60
60
60
60
60
60
57
Microsoft Patches 130 Vulnerabilities, Including Critical Flaws in SPNEGO and SQL Server
60
60
60
60
60
60
60
60
60
60
60
The Apple Security Update Review for September 2026
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.
75
CitrixBleed 2 Vulnerability Exploited
60
60
60
60
60
60
SolarWinds Web Help Desk Exploited for RCE in Multi
60
60
December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
60
60
November 2025 CVE Landscape: 10 Critical Vulnerabilities Show 69% Drop from October
60
60
60
60
Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability
60
60
60
60
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.
72
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60