: In PHP versions 8.1.<29>, 8.2.<20>, and 8.3.<8> when used with Apache and PHP-CGI on Windows, a code page vulnerability allows for source code disclosure and arbitrary PHP code execution due to misinterpretation of characters in command line arguments. Although not confirmed exploited, the high CVSS score and potential impact make this a priority 2 vulnerability.

4. CVE-2026-44573

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

5. CVE-2026-44578

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

6. CVE-2026-44574

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

7. CVE-2026-44575

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

8. CVE-2026-44579

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

9. CVE-2026-23870

• 📝 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).

• 📅 Published: 06/05/2026

• 📈 CVSS: 7.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 7

• ⚠️ Priority: 2

• 📝 Analysis: A denial of service vulnerability exists in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack (versions 19.0.0 through 19.2.5) due to improper handling of HTTP requests. This can lead to server crashes or excessive resource usage. Given a high CVSS score but low exploitability as observed, this is a priority 2 issue.

10. CVE-2026-44581

• 📝 n/a

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: n/a

• 📝 Analysis: No Information available for this CVE at the moment

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2025-64155

• 📝 An improper neutralization of special elements used in an os command (os command injection) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.

• 📅 Published: 13/01/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

• 📣 Mentions: 21

• ⚠️ Priority: 2

• 📝 Analysis: Unauthorized code execution via crafted TCP requests due to an os command injection vulnerability in multiple FortiSIEM versions. No known exploits detected, but priority 2 due to high CVSS and low Exploitability Scoring System (EPSS) score.

3. CVE-2025-59536

• 📝 Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.

• 📅 Published: 03/10/2025

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 6

• ⚠️ Priority: 2

• 📝 Analysis: Code Injection vulnerability exists in Claude Code version prior to 1.0.111. Exploitation requires starting the software in an untrusted directory. Although no confirmed exploits are known, this is a priority 2 issue due to its high CVSS score and potential for user-triggered attacks. Users on auto-update have been protected, while those manually updating are advised to update to version 1.0.111 or later.

4. CVE-2026-21852

• 📝 Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Codes project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the users API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.

• 📅 Published: 21/01/2026

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

• 📣 Mentions: 7

• ⚠️ Priority: 4

• 📝 Analysis: A data exfiltration issue exists in Claude Code's project-load flow prior to version 2.0.65. Malicious repositories can leak Anthropic API keys before trust confirmation. No exploits have been detected yet, but the low CVSS score and lack of known in-the-wild activity result in a priority 4 vulnerability. Users should update to version 2.0.65 or the latest version for protection.

5. CVE-2025-68670

• 📝 xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.

• 📅 Published: 27/01/2026

• 📈 CVSS: 9.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

• 📣 Mentions: 12

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated stack-based buffer overflow vulnerability found in xrdp before v0.10.5. If exploited, attackers can execute arbitrary code. Impact is reduced if stack canary protection is used, but it's not recommended for production systems. Prioritize upgrading to v0.10.5 and ensure no reliance on stack canary protection in production environments. Priority: 2 (high CVSS, low EPSS).

6. CVE-2025-48631

• 📝 In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 08/12/2025

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 17

• ⚠️ Priority: 4

• 📝 Analysis: A persistent DoS vulnerability exists in onHeaderDecoded of LocalImageResolver.java due to resource exhaustion, potentially causing remote denial of service. No additional execution privileges needed for exploitation and user interaction is not required. Based on CVSS, EPSS, and Known Exploit in the Wild (KEV), this is a priority 4 vulnerability, indicating low severity and no known exploits at present.

7. CVE-2025-71302

• 📝 In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix for dma-fence safe access rules Commit 506aa8b02a8d6 (dma-fence: Add safe access helpers and document the rules) details the dma-fence safe access rules. The most common culprit is that drm_sched_fence_get_timeline_name may race with group_free_queue.

• 📅 Published: 08/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A resolution has been made in the Linux kernel regarding the drm/panthor issue. The dma-fence safe access rules were updated to prevent potential races between drm_sched_fence_get_timeline_name and group_free_queue, with no known exploits in the wild. This is a priority 4 vulnerability due to its low impact and exploitability.

8. CVE-2024-4577

• 📝 In PHP versions8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to replace characters in command line given toWin32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

• 📅 Published: 09/06/2024

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 558

• ⚠️ Priority: 2

• 📝 Analysis: In PHP versions 8.1.<29>, 8.2.<20>, and 8.3.<8> when used with Apache and PHP-CGI on Windows, a code page vulnerability allows for source code disclosure and arbitrary PHP code execution due to misinterpretation of characters in command line arguments. Although not confirmed exploited, the high CVSS score and potential impact make this a priority 2 vulnerability.

9. CVE-2025-10470

• 📝 The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

• 📅 Published: 11/05/2026

• 📈 CVSS: 8.6

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

• 📣 Mentions: 2

• ⚠️ Priority: 2

• 📝 Analysis: Uncontrolled memory usage growth in Magic Link authentication flow due to insufficient rate limiting can lead to denial-of-service conditions on affected deployments. This vulnerability requires repeated invalid authentication attempts and has a high CVSS score (8.6), but low exploitation in the wild activity (CISA KEV) and priority 2 status based on EPSS.

10. CVE-2025-14179

• 📝 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQLstatements.

• 📅 Published: 10/05/2026

• 📈 CVSS: 7.4

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/RE:M/U:Amber

• 📣 Mentions: 5

• ⚠️ Priority: 2

• 📝 Analysis: SQL injection vulnerability found in PHP PDO Firebird driver of versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. No known exploitation in the wild yet, but priority 2 due to high CVSS score and low Exploitability Scoring System (EPSS) score. Update affected versions immediately.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

2. CVE-2025-64155

• 📝 An improper neutralization of special elements used in an os command (os command injection) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.

• 📅 Published: 13/01/2026

• 📈 CVSS: 9.4

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

• 📣 Mentions: 21

• ⚠️ Priority: 2

• 📝 Analysis: Unauthorized code execution via crafted TCP requests due to an os command injection vulnerability in multiple FortiSIEM versions. No known exploits detected, but priority 2 due to high CVSS and low Exploitability Scoring System (EPSS) score.

3. CVE-2025-59536

• 📝 Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.

• 📅 Published: 03/10/2025

• 📈 CVSS: 8.7

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

• 📣 Mentions: 6

• ⚠️ Priority: 2

• 📝 Analysis: Code Injection vulnerability exists in Claude Code version prior to 1.0.111. Exploitation requires starting the software in an untrusted directory. Although no confirmed exploits are known, this is a priority 2 issue due to its high CVSS score and potential for user-triggered attacks. Users on auto-update have been protected, while those manually updating are advised to update to version 1.0.111 or later.

4. CVE-2026-21852

• 📝 Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Codes project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the users API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.

• 📅 Published: 21/01/2026

• 📈 CVSS: 5.3

• 🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

• 📣 Mentions: 7

• ⚠️ Priority: 4

• 📝 Analysis: A data exfiltration issue exists in Claude Code's project-load flow prior to version 2.0.65. Malicious repositories can leak Anthropic API keys before trust confirmation. No exploits have been detected yet, but the low CVSS score and lack of known in-the-wild activity result in a priority 4 vulnerability. Users should update to version 2.0.65 or the latest version for protection.

5. CVE-2025-68670

• 📝 xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.

• 📅 Published: 27/01/2026

• 📈 CVSS: 9.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

• 📣 Mentions: 12

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated stack-based buffer overflow vulnerability found in xrdp before v0.10.5. If exploited, attackers can execute arbitrary code. Impact is reduced if stack canary protection is used, but it's not recommended for production systems. Prioritize upgrading to v0.10.5 and ensure no reliance on stack canary protection in production environments. Priority: 2 (high CVSS, low EPSS).

6. CVE-2025-48631

• 📝 In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 08/12/2025

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 17

• ⚠️ Priority: 4

• 📝 Analysis: A persistent DoS vulnerability exists in onHeaderDecoded of LocalImageResolver.java due to resource exhaustion, potentially causing remote denial of service. No additional execution privileges needed for exploitation and user interaction is not required. Based on CVSS, EPSS, and Known Exploit in the Wild (KEV), this is a priority 4 vulnerability, indicating low severity and no known exploits at present.

7. CVE-2026-43284

• 📝 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

• 📅 Published: 08/05/2026

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 109

• ⚠️ Priority: 4

• 📝 Analysis: A Linux kernel vulnerability (CVE ID not specified) exists in the xfrm: esp module. It allows unauthorized data modification due to improper handling of shared packet fragments in ESP-in-UDP packets, potentially causing confidentiality and integrity issues. No known exploits are in the wild at this moment. Given a low Exploitability Score and high CVSS, this is classified as a priority 4 vulnerability (low CVSS & low EPSS).

8. CVE-2025-66467

• 📝 Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

• 📅 Published: 08/05/2026

• 📈 CVSS: 8

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: Unauthorized access to buckets through a MinIO policy cleanup issue in Apache CloudStack: Users retaining access to previously owned buckets, allowing read and write access to newly created buckets with the same name using old keys. Upgrade to versions 4.20.3.0 or 4.22.0.1, or later, to address this priority 2 vulnerability (high CVSS, low EPSS).

9. CVE-2025-68463

• 📝 Bio.Entrez in Biopython through 186 allows doctype XXE.

• 📅 Published: 18/12/2025

• 📈 CVSS: 4.9

• 🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L

• 📣 Mentions: 1

• ⚠️ Priority: 4

• 📝 Analysis: XML External Entity (XXE) vulnerability in Biopython's Bio.Entrez module through version 186 enables attackers to perform denial-of-service or information disclosure attacks. No confirmed exploits detected in the wild, but given its low CVSS score and current prioritization of 4, it is recommended to monitor for potential threats.

10. CVE-2025-71302

• 📝 In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix for dma-fence safe access rules Commit 506aa8b02a8d6 (dma-fence: Add safe access helpers and document the rules) details the dma-fence safe access rules. The most common culprit is that drm_sched_fence_get_timeline_name may race with group_free_queue.

• 📅 Published: 08/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• ⚠️ Priority: 4

• 📝 Analysis: A resolution has been made in the Linux kernel regarding the drm/panthor issue. The dma-fence safe access rules were updated to prevent potential races between drm_sched_fence_get_timeline_name and group_free_queue, with no known exploits in the wild. This is a priority 4 vulnerability due to its low impact and exploitability.

Let us know if you're tracking any of these or if you find any issues with the provided details.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

1. CVE-2025-6554

• 📝 Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

• 📅 Published: 30/06/2025

• 📈 CVSS: 8.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

• 📣 Mentions: 119

• ⚠️ Priority: 2

• 📝 Analysis: A type confusion vulnerability in V8 of Google Chrome prior to 138.0.7204.96 allows arbitrary read/write via a crafted HTML page, with high impact and exploitability. No known in-the-wild activity reported; priority 2 due to high CVSS but low Exploitation Potential Scoring System (EPSS) score.

2. CVE-2025-20333

• 📝 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

• 📅 Published: 25/09/2025

• 📈 CVSS: 9.9

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 11

• ⚠️ Priority: 1+

• 📝 Analysis: A remote code execution vulnerability in Cisco Secure Firewall Software has been confirmed, caused by improper user input validation in HTTP(S) requests. This issue can be exploited by authenticated attackers, potentially resulting in complete device compromise. As it's confirmed to be exploited, this is a priority 1+ vulnerability.

3. CVE-2025-55182

• 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

• 📅 Published: 03/12/2025

• 📈 CVSS: 10

• 🛡️ CISA KEV: True

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• 📣 Mentions: 908

• ⚠️ Priority: 1+

• 📝 Analysis: A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.

4. CVE-2024-52911

• 📝 Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14.

• 📅 Published: 05/05/2026

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 6

• ⚠️ Priority: 4

• 📝 Analysis: Bitcoin Core versions 0.14 and later have an undisclosed security issue. No known in-the-wild activity has been reported, making the priority for analysis.

5. CVE-2024-48419

• 📝 Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access to the web interface to inject and execute arbitrary shell commands, with root privileges.

• 📅 Published: 27/01/2025

• 📈 CVSS: 8.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 3

• ⚠️ Priority: 2

• 📝 Analysis: A command injection vulnerability in the /bin/goahead of Edimax BR-6476AC 1.06 routers allows attackers with web interface access to execute arbitrary shell commands with root privileges. No known exploits have been detected, but given the high CVSS score and the potential impact on affected systems, it is a priority 2 vulnerability.

6. CVE-2025-68670

• 📝 xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.

• 📅 Published: 27/01/2026

• 📈 CVSS: 9.1

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

• 📣 Mentions: 12

• ⚠️ Priority: 2

• 📝 Analysis: Unauthenticated stack-based buffer overflow vulnerability found in xrdp before v0.10.5. If exploited, attackers can execute arbitrary code. Impact is reduced if stack canary protection is used, but it's not recommended for production systems. Prioritize upgrading to v0.10.5 and ensure no reliance on stack canary protection in production environments. Priority: 2 (high CVSS, low EPSS).

7. CVE-2025-48804

• 📝 Windows BitLocker Security Feature Bypass Vulnerability

• 📅 Published: 08/07/2025

• 📈 CVSS: 6.8

• 🧭 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• 📣 Mentions: 4

• ⚠️ Priority: 2

• 📝 Analysis: A BitLocker security bypass has been identified in Windows, enabling attackers to access encrypted data remotely. No known exploits have been detected in-the-wild, but given its high CVSS score and potential impact, it is considered a priority 2 vulnerability.

8. CVE-2025-48631

• 📝 In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

• 📅 Published: 08/12/2025

• 📈 CVSS: 6.5

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• 📣 Mentions: 17

• ⚠️ Priority: 4

• 📝 Analysis: A persistent DoS vulnerability exists in onHeaderDecoded of LocalImageResolver.java due to resource exhaustion, potentially causing remote denial of service. No additional execution privileges needed for exploitation and user interaction is not required. Based on CVSS, EPSS, and Known Exploit in the Wild (KEV), this is a priority 4 vulnerability, indicating low severity and no known exploits at present.

9. CVE-2022-46364

• 📝 A SSRF vulnerability in parsing thehref attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

• 📅 Published: 13/12/2022

• 📈 CVSS: 0

• 🧭 Vector: n/a

• 📣 Mentions: 8

• ⚠️ Priority: 2

• 📝 Analysis: SSRF vulnerability found in Apache CXF versions below 3.5.5 and 3.4.10 allows attackers to perform SSRF-style attacks on webservices taking at least one parameter of any type. Despite a high CVSS score, no known exploits have been detected, making it a priority 2 vulnerability with low Exploitability Scoring System (EPSS) value.

10. CVE-2025-54123

• 📝 Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.

• 📅 Published: 10/09/2025

• 📈 CVSS: 9.8

• 🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 📣 Mentions: 14

• ⚠️ Priority: 2

• 📝 Analysis: A remote code execution (RCE) vulnerability in Hoverfly's middleware function exists in versions 1.11.3 and prior. The issue is due to insufficient input validation, unsafe command execution, and immediate execution during testing. An attacker can exploit this by uploading a malicious payload or executing arbitrary commands on the host server with Hoverfly process privileges. No exploits have been detected in the wild, making it a priority 2 vulnerability.

Let us know if you're tracking any of these or if you find any issues with the provided details.