January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero
60
60
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross
60
Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities
60
60
57
Containers on fire: from container escapes to supply chain attacks
60
Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
60
2026-001: Critical vulnerabilities in Ivanti EPMM
Ivanti EPMM has two critical CVSS 9.8 flaws allowing unauthenticated remote code execution; limited exploitation has already been observed.
On 29 January 2026, Ivanti patched CVE-2026-1281 and CVE-2026-1340, two code injection vulnerabilities (both CVSS 9.8) in Endpoint Manager Mobile that allow unauthenticated remote code execution. CERT-EU reports one of the flaws was exploited in a limited number of cases. Affected versions include EPMM 12.5.1.0, 12.6.1.0 and 12.7.0.0 and prior; the permanent fix is planned for release 12.8.0.0 in Q1 2026.
72
Microsoft fixes critical wormable Windows flaw (CVE-2025-47981)
60
60
60
60
Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL
ServiceNow patched four AI Platform flaws, including three pre-authentication CVSS 10.0 issues enabling unauthenticated code execution, SQL injection, and privilege escalation.
ServiceNow released patches on August 27, 2026 for four AI Platform flaws: CVE-2026-18885 (code injection in the GraphQL Composite Data API), CVE-2026-18886 (improper access control enabling privilege escalation), and CVE-2026-74820 (SQL injection), all self-rated CVSS 10.0 and exploitable without authentication, plus CVE-2026-6876, an 8.7 sandbox escape. Updates were deployed to hosted instances, but self-hosted customers must patch affected Xanadu, Yokohama, Zurich, and Australia release lines themselves. ServiceNow says it is not aware of exploitation of the new flaws, and no public exploit code existed as of August 28, 2026; separately, Defused reported in-the-wild exploitation of the earlier CVE-2026-6875 (CVSS 9.5), later noting the captured payload matched Searchlight Cyber's PoC.
70
Sophos fixed critical vulnerabilities in its Firewall product
60
60
Vulnerability Spotlight: Vulnerabilities in Lansweeper could lead to JavaScript, SQL injections
60
60
60
60
Ivanti Patches Critical Flaws in Connect Secure and Policy Secure
60
60
Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager
60
60
60
60
60
60
60
Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
60
Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
60
60
60
A "light" February 2022 Patch Tuesday that should not be ignored
60
CISA Flags Langflow RCE, Tomcat, and N
60
Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws
60
60
Fortinet Rolls Out Critical Security Patches for FortiClientLinux Vulnerability
60
60
60