CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026
60
55
60
60
60
60
55
30
30
Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
60
2026-001: Critical vulnerabilities in Ivanti EPMM
Ivanti EPMM has two critical CVSS 9.8 flaws allowing unauthenticated remote code execution; limited exploitation has already been observed.
On 29 January 2026, Ivanti patched CVE-2026-1281 and CVE-2026-1340, two code injection vulnerabilities (both CVSS 9.8) in Endpoint Manager Mobile that allow unauthenticated remote code execution. CERT-EU reports one of the flaws was exploited in a limited number of cases. Affected versions include EPMM 12.5.1.0, 12.6.1.0 and 12.7.0.0 and prior; the permanent fix is planned for release 12.8.0.0 in Q1 2026.
72
55
60
30
57
Microsoft fixes critical wormable Windows flaw (CVE-2025-47981)
60
60
60
30
60
60
Microsoft Offers $60,000 Bounty for Critical Cross-Tenant Vulnerabilities
Microsoft expands Dynamics 365 and Power Platform bug bounty, paying up to $60,000 for critical cross-tenant vulnerabilities.
Microsoft expanded its bounty incentives for Dynamics 365 and Power Platform, with qualifying rewards from $1,250 to $60,000. Critical cross-tenant vulnerabilities receive a 100% award multiplier and important ones 50%, while critical AI inference manipulation or inferential disclosure can earn up to $30,000. Scope covers Dynamics 365 apps, Power Apps, Power Automate, Copilot Studio, Power Pages, Dataverse, and selected on-premises products. Reports must be rated Critical or Important and submitted via the MSRC Researcher Portal.
18
42
45
AI Agents Are Here. So Are the Threats.
Unit 42 demonstrates nine framework-agnostic attack scenarios against AI agents built with CrewAI and AutoGen, causing data leakage, credential theft and remote code execution.
Palo Alto Networks Unit 42 investigated how attackers can target agentic applications, implementing two functionally identical apps with the open-source CrewAI and AutoGen frameworks and executing the same attacks on both. Nine attack scenarios produce outcomes including information leakage, credential theft, tool exploitation and remote code execution. Findings show most vulnerabilities are framework-agnostic, arising from insecure design patterns, misconfigurations and unsafe tool integrations rather than flaws in the frameworks themselves. The team published defense strategies per scenario and open-sourced the source code and datasets on GitHub.
58
55
60
U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog
60
60
60
57
55
60
30
42
60
57
55
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
SAP patched a CVSS 10.0 unauthenticated RCE flaw (CVE-2026-58231) in Commerce Cloud's Data Hub Adapter, plus three critical flaws in NetWeaver and Manufacturing.
SAP's August 2026 updates fix CVE-2026-58231, a CVSS 10.0 flaw in Commerce Cloud's Data Hub Adapter where insufficient authorization checks and input validation let unauthenticated attackers execute arbitrary code. Onapsis urged customers to patch and redeploy, with an IP Filter Set on the vulnerable endpoint offered as a temporary workaround. The update also fixed CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS 9.1), code injection flaws in Manufacturing Integration and Intelligence involving SSRF and SSTI, and CVE-2026-34265 (CVSS 9.8), an out-of-bounds write in NetWeaver ABAP's DIAG protocol parsing that can leak information or crash systems.
60
60