Cve
Curated coverage and analysis in this editorial area.
Metabase Zero-Day CVE-2026-72898: Active Exploitation, CVSS 10.0, Wide Blast Radius
A maximum-severity CVSS 10.0 zero-day struck Metabase on August 2, 2026. The attack, confirmed against the vendor's cloud infrastructu…
SonicWall Email Security: Local Privilege Escalation from CLI to Root via Command Injection
CVE-2026-66149 enables local privilege escalation in SonicWall Email Security. A patch is available, but the security perimeter remain…
ShinyHunters Exploited Oracle PeopleSoft Zero-Day for Two Weeks
CVE-2026-35273 hit over 100 notified organizations, 68% universities, via an SSRF-to-unauthenticated-RCE chain. CISA added it to the K…
Galaxy S25: A TIFF File Can Trigger Remote Code Execution
CVE-2026-21045 strikes the Galaxy S25's Quram library. Heap overflow in TIFF parsing carries a CVSS 8.4 score, with a three-month gap…
Flowise Removes Airtable and CSV Agents After Critical RCE (CVSS 9.4)
The low-code AI orchestration platform Flowise has entirely removed its AirtableAgent and CSVAgent components to address an unauthenti…
Passkey Bypass: Three Studies Shatter FIDO2's 'Anti-Phishing' Promise
On August 3, 2026, researchers from SpecterOps, Palo Alto Networks Unit 42, and independent researcher Dirk-jan Mollema published dist…
fTPM 2.0 Compromised: AMD and Intel Forced to Patch the Root of Trust
Two critical vulnerabilities in the shared fTPM 2.0 firmware used by AMD and Intel expose cryptographic secrets and enable key forgery…
Gunra Hits Critical Infrastructure with Dual Fortinet Exploit
CISA, FBI, NSA, and South Korean police issued joint advisory AA26-222A on Gunra: 51 confirmed victims, MFA bypass, and persistence th…
TONTOU: The Attack That Nullifies Spectre v2 Mitigations and Leaks Linux Passwords
MIT CSAIL researchers demonstrated a bypass of Spectre v2 mitigations on Linux at Black Hat USA 2026. TONTOU extracts password hashes…
Apple Patches Decade-Old Zero-Day in iOS Core: dyld Exposed for 10+ Years
CVE-2026-20700 affects the dyld dynamic linker, a fundamental component present for over a decade. Apple confirms targeted exploitatio…
Citrix NetScaler in the Crosshairs: Pre-Auth RCE via SAML Heap Overflow, Likely CVE-2026-8452
WatchTowr Labs has reverse-engineered a critical pre-authentication remote code execution flaw in Citrix NetScaler ADC/Gateway. The vu…
Cursor IDE Executes Code from Poisoned Repositories: 7 Months of Silence, No Patch
Mindgard disclosed a vulnerability in the popular Cursor IDE that allows automatic execution of malicious code via a poisoned git.exe…