Cve
Curated coverage and analysis in this editorial area.
Microsoft Patch Tuesday July 2026: Two Zero-Days, and the CVSS 5.3 Is More Dangerous Than the 7.8
Microsoft's July 2026 Patch Tuesday addressed 570 CVEs, including two actively exploited zero-days: CVE-2026-56164 in SharePoint Serve…
CVE-2026-16232: Check Point SmartConsole Zero-Day Actively Exploited in the Wild
Check Point confirms active exploitation of CVE-2026-16232, an authentication bypass with a CVSS 9.3 score in SmartConsole. CISA has a…
BIN Project Files as Weapons: The Delta Electronics DTM Soft Flaw That Turns Engineering Data into Code Execution
A deserialization vulnerability in Delta Electronics DTM Soft allows remote code execution via malicious BIN project files. With a CVS…
Windmill Under Attack: Active Path Traversal on 170 Exposed Servers
CVE-2026-29059 hits the Windmill automation platform with an unauthenticated path traversal. A patch has existed since January, yet th…
Metasploit Drops Two Modules: FlowiseAI RCE and macOS Privilege Escalation
The Metasploit Framework adds exploit modules for CVE-2026-41264 in FlowiseAI and CVE-2024-27822 in macOS PackageKit. Both are product…
OpenSSL's Unsettling Discrepancy: An X.509 Flaw Caught Between Information Disclosure and DoS
CVE-2026-42771 hits OpenSSL with a CVSS 6.5. ZDI calls it information disclosure; CVE.org points to likely DoS. The split complicates…
WatchGuard FireWare OS: IKEv2 Bug Enables Remote DoS with a Single Packet
A null pointer dereference in WatchGuard FireWare OS exposes firewalls with active IKEv2 VPN to remote denial-of-service. CVE-2026-130…
Samsung rlottie: RCE Bug in Lottie Files Masked by a "Medium" CVSS
A numeric truncation flaw in Samsung rlottie enables remote code execution via malicious Lottie animations. The CVSS 5.5 rating unders…
Autel EV Charger: Remote RCE via OCPP WebSocket, Discovered at Pwn2Own
The ZDI-26-437 vulnerability in the Autel MaxiCharger AC Elite Home enables pre-authentication remote code execution via an integer un…
CVE-2026-6071: RCE in Rockwell Arena Simulation via Malicious DOE File
Trend Micro's Zero Day Initiative disclosed CVE-2026-6071, an out-of-bounds write in Rockwell Automation Arena Simulation's DOE file p…
NVIDIAScape: Container Escape in Three Lines of Code in the NVIDIA Toolkit
CVE-2025-23266, rated CVSS 9.0, affects 37% of AI cloud environments. An old-school bug in the NVIDIA Container Toolkit enables privil…
SonicWall SMA 1000: The Unexpected Backdoor — Active Exploitation and a 72-Hour Patch Window
SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, 2026: active exploitation since June 22, public PoC, and a mandatory…