60
60
60
60
60
60
60
60
60
September 2025 CVE Landscape
60
60
Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2
CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.
Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.
70
Network Attack Trends: Internet of Threats (November 2020
60
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
60
60
Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped
60
Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras
Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.
Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.
72
September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows
Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.
Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.
84
60
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
60
Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products
60
Muhstik Botnet Targeting Redis Servers Using Recently Disclosed Vulnerability
60
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
60
60
Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network Platforms
60
60
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
60
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
50
60
⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply
60
⚡ Weekly Recap: iPhone Spyware, Microsoft 0-Day, TokenBreak Hack, AI Data Leaks and More
60
60
⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens
60