Posts tagged “CVE”
CVE-2024-27834: Apple Pointer Authentication Bypass Added to CISA KEV
CVE-2024-27834 lets attackers bypass Apple's Pointer Authentication. CISA added it to its KEV list on Nov 4, 2026. Affected versions and update steps inside.
Brotli buffer overflow (CVE-2026-111497): which versions are affected?
CVE-2026-111497 in Google Brotli is on CISA's exploited list. See which versions are affected, the fixed releases and how to check your systems.
Cisco ASA and FTD VPN denial-of-service flaw: CVE-2026-76418
CVE-2026-76418 (CVSS 8.6) hits Cisco ASA and FTD SSL VPN and is on CISA's KEV list. Check if you are affected, and what to patch or mitigate now.
GitLab CVE-2026-97229: remote code execution through CI/CD configuration
Critical CVE-2026-97229 in GitLab CE and EE, CVSS 10.0. Affected versions, fixed releases, the CISA deadline and what to do now.
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: what to do now
Root privilege escalation (CVE-2026-111357) and file upload (CVE-2026-118527) in Ivanti Connect Secure: affected versions, CISA deadlines and the fixes.
CVE-2026-46300 in the Linux kernel: skbuff flaw and update guide
CVE-2026-46300 in the Linux kernel, now on CISA's exploited list. Fixed distro versions and the update steps you need to take.
Adobe Commerce and Magento file upload flaw: CVE-2026-48356
CVE-2026-48356 lets dangerous file types be uploaded in Adobe Commerce and Magento. CISA lists it as actively exploited. Affected versions and fixes.
Remote code execution in Nextcloud's Collabora CODE server: CVE-2026-110447
CVE-2026-110447 in Nextcloud's built-in Collabora CODE server is on CISA's KEV list. Fixed in richdocumentscode 26.4.303. No workaround. Here is what to do.
PHP memory corruption flaws: CVE-2026-109618 and CVE-2026-109619
Two flaws in PHP 8.2 to 8.5 can lead to unauthenticated remote code execution. Here are the fixed versions and what to do now.
Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625): actively exploited
Arista VeloCloud Orchestrator on-prem SQL injection (CVE-2026-114625, CVSS 9.4). On CISA's KEV list and actively exploited. Affected versions and next steps.
VMware ESX insufficient logging flaw: CVE-2026-41709
VMware ESX insufficient logging flaw (CVE-2026-41709). CVSS 2.7 but listed in CISA KEV. Fixed builds and what to do now.
WordPress core CVE-2026-119977: code execution during core upgrades
WordPress core CVE-2026-119977 (CVSS 8.1, on CISA KEV). Versions 4.7 to 7.1.3 are affected, 7.1.4 fixes it. What it is and what to do.