60
60
Containers on fire: from container escapes to supply chain attacks
60
60
2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
SAP patched two critical flaws, OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240), allowing unauthenticated attackers to execute OS commands on SAP hosts.
On SAP's September 2026 Security Patch Day, SAP released Security Notes 3747649 and 3759472 fixing two critical unauthenticated remote vulnerabilities found by Onapsis. CVE-2026-44756 ('OVERPASS', CVSS 10.0) is a memory corruption flaw in Extended Passport (EPP) deserialisation in the SAP Kernel; CVE-2026-58240 ('S4GET', CVSS 9.8) is a missing authentication check in the NetWeaver Message Server that lets attackers register as trusted cluster nodes. Successful exploitation of either can yield OS command execution as the SAP service account, leading to full system and business data compromise, and CERT-EU urges immediate patching. No in-the-wild exploitation is reported.
75
"Patched" but still exposed: US federal agencies must remediate Cisco flaws (again)
60
Microsoft Patch Tuesday, September 2025 Edition
60
60
Operation Triangulation: The last (hardware) mystery
60
Microsoft Issues Patches for 90 Flaws, Including 10 Critical Zero
60
CISA Adds Another 95 Flaws to its Actively Exploited Vulnerabilities Catalog
60
60
60
Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited
60
60
60
Apple Issues Urgent Patches for 2 Zero
60
60
60
60
60
60
Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities
60
60
60
60
60
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
60
60
60
Qualcomm Releases Patch for 3 new Zero
60
Microsoft releases 12 Security Updates; Including 6 Critical Patches
60
60
60
November 2025 CVE Landscape: 10 Critical Vulnerabilities Show 69% Drop from October
60
60
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero
60
60
60