Vulnerabilities
120 articles RSS
Adobe Rushes Out Acrobat Reader Patch for Zero-Day Exploited Since December
Adobe says CVE-2026-34621 is under active exploitation in Acrobat and Reader; the flaw can lead to arbitrary code execution and prompted a CISA KEV deadline.
CISA Adds 13-Year-Old Apache ActiveMQ RCE to KEV Catalog, Giving Federal Agencies Two Weeks to Patch a Bug Found by Claude in Ten Minutes
CISA added CVE-2026-34197, a 13-year-old remote code execution flaw in Apache ActiveMQ Classic, to its Known Exploited Vulnerabilities catalog on April 16 as Horizon3.ai's Naveen Sunkavally described finding the chain with Anthropic's Claude in about ten minutes.
Cisco Patches Four Critical Flaws in Identity Services Engine and Webex, Including a 9.8-Severity SSO Bypass
Cisco discloses four critical vulnerabilities across ISE and Webex, with the most severe allowing unauthenticated attackers to impersonate any user via a broken SSO certificate check.
Microsoft's April 2026 Patch Tuesday Ships 163 Fixes, Including an Exploited SharePoint Spoofing Flaw and a Publicly Disclosed Defender Escalation
April's update is Microsoft's second-largest Patch Tuesday on record, with 8 critical flaws, two zero-days, and privilege escalation bugs accounting for well over half of the patches.
Wasmtime Ships Largest-Ever Security Patch After LLM-Driven Audit Uncovers 12 Vulnerabilities Including Two Critical Sandbox Escapes
The Bytecode Alliance patches 12 Wasmtime flaws, two critical, found during a three-week LLM-assisted security sprint by Mozilla, UCSD, Akamai, and F5.
Google Patches Fourth Chrome Zero-Day of 2026 as CISA Orders Federal Agencies to Update Within Two Weeks
Google patches CVE-2026-5281, a use-after-free in Chrome's Dawn WebGPU layer exploited in the wild, marking the fourth Chrome zero-day of 2026. CISA gives federal agencies until April 15 to update.
OpenAI Patches ChatGPT DNS Data Exfiltration Flaw and Codex Command Injection That Exposed GitHub Tokens
Check Point and BeyondTrust disclose two distinct vulnerabilities in OpenAI products that allowed covert data theft through DNS queries and GitHub token compromise via branch name injection.
Critical Citrix NetScaler Flaw Draws Active Reconnaissance as Security Firms Warn of Imminent Exploitation
CVE-2026-3055, a CVSS 9.3 memory overread in NetScaler ADC and Gateway, echoes the 2023 CitrixBleed vulnerability that led to mass exploitation, with over 30,000 instances exposed online.
Three Vulnerabilities in LangChain and LangGraph Expose Files, API Keys, and Databases Across Millions of AI Deployments
Security researchers disclose a critical deserialization flaw and two high-severity bugs in the most widely downloaded AI framework on PyPI, with patches now available.
Oracle Issues Rare Emergency Patch for Critical Pre-Auth RCE in Identity Manager as Second Out-of-Band Fix in Four Months Signals Persistent Middleware Risk
Oracle releases out-of-band patch for CVE-2026-21992, a CVSS 9.8 unauthenticated RCE flaw in Identity Manager and Web Services Manager, just months after a similar vulnerability was actively exploited in the wild.
PolyShell Vulnerability Hits 57 Percent of Vulnerable Magento Stores as Mass Exploitation Escalates Without a Production Patch
A critical unauthenticated file upload flaw in Magento and Adobe Commerce, dubbed PolyShell, has been exploited at scale since March 19 with no production patch available.
Interlock Ransomware Exploited Cisco Firewall Zero-Day for 36 Days Before Patch
Amazon threat intelligence reveals that the Interlock ransomware group exploited a critical Cisco Secure Firewall Management Center zero-day vulnerability for over five weeks before Cisco disclosed and patched the flaw in early March 2026.