CVE-2026-20093 affects Cisco Integrated Management Controller with a CVSS score of 9.8. An unauthenticated attacker can change any user password including Admin. Technical analysis and remediation procedures for UCS servers in production.
CVE-2025-55182 (CVSS 10.0) affects React Server Components and Next.js App Router. The UAT-10608 group (Cisco Talos) exploits the flaw to automatically harvest database credentials, SSH keys, AWS secrets, GitHub tokens, and Stripe keys from 766 confirmed hosts.
Google fixes CVE-2026-5281, a use-after-free in Dawn (WebGPU implementation) actively exploited in the wild. Chrome's 4th zero-day of 2026. All Chromium browsers affected.
CVE-2026-0625 (CVSS 9.8) affects end-of-life D-Link DSL routers. No patch will ever be released. Learn how to detect if you are exposed and what actions to take immediately.
F5 reclassifies CVE-2025-53521 from DoS to critical RCE (CVSS 9.8) in March 2026. In-memory-only webshells deployed, attackers linked to China.
A flaw in Microsoft Excel allows Copilot Agent to exfiltrate data without user interaction. Zero-click, critical, patch available since March 10.
The Ni8mare vulnerability in n8n allows unauthenticated full server takeover. CVSS 10.0, 100,000 estimated vulnerable instances, 26,512 detected by Censys.
Critical flaw in GNU InetUtils telnet daemon allows unauthenticated remote root code execution. 3,362 hosts directly exposed on the Internet.
Citrix patches CVE-2026-3055 (CVSS 9.3), a NetScaler ADC/Gateway flaw allowing sensitive memory reads via SAML. Analysis and remediation.
Analysis of CVE-2026-20131, a deserialization flaw in Cisco Secure Firewall Management Center. Maximum CVSS score, exploited by Interlock group since January 2026.
CVE-2026-22557 in Ubiquiti UniFi Network Application allows full system takeover. Hardening guide and exposure verification.
Analysis of CVE-2026-21992, a critical Oracle Identity Manager vulnerability allowing unauthenticated remote code execution. Patch available.
CVE-2026-3094 reveals a backdoor in XZ Utils, a compression utility present on nearly all Linux systems. Analysis of a historic near-miss.
Technical analysis of CVE-2026-33017, a critical Langflow vulnerability allowing unauthenticated remote code execution. Exploited within 20 hours of disclosure.
Analysis of the March 2026 Patch Tuesday: 84 vulnerabilities patched by Microsoft, including 2 publicly disclosed zero-days, plus critical Chrome and Android fixes.