Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known …
Every CISA KEV addition, plus critical-severity flaws in the kit that sits at the edge of a network: firewalls, VPN gateways, load balancers, routers, switches and management consoles.
Colour on the left of each entry is the CVSS severity. A pink CISA KEV badge means the flaw is being exploited right now — treat those first, whatever the score says. How each post is sourced and checked is set out in the methodology.
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be …
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
A logic flaw in Cisco ASA/FTD’s SSL VPN handling lets an unauthenticated attacker send a crafted connection request and force the firewall to reload, knocking out VPN and firewall service.
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a …
Vulnerabilities in Node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical …
Broadcom VMWare ESX Insufficient Logging Vulnerability
A logging gap in VMware ESX lets an administrator who already holds privileged access perform certain actions without those actions appearing in the audit trail, weakening post-incident forensics.
Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker …
Vulnerabilities in node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical …
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
A file-upload flaw in Adobe Commerce and Magento lets an attacker who tricks a logged-in user into clicking a crafted link run code and hijack that user’s session, and it’s already being exploited.
Google Brotli Unchecked Return Value Vulnerability
A flawed check in Brotli’s decompression code lets a crafted compressed stream corrupt decoder memory, with no login needed, potentially exposing data, crashing the process, or running attacker code.